VDB
Sign up
MEDIUM6.5

GHSA-8jhh-3jf2-pfwr

Mattermost vulnerable to information disclosure

Quick fix

GHSA-8jhh-3jf2-pfwr — github.com/mattermost/mattermost-server: upgrade to the fixed version with the command below.

go get github.com/mattermost/mattermost-server@v7.1.6

Details

When running in a High Availability configuration, Mattermost fails to sanitize some of the `user_updated` and` post_deleted` events broadcast to all users, leading to disclosure of sensitive information to some of the users with currently connected Websocket clients.

[Issue Identifier](https://mattermost.com/security-updates/): MMSA-2023-00138

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/mattermost/mattermost-server
Introduced in: 3.3.0Fixed in: 7.1.6
Fixgo get github.com/mattermost/mattermost-server@v7.1.6
Go/github.com/mattermost/mattermost-server
Introduced in: 7.7.0Fixed in: 7.7.2
Fixgo get github.com/mattermost/mattermost-server@v7.7.2
Go/github.com/mattermost/mattermost-server
Introduced in: 7.1.0Fixed in: 7.1.6
Fixgo get github.com/mattermost/mattermost-server@v7.1.6
Go/github.com/mattermost/mattermost-server/v5
Introduced in: 5.0.0Fixed in: 7.1.6
Fixgo get github.com/mattermost/mattermost-server/v5@v7.1.6
Go/github.com/mattermost/mattermost-server/v6
Introduced in: 6.0.0Fixed in: 7.1.6
Fixgo get github.com/mattermost/mattermost-server/v6@v7.1.6

References