GHSA-6mx3-9qfh-77gj

Source

https://github.com/advisories/GHSA-6mx3-9qfh-77gj

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-6mx3-9qfh-77gj/GHSA-6mx3-9qfh-77gj.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-6mx3-9qfh-77gj

Aliases

Related

Published

2024-02-29T09:30:34Z

Modified

2025-01-11T07:57:00.823584Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

Mattermost denial of service through long emoji value

Details

Mattermost fails to properly validate the length of the emoji value in the custom user status, allowing an attacker to send multiple times a very long string as an emoji value causing high resource consumption and possibly crashing the server.

Database specific

{
    "nvd_published_at": "2024-02-29T08:15:47Z",
    "cwe_ids": [
        "CWE-400"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-29T22:48:30Z"
}

References

Affected packages

Go / github.com/mattermost/mattermost/server/v8

Package

Name: github.com/mattermost/mattermost/server/v8; View open source insights on deps.dev
Purl: pkg:golang/github.com/mattermost/mattermost/server/v8

Affected ranges

Type: SEMVER
Events: Introduced

9.3.0

Fixed

9.3.1

Go / github.com/mattermost/mattermost/server/v8

Package

Name: github.com/mattermost/mattermost/server/v8; View open source insights on deps.dev
Purl: pkg:golang/github.com/mattermost/mattermost/server/v8

Affected ranges

Type: SEMVER
Events: Introduced

9.2.0

Fixed

9.2.5