Description
Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows an authenticated attacker to crash the server via repeated requests to the getSessions API after flooding the sessions table.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mattermost | Mattermost | 9.6.0 – ≤ 8.1.10, 9.5.0 – ≤ 9.5.2, 9.4.0 – ≤ 9.4.4, 8.1.0 – ≤ 8.1.11 | 9.7.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/mattermost/mattermost-server | >= 9.6.0-rc1, < 9.6.1 | 9.6.1 | GHSA-wj37-mpq9-xrcm |
| Go | github.com/mattermost/mattermost-server | >= 9.5.0, < 9.5.3 | 9.5.3 | GHSA-wj37-mpq9-xrcm |
| Go | github.com/mattermost/mattermost-server | >= 9.4.0, < 9.4.5 | 9.4.5 | GHSA-wj37-mpq9-xrcm |
| Go | github.com/mattermost/mattermost-server | >= 8.1.0, < 8.1.12 | 8.1.12 | GHSA-wj37-mpq9-xrcm |
| Go | github.com/mattermost/mattermost-server | >= 8.1.0+incompatible, < 8.1.12+incompatible · >= 9.4.0+incompatible, < 9.4.5+incompatible · >= 9.5.0+incompatible, < 9.5.3+incompatible · >= 9.6.0-rc1+incompatible, < 9.6.1+incompatible | 8.1.12+incompatible, 9.4.5+incompatible, 9.5.3+incompatible, 9.6.1+incompatible | GO-2024-2798 |
Advisories 1
- WID-SEC-2024-0718 Mattermost: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Apr 28, 2024