GHSA-m462-mqw4-2c8m

Mattermost Server has X.509 Improper Certificate Validation

Source: GitHub Advisory Database (reviewed) Critical CVE-2017-18911

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/mattermost/mattermost-server	< 3.6.7-rc1	3.6.7-rc1
Go	github.com/mattermost/mattermost-server	>= 3.7.0, < 3.7.5	3.7.5
Go	github.com/mattermost/mattermost-server	>= 3.8.0, < 3.8.2	3.8.2

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. The X.509 certificate validation can be skipped for a TLS-based e-mail server.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2017-18911 advisory
https://github.com/mattermost/mattermost/commit/222bce0c5c1abb2f58c3a6de1fe8c5d3accffb21 web
https://github.com/mattermost/mattermost/commit/691c18157025d4808b5b11de1d6de01050e54fa6 web
https://github.com/mattermost/mattermost/commit/e9bb8cdfb4915067349a4840ab15ff941c4eb070 web
https://github.com/mattermost/mattermost package
https://mattermost.com/security-updates web