GHSA-8j3q-gc9x-7972
Mattermost Incorrect Type Conversion or Cast
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/mattermost/mattermost/server/v8 | >= 10.2.0, < 10.2.1 | 10.2.1 |
| Go | github.com/mattermost/mattermost/server/v8 | >= 10.1.0, < 10.1.4 | 10.1.4 |
| Go | github.com/mattermost/mattermost/server/v8 | >= 10.0.0, < 10.0.4 | 10.0.4 |
| Go | github.com/mattermost/mattermost/server/v8 | >= 9.11.0, < 9.11.6 | 9.11.6 |
| Go | github.com/mattermost/mattermost/server/v8 | < 8.0.0-20241127161322-25ff7a3779a5 | 8.0.0-20241127161322-25ff7a3779a5 |
Details
As written in the advisory (Markdown source, shown as plain text).
Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate the style of proto supplied to an action's style in post.props.attachments, which allows an attacker to crash the frontend via crafted malicious input.
References
External links from the advisory. They lead to third-party sites.