JumpServer v4.10.17 Patch: Fixes SFTP Path Traversal and File Upload Vulnerabilities

Vulnerability Overview v4.10.17-fts: Fixed a vulnerability related to file uploads. feat: upgrade usql version to 0.1.13: Upgraded the usql version, which may have fixed related security issues. fix: tab text: Fixed an issue with tab text labels. fix: file upload tips: Fixed an issue with file upload prompt messages. perf: add k8s cluster enabled by KOKO_PRIVILEGED: Added privilege control for Kubernetes (K8s) clusters. perf: update golanci action: Updated the golanci action. perf: add ws origin check: Added WebSocket origin verification. fix: preserve SFTP subsystem exit status: Fixed an issue regarding the SFTP subsystem exit status. perf: mongodb cluster gateway support: Added support for MongoDB cluster gateways. perf: update dockerfile-ee: Updated the Dockerfile. fix osm conflicts: Fixed OSM conflicts. perf: force sftp session protocol: Enforced the SFTP session protocol. fix(auth): allow token SSH login when password auth is disabled: Fixed an issue where token-based SSH login was not allowed when password authentication was disabled. merge: osm-fix: Merged OSM fixes. perf: update gh action: Updated the GitHub action. perf: fix sftp path traversal: Fixed an SFTP path traversal vulnerability. feat: upgrade usql version: Upgraded the usql version. feat:support proxy site prefix: Added support for proxy site prefixes. Impact Scope File upload vulnerability: May affect the security of the file upload functionality. usql version upgrade: May affect applications utilizing usql. Tab text issue: May affect the display of text labels. File upload prompt issue: May affect the prompt messages during file uploads. K8s cluster privilege control: May affect privilege management for K8s clusters. WebSocket origin check: May affect the security of WebSocket connections. SFTP subsystem exit status: May affect the stability of SFTP sessions. MongoDB cluster gateway support: May affect the gateway functionality for MongoDB clusters. Dockerfile update: May affect the build process of Docker images. OSM conflicts: May affect OSM-related functionalities. SFTP session protocol: May affect the protocol consistency of SFTP sessions. Token SSH login: May affect the security of SSH logins. GitHub action update: May affect the execution of GitHub Actions. SFTP path traversal: May affect the security of SFTP file paths. usql version upgrade: May affect applications utilizing usql. Proxy site prefix: May affect the configuration of proxy sites. Remediation File upload vulnerability: Fixed vulnerabilities related to file uploads. usql version upgrade: Upgraded usql to version 0.1.13. Tab text issue: Fixed the tab text label issue. File upload prompt issue: Fixed the file upload prompt issue. K8s cluster privilege control: Added privilege control for K8s clusters. WebSocket origin check: Added WebSocket origin verification. SFTP subsystem exit status: Fixed the SFTP subsystem exit status issue. MongoDB cluster gateway support: Added support for MongoDB cluster gateways. Dockerfile update: Updated the Dockerfile. OSM conflicts: Fixed OSM conflicts. SFTP session protocol: Enforced the SFTP session protocol. Token SSH login: Fixed the issue allowing token-based SSH login when password authentication is disabled. GitHub action update: Updated the GitHub action. SFTP path traversal: Fixed the SFTP path traversal vulnerability. usql version upgrade: Upgraded the usql version. Proxy site prefix: Added support for proxy site prefixes. POC Code or Exploit Code No specific POC code or exploit code is provided in the page.

Goal Reached Thanks to every supporter — we hit 100%!

JumpServer v4.10.17 Patch: Fixes SFTP Path Traversal and File Upload Vulnerabilities

More from this source