Description
Uncontrolled resource consumption in Mattermost version 6.6.0 and earlier allows an authenticated attacker to crash the server via a crafted SVG attachment on a post.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mattermost | Mattermost | 6.5.x 6.5.0, 6.6.x 6.6.0, 5.x – ≤ 5.39, 6.x – ≤ 6.3.7, 6.4.x – ≤ 6.4.2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/mattermost/mattermost-server | >= 6.6.0, < 6.6.1 | 6.6.1 | GHSA-gwpf-95jc-63rv |
| Go | github.com/mattermost/mattermost-server | >= 6.5.0, < 6.5.1 | 6.5.1 | GHSA-gwpf-95jc-63rv |
| Go | github.com/mattermost/mattermost-server | >= 6.4.0, < 6.4.3 | 6.4.3 | GHSA-gwpf-95jc-63rv |
| Go | github.com/mattermost/mattermost-server | >= 5.0.0, < 6.3.8 | 6.3.8 | GHSA-gwpf-95jc-63rv |