GHSA-f7c3-7vp3-44p6

Mattermost Server mishandles redirect denial action

Source: GitHub Advisory Database (reviewed) Moderate CVE-2017-18897

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/mattermost/mattermost-server	< 4.0.5	4.0.5
Go	github.com/mattermost/mattermost-server	>= 4.1.0, < 4.1.1	4.1.1
Go	github.com/mattermost/mattermost-server	>= 4.2.0-rc1, < 4.2.0	4.2.0

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. It mishandles a deny action for a redirection.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2017-18897 advisory
https://github.com/mattermost/mattermost/commit/3c34e2b2dcb0fde96a10e68d877aa7d0ab511669 web
https://github.com/mattermost/mattermost/commit/722fb1947a2e7395ccf16adce9206736d803a9f3 web
https://github.com/mattermost/mattermost/commit/d38328976e2c8bb0fab91e656042a0d8ac37bc76 web
https://github.com/mattermost/mattermost package
https://mattermost.com/security-updates web