deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-v2vm-hq26-5jv6
Package: github.com/mattermost/mattermost-server (GO)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 4.1.2
Patched in: 4.1.2

Summary: Mattermost Server is vulnerable to SQL Injection when executing multiple POST requests

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows SQL injection during the fetching of multiple posts.
GitHub Security Advisory: GHSA-35c4-5qfp-wxj6
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 4.3.0-rc1, < 4.3.0
Patched in: 4.3.0

Summary: Mattermost Server exposes team creator's e-mail address to other members

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It discloses the team creator's e-mail address to members.
GitHub Security Advisory: GHSA-35c4-5qfp-wxj6
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 4.2.0-rc1, < 4.2.1
Patched in: 4.2.1

Summary: Mattermost Server exposes team creator's e-mail address to other members

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It discloses the team creator's e-mail address to members.
GitHub Security Advisory: GHSA-35c4-5qfp-wxj6
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 4.1.2
Patched in: 4.1.2

Summary: Mattermost Server exposes team creator's e-mail address to other members

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It discloses the team creator's e-mail address to members.
GitHub Security Advisory: GHSA-wvjg-33p9-938h
Package: github.com/mattermost/mattermost-server (GO)
Severity: HIGH (CVSS 8.8)
CWE: CWE-732: Incorrect Permission Assignment for Critical Resource
Vulnerable versions: >= 4.3.0-rc1, < 4.3.0
Patched in: 4.3.0

Summary: Mattermost Server does not properly restrict use of slash commands

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows a bypass of restrictions on use of slash commands.
GitHub Security Advisory: GHSA-wvjg-33p9-938h
Package: github.com/mattermost/mattermost-server (GO)
Severity: HIGH (CVSS 8.8)
CWE: CWE-732: Incorrect Permission Assignment for Critical Resource
Vulnerable versions: >= 4.2.0-rc1, < 4.2.1
Patched in: 4.2.1

Summary: Mattermost Server does not properly restrict use of slash commands

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows a bypass of restrictions on use of slash commands.
GitHub Security Advisory: GHSA-wvjg-33p9-938h
Package: github.com/mattermost/mattermost-server (GO)
Severity: HIGH (CVSS 8.8)
CWE: CWE-732: Incorrect Permission Assignment for Critical Resource
Vulnerable versions: < 4.1.2
Patched in: 4.1.2

Summary: Mattermost Server does not properly restrict use of slash commands

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows a bypass of restrictions on use of slash commands.
GitHub Security Advisory: GHSA-g78f-6xq7-rrhq
Package: github.com/mattermost/mattermost-server (GO)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-269: Improper Privilege Management
Vulnerable versions: >= 4.3.0-rc1, < 4.3.0
Patched in: 4.3.0

Summary: Mattermost Server allows attackers to gain privileges by accessing unintended API endpoints with users' credentials

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by accessing unintended API endpoints on a user's behalf.
GitHub Security Advisory: GHSA-g78f-6xq7-rrhq
Package: github.com/mattermost/mattermost-server (GO)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-269: Improper Privilege Management
Vulnerable versions: >= 4.2.0-rc1, < 4.2.1
Patched in: 4.2.1

Summary: Mattermost Server allows attackers to gain privileges by accessing unintended API endpoints with users' credentials

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by accessing unintended API endpoints on a user's behalf.
GitHub Security Advisory: GHSA-g78f-6xq7-rrhq
Package: github.com/mattermost/mattermost-server (GO)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-269: Improper Privilege Management
Vulnerable versions: < 4.1.2
Patched in: 4.1.2

Summary: Mattermost Server allows attackers to gain privileges by accessing unintended API endpoints with users' credentials

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by accessing unintended API endpoints on a user's behalf.
GitHub Security Advisory: GHSA-876j-jfqf-m7j7
Package: github.com/mattermost/mattermost-server (GO)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-269: Improper Privilege Management, CWE-863: Incorrect Authorization
Vulnerable versions: >= 4.3.0-rc1, < 4.3.0
Patched in: 4.3.0

Summary: Mattermost Server exposes OAuth personal access tokens to attackers

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by using a registered OAuth application with personal access tokens.
GitHub Security Advisory: GHSA-876j-jfqf-m7j7
Package: github.com/mattermost/mattermost-server (GO)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-269: Improper Privilege Management, CWE-863: Incorrect Authorization
Vulnerable versions: >= 4.2.0-rc1, < 4.2.1
Patched in: 4.2.1

Summary: Mattermost Server exposes OAuth personal access tokens to attackers

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by using a registered OAuth application with personal access tokens.
GitHub Security Advisory: GHSA-876j-jfqf-m7j7
Package: github.com/mattermost/mattermost-server (GO)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-269: Improper Privilege Management, CWE-863: Incorrect Authorization
Vulnerable versions: < 4.1.2
Patched in: 4.1.2

Summary: Mattermost Server exposes OAuth personal access tokens to attackers

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by using a registered OAuth application with personal access tokens.
GitHub Security Advisory: GHSA-w8cc-3h7q-jhc3
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-331: Insufficient Entropy
Vulnerable versions: >= 4.3.0-rc1, < 4.3.0
Patched in: 4.3.0

Summary: Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data.
GitHub Security Advisory: GHSA-w8cc-3h7q-jhc3
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-331: Insufficient Entropy
Vulnerable versions: >= 4.2.0-rc1, < 4.2.1
Patched in: 4.2.1

Summary: Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data.
GitHub Security Advisory: GHSA-w8cc-3h7q-jhc3
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-331: Insufficient Entropy
Vulnerable versions: < 4.1.2
Patched in: 4.1.2

Summary: Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data.
GitHub Security Advisory: GHSA-4qg8-fj49-pxjh
Package: github.com/sigstore/timestamp-authority (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-405: Asymmetric Resource Consumption (Amplification)
Vulnerable versions: <= 2.0.2
Patched in: 2.0.3

Summary: Sigstore Timestamp Authority allocates excessive memory during request parsing

Details:
### Impact

**Excessive memory allocation**

Function [api.ParseJSONRequest](https://github.com/sigstore/timestamp-authority/blob/26d7d426d3000abdbdf2df34de56bb92246c0365/pkg/api/timestamp.go#L63) currently splits (via a call to [strings.Split](https://pkg.go.dev/strings#Split)) an optionally-provided OID (which is untrusted data) on periods. Similarly, function [api.getContentType](https://github.com/sigstore/timestamp-authority/blob/26d7d426d3000abdbdf2df34de56bb92246c0365/pkg/api/timestamp.go#L114) splits the `Content-Type` header (which is also untrusted data) on an `application` string.

As a result, in the face of a malicious request with either an excessively long OID in the payload containing many period characters or a malformed `Content-Type` header, a call to `api.ParseJSONRequest` or `api.getContentType` incurs allocations of O(n) bytes (where n stands for the length of the function's argument). Relevant weakness: [CWE-405: Asymmetric Resource Consumption (Amplification)](https://cwe.mitre.org/data/definitions/405.html)

### Patches

Upgrade to v2.0.3.

### Workarounds

There are no workarounds with the service itself. If the service is behind a load balancer, configure the load balancer to reject excessively large requests.
GitHub Security Advisory: GHSA-f83f-xpx7-ffpw
Package: github.com/sigstore/fulcio (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-405: Asymmetric Resource Consumption (Amplification)
Vulnerable versions: <= 1.8.2
Patched in: 1.8.3

Summary: Fulcio allocates excessive memory during token parsing

Details:
Function [identity.extractIssuerURL](https://github.com/sigstore/fulcio/blob/main/pkg/identity/issuerpool.go#L44-L45) currently splits (via a call to [strings.Split](https://pkg.go.dev/strings#Split)) its argument (which is untrusted data) on periods.

As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to `extractIssuerURL` incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. Relevant weakness: [CWE-405: Asymmetric Resource Consumption (Amplification)](https://cwe.mitre.org/data/definitions/405.html)

Details
See [identity.extractIssuerURL](https://github.com/sigstore/fulcio/blob/main/pkg/identity/issuerpool.go#L44-L45)

Impact
Excessive memory allocation
GitHub Security Advisory: GHSA-rwjg-c3h2-f57p
Package: github.com/envoyproxy/envoy (GO)
Severity: MODERATE (CVSS 5.0)
CWE: CWE-170: Improper Null Termination
Vulnerable versions: <= 1.33.12
Patched in: 1.33.13

Summary: Envoy's TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte

Details:
### Summary
Envoy’s mTLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte (\0) inside an `OTHERNAME` SAN value as valid matches.

### Details
This occurs when the SAN is encoded as a `BMPSTRING` or `UNIVERSALSTRING`, and its UTF-8 conversion result is truncated at the first null byte during string assignment. As a result, `"victim\0evil"` may match an exact: `"victim"` rule and be accepted by Envoy.

### PoC

Create a CA and a server certificate signed by that CA.
Create two client certificates signed by the same CA:
client_evil with OTHERNAME BMPSTRING = "evil"
client_null with OTHERNAME BMPSTRING = "victim\0evil"
Configure Envoy with require_client_certificate: true and a match_typed_subject_alt_names entry for the OTHERNAME OID with matcher.exact: "victim".
Connect without a client cert → connection rejected.
Connect with client_evil → connection rejected.
Connect with client_null → connection accepted (but shouldn't!).

### Impact
An attacker who can obtain a trusted client certificate with a null byte embedded in an OTHERNAME SAN can exploit this vulnerability. The practical impact is unauthorized impersonation of the matched identity, enabling access to services or APIs protected by that exact OTHERNAME check.

### Credit
[markevich.nikita1@gmail.com](mailto:markevich.nikita1@gmail.com)
GitHub Security Advisory: GHSA-rwjg-c3h2-f57p
Package: github.com/envoyproxy/envoy (GO)
Severity: MODERATE (CVSS 5.0)
CWE: CWE-170: Improper Null Termination
Vulnerable versions: >= 1.34.0, <= 1.34.10
Patched in: 1.34.11

Summary: Envoy's TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte

Details:
### Summary
Envoy’s mTLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte (\0) inside an `OTHERNAME` SAN value as valid matches.

### Details
This occurs when the SAN is encoded as a `BMPSTRING` or `UNIVERSALSTRING`, and its UTF-8 conversion result is truncated at the first null byte during string assignment. As a result, `"victim\0evil"` may match an exact: `"victim"` rule and be accepted by Envoy.

### PoC

Create a CA and a server certificate signed by that CA.
Create two client certificates signed by the same CA:
client_evil with OTHERNAME BMPSTRING = "evil"
client_null with OTHERNAME BMPSTRING = "victim\0evil"
Configure Envoy with require_client_certificate: true and a match_typed_subject_alt_names entry for the OTHERNAME OID with matcher.exact: "victim".
Connect without a client cert → connection rejected.
Connect with client_evil → connection rejected.
Connect with client_null → connection accepted (but shouldn't!).

### Impact
An attacker who can obtain a trusted client certificate with a null byte embedded in an OTHERNAME SAN can exploit this vulnerability. The practical impact is unauthorized impersonation of the matched identity, enabling access to services or APIs protected by that exact OTHERNAME check.

### Credit
[markevich.nikita1@gmail.com](mailto:markevich.nikita1@gmail.com)
GitHub Security Advisory: GHSA-rwjg-c3h2-f57p
Package: github.com/envoyproxy/envoy (GO)
Severity: MODERATE (CVSS 5.0)
CWE: CWE-170: Improper Null Termination
Vulnerable versions: >= 1.35.0, <= 1.35.6
Patched in: 1.35.7

Summary: Envoy's TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte

Details:
### Summary
Envoy’s mTLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte (\0) inside an `OTHERNAME` SAN value as valid matches.

### Details
This occurs when the SAN is encoded as a `BMPSTRING` or `UNIVERSALSTRING`, and its UTF-8 conversion result is truncated at the first null byte during string assignment. As a result, `"victim\0evil"` may match an exact: `"victim"` rule and be accepted by Envoy.

### PoC

Create a CA and a server certificate signed by that CA.
Create two client certificates signed by the same CA:
client_evil with OTHERNAME BMPSTRING = "evil"
client_null with OTHERNAME BMPSTRING = "victim\0evil"
Configure Envoy with require_client_certificate: true and a match_typed_subject_alt_names entry for the OTHERNAME OID with matcher.exact: "victim".
Connect without a client cert → connection rejected.
Connect with client_evil → connection rejected.
Connect with client_null → connection accepted (but shouldn't!).

### Impact
An attacker who can obtain a trusted client certificate with a null byte embedded in an OTHERNAME SAN can exploit this vulnerability. The practical impact is unauthorized impersonation of the matched identity, enabling access to services or APIs protected by that exact OTHERNAME check.

### Credit
[markevich.nikita1@gmail.com](mailto:markevich.nikita1@gmail.com)
GitHub Security Advisory: GHSA-rwjg-c3h2-f57p
Package: github.com/envoyproxy/envoy (GO)
Severity: MODERATE (CVSS 5.0)
CWE: CWE-170: Improper Null Termination
Vulnerable versions: >= 1.36.0, <= 1.36.2
Patched in: 1.36.3

Summary: Envoy's TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte

Details:
### Summary
Envoy’s mTLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte (\0) inside an `OTHERNAME` SAN value as valid matches.

### Details
This occurs when the SAN is encoded as a `BMPSTRING` or `UNIVERSALSTRING`, and its UTF-8 conversion result is truncated at the first null byte during string assignment. As a result, `"victim\0evil"` may match an exact: `"victim"` rule and be accepted by Envoy.

### PoC

Create a CA and a server certificate signed by that CA.
Create two client certificates signed by the same CA:
client_evil with OTHERNAME BMPSTRING = "evil"
client_null with OTHERNAME BMPSTRING = "victim\0evil"
Configure Envoy with require_client_certificate: true and a match_typed_subject_alt_names entry for the OTHERNAME OID with matcher.exact: "victim".
Connect without a client cert → connection rejected.
Connect with client_evil → connection rejected.
Connect with client_null → connection accepted (but shouldn't!).

### Impact
An attacker who can obtain a trusted client certificate with a null byte embedded in an OTHERNAME SAN can exploit this vulnerability. The practical impact is unauthorized impersonation of the matched identity, enabling access to services or APIs protected by that exact OTHERNAME check.

### Credit
[markevich.nikita1@gmail.com](mailto:markevich.nikita1@gmail.com)
GitHub Security Advisory: GHSA-rj35-4m94-77jh
Package: github.com/envoyproxy/envoy (GO)
Severity: LOW (CVSS 3.7)
CWE: CWE-693: Protection Mechanism Failure
Vulnerable versions: <= 1.33.12
Patched in: 1.33.13

Summary: Envoy forwards early CONNECT data in TCP proxy mode

Details:
## Summary

Forwarding of early CONNECT data in TCP proxy mode.

## Details

Per [RFC 7231-4.3.6](https://www.rfc-editor.org/rfc/rfc7231#section-4.3.6) the sender of CONNECT (and all inbound proxies)  switch to tunnel mode only after receiving 2xx response. However in TCP proxy mode, Envoy accepts client data before it has issued a 2xx response and eagerly proxies it to an established TCP connection. This creates possibility of a de-synchronized tunnel state if a proxy upstream from Envoy responds with a status other an 2xx.

The RFC does not specify the behavior in case an early CONNECT data is received and early CONNECT data is common as a latency reduction mechanism. To prevent disruption to existing deployments Envoy will by default allow early CONNECT data. Setting the `envoy.reloadable_features.reject_early_connect_data` runtime flag to `true` will cause CONNECT requests that send data before 2xx response to be rejected. This options should be enabled if there are intermediaries upstream from Envoy that may reject establishment of a CONNECT tunnel. 

## Impact

De-synchronization of CONNECT tunnel state if a forwarding proxy upstream from Envoy responds with a non 2xx status.

## Attack vector(s)
Sending data for a CONNECT request before receiving 2xx response.

## Patches
Users should upgrade to v1.36.3, v1.35.7, v1.34.11 or v1.33.13

## Credits

[chasingimpact](https://github.com/chasingimpact) (Patrick)
GitHub Security Advisory: GHSA-rj35-4m94-77jh
Package: github.com/envoyproxy/envoy (GO)
Severity: LOW (CVSS 3.7)
CWE: CWE-693: Protection Mechanism Failure
Vulnerable versions: >= 1.34.0, <= 1.34.10
Patched in: 1.34.11

Summary: Envoy forwards early CONNECT data in TCP proxy mode

Details:
## Summary

Forwarding of early CONNECT data in TCP proxy mode.

## Details

Per [RFC 7231-4.3.6](https://www.rfc-editor.org/rfc/rfc7231#section-4.3.6) the sender of CONNECT (and all inbound proxies)  switch to tunnel mode only after receiving 2xx response. However in TCP proxy mode, Envoy accepts client data before it has issued a 2xx response and eagerly proxies it to an established TCP connection. This creates possibility of a de-synchronized tunnel state if a proxy upstream from Envoy responds with a status other an 2xx.

The RFC does not specify the behavior in case an early CONNECT data is received and early CONNECT data is common as a latency reduction mechanism. To prevent disruption to existing deployments Envoy will by default allow early CONNECT data. Setting the `envoy.reloadable_features.reject_early_connect_data` runtime flag to `true` will cause CONNECT requests that send data before 2xx response to be rejected. This options should be enabled if there are intermediaries upstream from Envoy that may reject establishment of a CONNECT tunnel. 

## Impact

De-synchronization of CONNECT tunnel state if a forwarding proxy upstream from Envoy responds with a non 2xx status.

## Attack vector(s)
Sending data for a CONNECT request before receiving 2xx response.

## Patches
Users should upgrade to v1.36.3, v1.35.7, v1.34.11 or v1.33.13

## Credits

[chasingimpact](https://github.com/chasingimpact) (Patrick)
GitHub Security Advisory: GHSA-rj35-4m94-77jh
Package: github.com/envoyproxy/envoy (GO)
Severity: LOW (CVSS 3.7)
CWE: CWE-693: Protection Mechanism Failure
Vulnerable versions: >= 1.35.0, <= 1.35.6
Patched in: 1.35.7

Summary: Envoy forwards early CONNECT data in TCP proxy mode

Details:
## Summary

Forwarding of early CONNECT data in TCP proxy mode.

## Details

Per [RFC 7231-4.3.6](https://www.rfc-editor.org/rfc/rfc7231#section-4.3.6) the sender of CONNECT (and all inbound proxies)  switch to tunnel mode only after receiving 2xx response. However in TCP proxy mode, Envoy accepts client data before it has issued a 2xx response and eagerly proxies it to an established TCP connection. This creates possibility of a de-synchronized tunnel state if a proxy upstream from Envoy responds with a status other an 2xx.

The RFC does not specify the behavior in case an early CONNECT data is received and early CONNECT data is common as a latency reduction mechanism. To prevent disruption to existing deployments Envoy will by default allow early CONNECT data. Setting the `envoy.reloadable_features.reject_early_connect_data` runtime flag to `true` will cause CONNECT requests that send data before 2xx response to be rejected. This options should be enabled if there are intermediaries upstream from Envoy that may reject establishment of a CONNECT tunnel. 

## Impact

De-synchronization of CONNECT tunnel state if a forwarding proxy upstream from Envoy responds with a non 2xx status.

## Attack vector(s)
Sending data for a CONNECT request before receiving 2xx response.

## Patches
Users should upgrade to v1.36.3, v1.35.7, v1.34.11 or v1.33.13

## Credits

[chasingimpact](https://github.com/chasingimpact) (Patrick)