Arbitrary Code Execution Affecting github.com/gravitational/teleport/api/types package, versions <13.4.7 >=14.1.0 <14.1.3
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMGRAVITATIONALTELEPORTAPITYPES-6043909
- published 16 Nov 2023
- disclosed 2 Nov 2023
- credit jentfoo
How to fix?
Upgrade github.com/gravitational/teleport/api/types to version 13.4.7, 14.1.3 or higher.
Overview
Affected versions of this package are vulnerable to Arbitrary Code Execution during subcommand usage for SFTP implementation. An attacker could inject environment variables into the execution of this subcommand, via shell init scripts or via the SSH environment request.
References
CVSS Scores
version 3.1