GHSA-c9v7-wmwj-vf6x: Withdrawn Advisory: SFTP is possible on the Proxy server for any user with SFTP access

January 3, 2024 (updated September 6, 2024)

An attacker that has access to nodes within the cluster may be able to SFTP to the Proxy Service. The user’s permissions on the Proxy server are still respected, so files can only be read or modified on the Proxy if the user has system access to read or write to them.

References

github.com/advisories/GHSA-c9v7-wmwj-vf6x
github.com/gravitational/teleport
github.com/gravitational/teleport/commit/1c77fc49944ebcded32bbdd77c3e1f4f8a1c130d
github.com/gravitational/teleport/pull/36136
github.com/gravitational/teleport/security/advisories/GHSA-c9v7-wmwj-vf6x

Code Behaviors & Features

Detect and mitigate GHSA-c9v7-wmwj-vf6x with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →