VDB
Sign up
LOW2.6

GHSA-3g35-v53r-gpxc

Mattermost race condition

Quick fix

GHSA-3g35-v53r-gpxc — github.com/mattermost/mattermost/server/v8: upgrade to the fixed version with the command below.

go get github.com/mattermost/mattermost/server/v8@v9.4.2

Details

A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual posts' contents via carefully timed post creation while another user deletes posts.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/mattermost/mattermost/server/v8
Introduced in: 9.0.0Fixed in: 9.4.2
Fixgo get github.com/mattermost/mattermost/server/v8@v9.4.2
Go/github.com/mattermost/mattermost/server/v8
Introduced in: 0Fixed in: 8.1.9
Fixgo get github.com/mattermost/mattermost/server/v8@v8.1.9

References