Bug 2277331 (CVE-2024-22091)

Summary:	CVE-2024-22091 mattermost: fail to limit the size of a request path causing excessive resource consumption
Product:	[Other] Security Response	Reporter:	Rohit Keshri <rkeshri>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	dfreiber, drow, gparvin, jburrell, lbainbri, njean, owatkins, pahickey, rhaigner, sidakwo, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Mattermost, where it failed to limit the size of a request path that includes user inputs. This flaw allows an attacker to cause excessive resource consumption, possibly leading to a denial of service (DoS) via sending large request paths.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2277332, 2277333
Bug Blocks:	2277330

Description Rohit Keshri 2024-04-26 11:12:51 UTC

Mattermost versions 8.1.x <= 8.1.10, 9.6.x <= 9.6.0, 9.5.x <= 9.5.2 and 8.1.x <= 8.1.11 fail to limit the size of a request path that includes user inputs which allows an attacker to cause excessive resource consumption, possibly leading to a DoS via sending large request paths

https://mattermost.com/security-updates

Comment 1 Rohit Keshri 2024-04-26 11:15:11 UTC

Created purple-mattermost tracking bugs for this issue:

Affects: epel-all [bug 2277332]
Affects: fedora-all [bug 2277333]