MEDIUM4.9

GHSA-r67m-mf7v-qp7j

Mattermost password hash disclosure vulnerability

Quick fix

GHSA-r67m-mf7v-qp7j — github.com/mattermost/mattermost-server/v6: upgrade to the fixed version with the command below.

go get github.com/mattermost/mattermost-server/v6@v7.8.12

Details

Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the response body.

Enter the version of the package you're using.

Introduced in: 5.4.0-rc1Fixed in: 7.8.12

Fixgo get github.com/mattermost/mattermost-server/v6@v7.8.12

Introduced in: 8.0.0Fixed in: 8.0.4

Fixgo get github.com/mattermost/mattermost/server/v8@v8.0.4

Introduced in: 8.1.0Fixed in: 8.1.3

Fixgo get github.com/mattermost/mattermost/server/v8@v8.1.3

Introduced in: 9.0.0Fixed in: 9.0.1

Fixgo get github.com/mattermost/mattermost/server/v8@v9.0.1

Introduced in: 0Fixed in: 8.0.0-20230825233148-f787fd63368a

Fixgo get github.com/mattermost/mattermost/server/v8@v8.0.0-20230825233148-f787fd63368a

Introduced in: 0Fixed in: 5.3.2-0.20230825233148-f787fd63368a

Fixgo get github.com/mattermost/mattermost-server/v6@v5.3.2-0.20230825233148-f787fd63368a

Introduced in: 0Fixed in: 5.3.2-0.20230825233148-f787fd63368a

Fixgo get github.com/mattermost/mattermost-server/v5@v5.3.2-0.20230825233148-f787fd63368a

Introduced in: 0Fixed in: 5.3.2-0.20230825233148-f787fd63368a

Fixgo get github.com/mattermost/mattermost-server@v5.3.2-0.20230825233148-f787fd63368a