VDB
Sign up
MEDIUM5.3

GHSA-2j87-p623-8cc2

Mattermost vulnerable to Observable Timing Discrepancy

Quick fix

GHSA-2j87-p623-8cc2 — github.com/mattermost/mattermost/server/v8: upgrade to the fixed version with the command below.

go get github.com/mattermost/mattermost/server/v8@v10.5.2

Details

Mattermost Plugin MSTeams versions <2.1.0 and Mattermost Server versions 10.5.x <=10.5.1 with the MS Teams plugin enabled fail to perform constant time comparison on a MSTeams plugin webhook secret which allows an attacker to retrieve the webhook secret of the MSTeams plugin via a timing attack during webhook secret comparison.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/mattermost/mattermost/server/v8
Introduced in: 10.5.0Fixed in: 10.5.2
Fixgo get github.com/mattermost/mattermost/server/v8@v10.5.2
Go/github.com/mattermost/mattermost/server/v8
Introduced in: 0Fixed in: 8.0.0-20250314142426-c049748b8863
Fixgo get github.com/mattermost/mattermost/server/v8@v8.0.0-20250314142426-c049748b8863
Go/github.com/mattermost/mattermost-plugin-msteams
Introduced in: 0Fixed in: 2.1.0
Fixgo get github.com/mattermost/mattermost-plugin-msteams@v2.1.0

References