CVE-2024-1953
First published: Thu Feb 29 2024(Updated: )
Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowing an authenticated attacker to cause the server to run out of memory and crash by issuing an unusually large HTTP request.
Credit: responsibledisclosure@mattermost.com responsibledisclosure@mattermost.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/github.com/mattermost/mattermost/server/v8 | <8.1.9 | 8.1.9 |
| go/github.com/mattermost/mattermost/server/v8 | >=9.2.0<9.2.5 | 9.2.5 |
| go/github.com/mattermost/mattermost/server/v8 | >=9.3.0<9.3.1 | 9.3.1 |
| go/github.com/mattermost/mattermost/server/v8 | >=9.4.0<9.4.2 | 9.4.2 |
| Mattermost | >=8.1.0<8.1.9 | |
| Mattermost | >=9.2.0<9.2.5 | |
| Mattermost | >=9.4.0<9.4.2 | |
| Mattermost | =9.3.0 |
Remedy
Update Mattermost Server to versions 9.5, 9.4.2, 9.3.1, 9.2.5, 8.1.9, or higher.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-1953?
CVE-2024-1953 has a high severity as it allows an authenticated attacker to potentially crash the server by overwhelming it with large HTTP requests.
How do I fix CVE-2024-1953?
To fix CVE-2024-1953, update Mattermost to version 8.1.9, 9.2.5, 9.3.1, or 9.4.2 or later.
Which Mattermost versions are affected by CVE-2024-1953?
Mattermost versions earlier than 8.1.9, 9.2.5, 9.3.0, and 9.4.2 are affected by CVE-2024-1953.
What type of attack does CVE-2024-1953 describe?
CVE-2024-1953 describes a denial-of-service attack where the server can run out of memory due to excessively large role name requests.
Is CVE-2024-1953 related to authentication?
Yes, CVE-2024-1953 requires the attacker to be authenticated in order to exploit the vulnerability.
- agent/remedy
- agent/type
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/weakness
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-vm9m-57jr-4pxh
- alias/CVE-2024-1953
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/references
- agent/softwarecombine
- agent/event
- agent/trending
- collector/github-advisory
- agent/source
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-api
- package-manager/go
- vendor/mattermost
- canonical/mattermost
- version/mattermost/8.1.0
- version/mattermost/9.2.0
- version/mattermost/9.4.0
- version/mattermost/9.3.0