Description
Mattermost versions 8.1.x <= 8.1.10, 9.6.x <= 9.6.0, 9.5.x <= 9.5.2 and 8.1.x <= 8.1.11 fail to limit the size of a request path that includes user inputs which allows an attacker to cause excessive resource consumption, possibly leading to a DoS via sending large request paths
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mattermost | Mattermost | 8.1.0 – ≤ 8.1.10, 9.6.0, 9.5.0 – ≤ 9.5.2, 8.1.0 – ≤ 8.1.11 | 9.7.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/mattermost/mattermost-server | >= 8.1.0, < 8.1.12 | 8.1.12 | GHSA-p2wq-4ggp-45f3 |
| Go | github.com/mattermost/mattermost-server | >= 9.5.0, < 9.5.3 | 9.5.3 | GHSA-p2wq-4ggp-45f3 |
| Go | github.com/mattermost/mattermost-server | >= 9.6.0-rc1, < 9.6.1 | 9.6.1 | GHSA-p2wq-4ggp-45f3 |
| Go | github.com/mattermost/mattermost-server | >= 8.1.0+incompatible, < 8.1.12+incompatible · >= 9.5.0+incompatible, < 9.5.3+incompatible · >= 9.6.0-rc1+incompatible, < 9.6.1+incompatible | 8.1.12+incompatible, 9.5.3+incompatible, 9.6.1+incompatible | GO-2024-2796 |
Advisories 1
- WID-SEC-2024-0718 Mattermost: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Apr 28, 2024