GitHub Advisoryadvisory · Go

GHSA-vm9m-57jr-4pxh Mattermost fails to limit the number of role names

MEDIUM Published 2024-02-29 Modified 2024-12-13 Official page ↗
Aliases
CVE-2024-1953
Ecosystem
Go
Packages
github.com/mattermost/mattermost/server/v8
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-400, CWE-770
Reviewed
2024-02-29

Affected packages

• Go github.com/mattermost/mattermost/server/v8: >= 9.4.0, < 9.4.2 → fixed in 9.4.2 • Go github.com/mattermost/mattermost/server/v8: >= 9.3.0, < 9.3.1 → fixed in 9.3.1 • Go github.com/mattermost/mattermost/server/v8: >= 9.2.0, < 9.2.5 → fixed in 9.2.5 • Go github.com/mattermost/mattermost/server/v8: < 8.1.9 → fixed in 8.1.9

Description

Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowing an authenticated attacker to cause the server to run out of memory and crash by issuing an unusually large HTTP request.

Related

Alias · CVE (1)

  • CVE-2024-1953 Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested… vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References