GitHub Advisoryadvisory · Go

GHSA-m7w4-q5vg-5xfp Mattermost subject to Denial of Service via upload of special GIF

MEDIUM Published 2022-09-25 Modified 2022-09-28 Official page ↗
Aliases
CVE-2022-3257
Ecosystem
Go
Packages
github.com/mattermost/mattermost-server/v6
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-434
Reviewed
2022-09-28

Affected packages

• Go github.com/mattermost/mattermost-server/v6: >= 7.1.0, < 7.2.0 → fixed in 7.2.0

Description

Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause resource exhaustion while processing the file, resulting in server-side Denial of Service.

Related

Alias · CVE (1)

  • CVE-2022-3257 Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a… vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References