Starstruk Logo MarkStarstruk

v15.5.4

gravitational/teleportv15.5.4Jul 3, 2025by fheinecke

AI Summary

This is a critical security patch release (v15.5.4) that addresses a remote SSH authentication bypass vulnerability (CVE-2025-49825) affecting servers with Teleport SSH agents, OpenSSH-integrated deployments, and Teleport Git proxy deployments. The release also includes bug fixes for Windows desktop services, DynamoDB storage issues, and a memory leak in Kubernetes Access, along with a Go update to 1.23.10.

Key Highlights

  • Critical security fix: Remote SSH authentication bypass (CVE-2025-49825) affecting Teleport SSH agents, OpenSSH-integrated, and Git proxy deployments
  • Fixed memory leak in Kubernetes Access caused by resources not being cleaned up when clients terminate watch streams
  • Fixed Windows desktop sessions not terminating when idle timeout is exceeded
  • Fixed duplicated entries in `tctl inventory list` when using DynamoDB as cluster state storage
  • Updated WindowsDesktop and WindowsDesktopService APIs to use pagination to avoid message size limitations

New Features

  • Added `teleport-update status --is-up-to-date` flag to change return code based on update status
  • WindowsDesktop and WindowsDesktopService APIs now use pagination

Full Release Notes

## Description

### Security fixes

This release also includes fixes for the following security issues:

#### [Critical] Remote authentication bypass

* Removed special handling for `*ssh.Certificate` authorities in the `IsHostAuthority` and `IsUserAuthority` callbacks used by `x/crypto/ssh.CertChecker`. [#56254](https://github.com/gravitational/teleport/pull/56254)

Resolved an issue that allowed remote SSH authentication bypass on servers with Teleport SSH agents, OpenSSH-integrated deployments and Teleport Git proxy deployments.  [CVE-2025-49825](https://github.com/gravitational/teleport/security/advisories/GHSA-8cqv-pj7f-pwpc). Refer to the [RCA](https://trust.goteleport.com/resources?s=32t147ja8aawd6px7irxat&name=cve-2025-49825-rca) for the full details.

### Other fixes and improvements

* Updated WindowsDesktop and WindowsDesktopService APIs to use pagination to avoid exceeding message size limitations. [#56237](https://github.com/gravitational/teleport/pull/56237)
* Fixed duplicated entries in `tctl inventory list` when using DynamoDB as cluster state storage. [#56184](https://github.com/gravitational/teleport/pull/56184)
* Fixed an issue that could prevent Windows desktop sessions from terminating when the idle timeout was exceeded. [#56052](https://github.com/gravitational/teleport/pull/56052)
* Added the `teleport-update status --is-up-to-date` flag to change the return code based on the update status. [#55952](https://github.com/gravitational/teleport/pull/55952)
* Fixed a memory leak in Kubernetes Access caused by resources not being cleaned up when clients terminate watch streams. [#55769](https://github.com/gravitational/teleport/pull/55769)
* Updated Go to 1.23.10. [#55604](https://github.com/gravitational/teleport/pull/55604)

## Download
Download the current and previous releases of Teleport at https://goteleport.com/download.

## Plugins

Download the current release of Teleport plugins from the links below.
* Slack [Linux amd64](https://cdn.teleport.dev/teleport-access-slack-v15.5.4-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-slack-v15.5.4-linux-arm64-bin.tar.gz) 
* Mattermost [Linux amd64](https://cdn.teleport.dev/teleport-access-mattermost-v15.5.4-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-mattermost-v15.5.4-linux-arm64-bin.tar.gz)
* Discord [Linux amd64](https://cdn.teleport.dev/teleport-access-discord-v15.5.4-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-discord-v15.5.4-linux-arm64-bin.tar.gz)
* Terraform Provider [Linux amd64](https://cdn.teleport.dev/terraform-provider-teleport-v15.5.4-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/terraform-provider-teleport-v15.5.4-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/terraform-provider-teleport-v15.5.4-darwin-amd64-bin.tar.gz) | [macOS arm64](https://cdn.teleport.dev/terraform-provider-teleport-v15.5.4-darwin-arm64-bin.tar.gz) | [macOS universal](https://cdn.teleport.dev/terraform-provider-teleport-v15.5.4-darwin-universal-bin.tar.gz)
* Event Handler [Linux amd64](https://cdn.teleport.dev/teleport-event-handler-v15.5.4-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-event-handler-v15.5.4-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/teleport-event-handler-v15.5.4-darwin-amd64-bin.tar.gz)
* PagerDuty [Linux amd64](https://cdn.teleport.dev/teleport-access-pagerduty-v15.5.4-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-pagerduty-v15.5.4-linux-arm64-bin.tar.gz)
* Jira [Linux amd64](https://cdn.teleport.dev/teleport-access-jira-v15.5.4-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-jira-v15.5.4-linux-arm64-bin.tar.gz)
* Email [Linux amd64](https://cdn.teleport.dev/teleport-access-email-v15.5.4-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-email-v15.5.4-linux-arm64-bin.tar.gz)
* Microsoft Teams [Linux amd64](https://cdn.teleport.dev/teleport-access-msteams-v15.5.4-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-msteams-v15.5.4-linux-arm64-bin.tar.gz)

---

labels: security-patch=yes,security-patch-alts=v15.5.3