GitHub Advisoryadvisory · Go
GHSA-m462-mqw4-2c8m Mattermost Server has X.509 Improper Certificate Validation
CRITICAL
Official page ↗
- Aliases
- CVE-2017-18911
- Ecosystem
- Go
- Packages
- github.com/mattermost/mattermost-server
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-295
- Reviewed
- 2026-02-06
Affected packages
• Go github.com/mattermost/mattermost-server: < 3.6.7-rc1 → fixed in 3.6.7-rc1
• Go github.com/mattermost/mattermost-server: >= 3.7.0, < 3.7.5 → fixed in 3.7.5
• Go github.com/mattermost/mattermost-server: >= 3.8.0, < 3.8.2 → fixed in 3.8.2
Description
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. The X.509 certificate validation can be skipped for a TLS-based e-mail server.
Related
Alias · CVE (1)
- CVE-2017-18911 An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. vulnerability
Weakness · CWE (1)
- CWE-295 Improper Certificate Validation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-18911 advisory
- https://github.com/mattermost/mattermost/commit/222bce0c5c1abb2f58c3a6de1fe8c5d3accffb21 web
- https://github.com/mattermost/mattermost/commit/691c18157025d4808b5b11de1d6de01050e54fa6 web
- https://github.com/mattermost/mattermost/commit/e9bb8cdfb4915067349a4840ab15ff941c4eb070 web
- https://github.com/mattermost/mattermost package
- https://mattermost.com/security-updates web