VDB
Sign up
MEDIUM5.3

GHSA-w496-f5qq-m58j

Mattermost vulnerable to excessive memory consumption

Quick fix

GHSA-w496-f5qq-m58j — github.com/mattermost/mattermost-server/v6: upgrade to the fixed version with the command below.

go get github.com/mattermost/mattermost-server/v6@v7.8.12

Details

Mattermost fails to properly sanitize the request to `/api/v4/redirect_location` allowing an attacker, sending a specially crafted request to `/api/v4/redirect_location`, to fill up the memory due to caching large items.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/mattermost/mattermost-server/v6
Introduced in: 0Fixed in: 7.8.12
Fixgo get github.com/mattermost/mattermost-server/v6@v7.8.12
Go/github.com/mattermost/mattermost/server/v8
Introduced in: 8.0.0Fixed in: 8.0.4
Fixgo get github.com/mattermost/mattermost/server/v8@v8.0.4
Go/github.com/mattermost/mattermost/server/v8
Introduced in: 8.1.0Fixed in: 8.1.3
Fixgo get github.com/mattermost/mattermost/server/v8@v8.1.3
Go/github.com/mattermost/mattermost/server/v8
Introduced in: 9.0.0Fixed in: 9.0.1
Fixgo get github.com/mattermost/mattermost/server/v8@v9.0.1

References