gravitational · r0mant · Oct 11, 2023 · Oct 11, 2023 · Oct 11, 2023 · Oct 11, 2023
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,43 @@
 # Changelog
 
+## 13.4.3 (10/11/23)
+
+### Security Fixes
+
+#### [Critical] Privilege escalation through `RecursiveChown`
+
+When using automatic Linux user creation, an attacker could exploit a race
+condition in the user creation functionality to `chown` arbitrary files on the
+system.
+
+Users who aren't using automatic Linux host user creation aren’t affected by
+this vulnerability.
+
+[#33247](https://github.com/gravitational/teleport/pull/33247)
+
+### Other Fixes
+
+* Fixed multiple discovery install attempts on Azure & GCP VMs [#32570](https://github.com/gravitational/teleport/pull/32570)
+* Fixed Access List caching & eventing issues [#32651](https://github.com/gravitational/teleport/pull/32651)
+* Teleport client now uses gRPC when creating tracing client [#32664](https://github.com/gravitational/teleport/pull/32664)
+* Fixed a corner case of privilege tokens where MFA devices disabled by cluster settings were still counted against the user [#32668](https://github.com/gravitational/teleport/pull/32668)
+* Fixed spurious timeouts in Database Access Sessions Fixed spurious timeouts in Database Access Sessions
+* Added connection information to multiplexer logs [#32739](https://github.com/gravitational/teleport/pull/32739)
+* Fixed panic on `tsh device enroll --current-device` [#32757](https://github.com/gravitational/teleport/pull/32757)
+* Added Discover flow for enrolling EC2 Instances with Instance Connect Endpoint [#32766](https://github.com/gravitational/teleport/pull/32766)
+* The Teleport `etcd` backend will now start if some nodes are unreachable [#32778](https://github.com/gravitational/teleport/pull/32778)
+* Adds Audit Review recurrence presets [#32961](https://github.com/gravitational/teleport/pull/32961)
+* Fixed issue causing keys to be incorrectly removed in tsh and Teleport Connect on Windows  [#32964](https://github.com/gravitational/teleport/pull/32964)
+* Added cost optimized pagination search for athena [#33006](https://github.com/gravitational/teleport/pull/33006)
+* Allow "auth unreachable" error message to be configurable [#33037](https://github.com/gravitational/teleport/pull/33037)
+* Fixed user session tracking across trusted clusters [#32996](https://github.com/gravitational/teleport/pull/32996)
+* Fixed issue when playing back a session recorded on a leaf cluster  [#33104](https://github.com/gravitational/teleport/pull/33104)
+* Teleport now reports initial command to session moderators [#33113](https://github.com/gravitational/teleport/pull/33113)
+* OneOff install script now installs enterprise Teleport when generated by an enterprise cluster [#33147](https://github.com/gravitational/teleport/pull/33147)
+* Fixed self-signed certificate issue on macOS [#33157](https://github.com/gravitational/teleport/pull/33157)
+* Discovery EC2 instance listing now shows instance name [#33178](https://github.com/gravitational/teleport/pull/33178)
+* Improved error messaging in `tsh kube credentials` when root cluster roles don't allow Kube access [#33211](https://github.com/gravitational/teleport/pull/33211)
+
 ## 13.4.1 (09/26/23)
 
 * Fixed `create_host_user_mode` issue with TeleportRole in the Teleport Operator CRDs [#32556](https://github.com/gravitational/teleport/pull/32556)

diff --git a/Makefile b/Makefile
@@ -11,7 +11,7 @@
 #   Stable releases:   "1.0.0"
 #   Pre-releases:      "1.0.0-alpha.1", "1.0.0-beta.2", "1.0.0-rc.3"
 #   Master/dev branch: "1.0.0-dev"
-VERSION=13.4.1
+VERSION=13.4.3
 
 DOCKER_IMAGE ?= teleport
 

diff --git a/api/version.go b/api/version.go
diff --git a/build.assets/macos/tsh/tsh.app/Contents/Info.plist b/build.assets/macos/tsh/tsh.app/Contents/Info.plist
@@ -19,13 +19,13 @@
 		<key>CFBundlePackageType</key>
 		<string>APPL</string>
 		<key>CFBundleShortVersionString</key>
-		<string>13.4.1</string>
+		<string>13.4.3</string>
 		<key>CFBundleSupportedPlatforms</key>
 		<array>
 			<string>MacOSX</string>
 		</array>
 		<key>CFBundleVersion</key>
-		<string>13.4.1</string>
+		<string>13.4.3</string>
 		<key>DTCompiler</key>
 		<string>com.apple.compilers.llvm.clang.1_0</string>
 		<key>DTPlatformBuild</key>

diff --git a/build.assets/macos/tshdev/tsh.app/Contents/Info.plist b/build.assets/macos/tshdev/tsh.app/Contents/Info.plist
@@ -17,13 +17,13 @@
 		<key>CFBundlePackageType</key>
 		<string>APPL</string>
 		<key>CFBundleShortVersionString</key>
-		<string>13.4.1</string>
+		<string>13.4.3</string>
 		<key>CFBundleSupportedPlatforms</key>
 		<array>
 			<string>MacOSX</string>
 		</array>
 		<key>CFBundleVersion</key>
-		<string>13.4.1</string>
+		<string>13.4.3</string>
 		<key>DTCompiler</key>
 		<string>com.apple.compilers.llvm.clang.1_0</string>
 		<key>DTPlatformBuild</key>

diff --git a/examples/chart/teleport-cluster/Chart.yaml b/examples/chart/teleport-cluster/Chart.yaml
@@ -1,4 +1,4 @@
-.version: &version "13.4.1"
+.version: &version "13.4.3"
 
 name: teleport-cluster
 apiVersion: v2

diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/Chart.yaml b/examples/chart/teleport-cluster/charts/teleport-operator/Chart.yaml
@@ -1,4 +1,4 @@
-.version: &version "13.4.1"
+.version: &version "13.4.3"
 
 name: teleport-operator
 apiVersion: v2

diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/auth_deployment_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/auth_deployment_test.yaml.snap
@@ -1,6 +1,6 @@
 should add an operator side-car when operator is enabled:
   1: |
-    image: public.ecr.aws/gravitational/teleport-operator:13.4.1
+    image: public.ecr.aws/gravitational/teleport-operator:13.4.3
     imagePullPolicy: IfNotPresent
     livenessProbe:
       httpGet:
@@ -41,7 +41,7 @@ should add an operator side-car when operator is enabled:
     - args:
       - --diag-addr=0.0.0.0:3000
       - --apply-on-startup=/etc/teleport/apply-on-startup.yaml
-      image: public.ecr.aws/gravitational/teleport-distroless:13.4.1
+      image: public.ecr.aws/gravitational/teleport-distroless:13.4.3
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:
@@ -174,7 +174,7 @@ should set nodeSelector when set in values:
     - args:
       - --diag-addr=0.0.0.0:3000
       - --apply-on-startup=/etc/teleport/apply-on-startup.yaml
-      image: public.ecr.aws/gravitational/teleport-distroless:13.4.1
+      image: public.ecr.aws/gravitational/teleport-distroless:13.4.3
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:
@@ -271,7 +271,7 @@ should set resources when set in values:
     - args:
       - --diag-addr=0.0.0.0:3000
       - --apply-on-startup=/etc/teleport/apply-on-startup.yaml
-      image: public.ecr.aws/gravitational/teleport-distroless:13.4.1
+      image: public.ecr.aws/gravitational/teleport-distroless:13.4.3
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:
@@ -357,7 +357,7 @@ should set securityContext when set in values:
     - args:
       - --diag-addr=0.0.0.0:3000
       - --apply-on-startup=/etc/teleport/apply-on-startup.yaml
-      image: public.ecr.aws/gravitational/teleport-distroless:13.4.1
+      image: public.ecr.aws/gravitational/teleport-distroless:13.4.3
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:

diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/proxy_deployment_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/proxy_deployment_test.yaml.snap
@@ -5,7 +5,7 @@ should provision initContainer correctly when set in values:
       - wait
       - no-resolve
       - RELEASE-NAME-auth-v12.NAMESPACE.svc.cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:13.4.1
+      image: public.ecr.aws/gravitational/teleport-distroless:13.4.3
       name: wait-auth-update
     - args:
       - echo test
@@ -62,7 +62,7 @@ should set nodeSelector when set in values:
     containers:
     - args:
       - --diag-addr=0.0.0.0:3000
-      image: public.ecr.aws/gravitational/teleport-distroless:13.4.1
+      image: public.ecr.aws/gravitational/teleport-distroless:13.4.3
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:
@@ -123,7 +123,7 @@ should set nodeSelector when set in values:
       - wait
       - no-resolve
       - RELEASE-NAME-auth-v12.NAMESPACE.svc.cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:13.4.1
+      image: public.ecr.aws/gravitational/teleport-distroless:13.4.3
       name: wait-auth-update
     nodeSelector:
       environment: security
@@ -174,7 +174,7 @@ should set resources when set in values:
     containers:
     - args:
       - --diag-addr=0.0.0.0:3000
-      image: public.ecr.aws/gravitational/teleport-distroless:13.4.1
+      image: public.ecr.aws/gravitational/teleport-distroless:13.4.3
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:
@@ -242,7 +242,7 @@ should set resources when set in values:
       - wait
       - no-resolve
       - RELEASE-NAME-auth-v12.NAMESPACE.svc.cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:13.4.1
+      image: public.ecr.aws/gravitational/teleport-distroless:13.4.3
       name: wait-auth-update
     serviceAccountName: RELEASE-NAME-proxy
     terminationGracePeriodSeconds: 60
@@ -275,7 +275,7 @@ should set securityContext for initContainers when set in values:
     containers:
     - args:
       - --diag-addr=0.0.0.0:3000
-      image: public.ecr.aws/gravitational/teleport-distroless:13.4.1
+      image: public.ecr.aws/gravitational/teleport-distroless:13.4.3
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:
@@ -343,7 +343,7 @@ should set securityContext for initContainers when set in values:
       - wait
       - no-resolve
       - RELEASE-NAME-auth-v12.NAMESPACE.svc.cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:13.4.1
+      image: public.ecr.aws/gravitational/teleport-distroless:13.4.3
       name: wait-auth-update
       securityContext:
         allowPrivilegeEscalation: false
@@ -383,7 +383,7 @@ should set securityContext when set in values:
     containers:
     - args:
       - --diag-addr=0.0.0.0:3000
-      image: public.ecr.aws/gravitational/teleport-distroless:13.4.1
+      image: public.ecr.aws/gravitational/teleport-distroless:13.4.3
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:
@@ -451,7 +451,7 @@ should set securityContext when set in values:
       - wait
       - no-resolve
       - RELEASE-NAME-auth-v12.NAMESPACE.svc.cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:13.4.1
+      image: public.ecr.aws/gravitational/teleport-distroless:13.4.3
       name: wait-auth-update
       securityContext:
         allowPrivilegeEscalation: false

diff --git a/examples/chart/teleport-kube-agent/Chart.yaml b/examples/chart/teleport-kube-agent/Chart.yaml
@@ -1,4 +1,4 @@
-.version: &version "13.4.1"
+.version: &version "13.4.3"
 
 name: teleport-kube-agent
 apiVersion: v2