Headline
GHSA-vfxf-76hv-v4w4: User-provided environment values allow execution on macOS agents
Impact
Agents running on macOS could be susceptible to unexpected code execution through user supplied environment variables.
Patches
Fixed in versions 14.2.4, 13.4.13 and 12.4.31.
References
- Fix PR: https://github.com/gravitational/teleport/pull/36132
User-provided environment values allow execution on macOS agents
High severity GitHub Reviewed Published Dec 29, 2023 in gravitational/teleport • Updated Jan 3, 2024