CVE-2022-1337: OOM DoS in Mattermost image proxy
First published: Wed Apr 13 2022(Updated: )
The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied image, which allows an authenticated attacker to crash the server via links to very large image files.
Credit: responsibledisclosure@mattermost.com responsibledisclosure@mattermost.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mattermost Mattermost Server | >=5.37.0<5.37.9 | |
| Mattermost Mattermost Server | >=6.2.0<6.2.5 | |
| Mattermost Mattermost Server | >=6.3.0<6.3.5 | |
| Mattermost Mattermost Server | >=6.4.0<6.4.2 | |
| go/github.com/mattermost/mattermost-server/v6 | <6.4.2 | 6.4.2 |
Remedy
Upgrade to Mattermost version 6.4.2, 6.3.5, 6.2.5, or 5.37.9.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Mattermost issue?
The vulnerability ID for this Mattermost issue is CVE-2022-1337.
What is the severity level of CVE-2022-1337?
The severity level of CVE-2022-1337 is medium.
How does the image proxy component in Mattermost version 6.4.1 and earlier lead to the vulnerability?
The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied image, which allows an authenticated attacker to crash the server via links to very large image files.
Which versions of Mattermost Server are affected by CVE-2022-1337?
Mattermost Server versions 5.37.0 to 5.37.9, 6.2.0 to 6.2.5, 6.3.0 to 6.3.5, and 6.4.0 to 6.4.2 are affected by CVE-2022-1337.
How can I fix CVE-2022-1337?
To fix CVE-2022-1337, you should update Mattermost Server to version 6.4.2 or later.
- collector/github-advisory-latest
- alias/GHSA-f37q-q7p2-ccfc
- alias/CVE-2022-1337
- collector/github-advisory
- collector/nvd-index
- agent/weakness
- agent/author
- agent/type
- agent/softwarecombine
- agent/references
- agent/description
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/remedy
- agent/title
- agent/tags
- agent/first-publish-date
- agent/event
- package-manager/go
- vendor/mattermost
- canonical/mattermost mattermost server
- version/mattermost mattermost server/5.37.0
- version/mattermost mattermost server/6.2.0
- version/mattermost mattermost server/6.3.0
- version/mattermost mattermost server/6.4.0