deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-rj35-4m94-77jh
Package: github.com/envoyproxy/envoy (GO)
Severity: LOW (CVSS 3.7)
CWE: CWE-693: Protection Mechanism Failure
Vulnerable versions: >= 1.36.0, <= 1.36.2
Patched in: 1.36.3

Summary: Envoy forwards early CONNECT data in TCP proxy mode

Details:
## Summary

Forwarding of early CONNECT data in TCP proxy mode.

## Details

Per [RFC 7231-4.3.6](https://www.rfc-editor.org/rfc/rfc7231#section-4.3.6) the sender of CONNECT (and all inbound proxies)  switch to tunnel mode only after receiving 2xx response. However in TCP proxy mode, Envoy accepts client data before it has issued a 2xx response and eagerly proxies it to an established TCP connection. This creates possibility of a de-synchronized tunnel state if a proxy upstream from Envoy responds with a status other an 2xx.

The RFC does not specify the behavior in case an early CONNECT data is received and early CONNECT data is common as a latency reduction mechanism. To prevent disruption to existing deployments Envoy will by default allow early CONNECT data. Setting the `envoy.reloadable_features.reject_early_connect_data` runtime flag to `true` will cause CONNECT requests that send data before 2xx response to be rejected. This options should be enabled if there are intermediaries upstream from Envoy that may reject establishment of a CONNECT tunnel. 

## Impact

De-synchronization of CONNECT tunnel state if a forwarding proxy upstream from Envoy responds with a non 2xx status.

## Attack vector(s)
Sending data for a CONNECT request before receiving 2xx response.

## Patches
Users should upgrade to v1.36.3, v1.35.7, v1.34.11 or v1.33.13

## Credits

[chasingimpact](https://github.com/chasingimpact) (Patrick)
GitHub Security Advisory: GHSA-mp85-7mrq-r866
Package: github.com/envoyproxy/envoy (GO)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-476: NULL Pointer Dereference
Vulnerable versions: <= 1.33.12
Patched in: 1.33.13

Summary: Envoy crashes when JWT authentication is configured with the remote JWKS fetching

Details:
### Summary
Envoy crashes when JWT authentication is configured with the remote JWKS fetching, `allow_missing_or_failed` is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails.

### Details
This is caused by a re-entry bug in the `JwksFetcherImpl`. When the first token's JWKS fetch fails, `onJwksError()` callback triggers processing of the second token, which calls fetch() again on the same fetcher object.

The original callback's reset() then clears the second fetch's state (`receiver_ and request_`) which causes a crash when the async HTTP response arrives.

### PoC
* `allow_missing_or_failed` or `allow_missing` is enabled
* The client send 2 Authorization headers
* the remote JWKS fetching failed
* There will be crash

### Impact
DoS and Crash

### Mitigation
* Disable the `allow_missing_or_failed` or `allow_missing`
GitHub Security Advisory: GHSA-mp85-7mrq-r866
Package: github.com/envoyproxy/envoy (GO)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-476: NULL Pointer Dereference
Vulnerable versions: >= 1.34.0, <= 1.34.10
Patched in: 1.34.11

Summary: Envoy crashes when JWT authentication is configured with the remote JWKS fetching

Details:
### Summary
Envoy crashes when JWT authentication is configured with the remote JWKS fetching, `allow_missing_or_failed` is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails.

### Details
This is caused by a re-entry bug in the `JwksFetcherImpl`. When the first token's JWKS fetch fails, `onJwksError()` callback triggers processing of the second token, which calls fetch() again on the same fetcher object.

The original callback's reset() then clears the second fetch's state (`receiver_ and request_`) which causes a crash when the async HTTP response arrives.

### PoC
* `allow_missing_or_failed` or `allow_missing` is enabled
* The client send 2 Authorization headers
* the remote JWKS fetching failed
* There will be crash

### Impact
DoS and Crash

### Mitigation
* Disable the `allow_missing_or_failed` or `allow_missing`
GitHub Security Advisory: GHSA-mp85-7mrq-r866
Package: github.com/envoyproxy/envoy (GO)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-476: NULL Pointer Dereference
Vulnerable versions: >= 1.35.0, <= 1.35.6
Patched in: 1.35.7

Summary: Envoy crashes when JWT authentication is configured with the remote JWKS fetching

Details:
### Summary
Envoy crashes when JWT authentication is configured with the remote JWKS fetching, `allow_missing_or_failed` is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails.

### Details
This is caused by a re-entry bug in the `JwksFetcherImpl`. When the first token's JWKS fetch fails, `onJwksError()` callback triggers processing of the second token, which calls fetch() again on the same fetcher object.

The original callback's reset() then clears the second fetch's state (`receiver_ and request_`) which causes a crash when the async HTTP response arrives.

### PoC
* `allow_missing_or_failed` or `allow_missing` is enabled
* The client send 2 Authorization headers
* the remote JWKS fetching failed
* There will be crash

### Impact
DoS and Crash

### Mitigation
* Disable the `allow_missing_or_failed` or `allow_missing`
GitHub Security Advisory: GHSA-mp85-7mrq-r866
Package: github.com/envoyproxy/envoy (GO)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-476: NULL Pointer Dereference
Vulnerable versions: >= 1.36.0, <= 1.36.2
Patched in: 1.36.3

Summary: Envoy crashes when JWT authentication is configured with the remote JWKS fetching

Details:
### Summary
Envoy crashes when JWT authentication is configured with the remote JWKS fetching, `allow_missing_or_failed` is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails.

### Details
This is caused by a re-entry bug in the `JwksFetcherImpl`. When the first token's JWKS fetch fails, `onJwksError()` callback triggers processing of the second token, which calls fetch() again on the same fetcher object.

The original callback's reset() then clears the second fetch's state (`receiver_ and request_`) which causes a crash when the async HTTP response arrives.

### PoC
* `allow_missing_or_failed` or `allow_missing` is enabled
* The client send 2 Authorization headers
* the remote JWKS fetching failed
* There will be crash

### Impact
DoS and Crash

### Mitigation
* Disable the `allow_missing_or_failed` or `allow_missing`
GitHub Security Advisory: GHSA-498j-wxww-j897
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.3.0-rc1, < 4.3.0
Patched in: 4.3.0

Summary: Mattermost Server is vulnerable to XSS through author_link field in Slack attachments

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the author_link field of a Slack attachment.
GitHub Security Advisory: GHSA-498j-wxww-j897
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.2.0, < 4.2.1
Patched in: 4.2.1

Summary: Mattermost Server is vulnerable to XSS through author_link field in Slack attachments

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the author_link field of a Slack attachment.
GitHub Security Advisory: GHSA-498j-wxww-j897
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 4.1.2
Patched in: 4.1.2

Summary: Mattermost Server is vulnerable to XSS through author_link field in Slack attachments

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the author_link field of a Slack attachment.
GitHub Security Advisory: GHSA-h564-6gc2-fcc6
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-284: Improper Access Control, CWE-639: Authorization Bypass Through User-Controlled Key, CWE-732: Incorrect Permission Assignment for Critical Resource
Vulnerable versions: >= 4.3.0-rc1, < 4.3.0
Patched in: 4.3.0

Summary: Mattermost Server allows users with a session ID to revoke another users' session

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ID allows revoking another user's session.
GitHub Security Advisory: GHSA-h564-6gc2-fcc6
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-284: Improper Access Control, CWE-639: Authorization Bypass Through User-Controlled Key, CWE-732: Incorrect Permission Assignment for Critical Resource
Vulnerable versions: >= 4.2.0-rc1, < 4.2.1-0[PII_REDACTED]2657-8fbbd688ea24
Patched in: 4.2.1-0[PII_REDACTED]2657-8fbbd688ea24

Summary: Mattermost Server allows users with a session ID to revoke another users' session

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ID allows revoking another user's session.
GitHub Security Advisory: GHSA-h564-6gc2-fcc6
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-284: Improper Access Control, CWE-639: Authorization Bypass Through User-Controlled Key, CWE-732: Incorrect Permission Assignment for Critical Resource
Vulnerable versions: < 4.1.2-0[PII_REDACTED]1910-6be8113eb60c
Patched in: 4.1.2-0[PII_REDACTED]1910-6be8113eb60c

Summary: Mattermost Server allows users with a session ID to revoke another users' session

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ID allows revoking another user's session.
GitHub Security Advisory: GHSA-9x8x-w6g5-hx4w
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.3.0-rc1, < 4.3.0
Patched in: 4.3.0

Summary: Mattermost Server is vulnerable to XSS attacks against an OAuth 2.0 allow/deny page

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page.
GitHub Security Advisory: GHSA-9x8x-w6g5-hx4w
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.2.0, < 4.2.1
Patched in: 4.2.1

Summary: Mattermost Server is vulnerable to XSS attacks against an OAuth 2.0 allow/deny page

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page.
GitHub Security Advisory: GHSA-9x8x-w6g5-hx4w
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 4.1.2
Patched in: 4.1.2

Summary: Mattermost Server is vulnerable to XSS attacks against an OAuth 2.0 allow/deny page

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page.
GitHub Security Advisory: GHSA-4f99-4q7p-p3gh
Package: github.com/sirupsen/logrus (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: = 1.9.2
Patched in: 1.9.3

Summary: Logrus is vulnerable to DoS when using Entry.Writer()

Details:
A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.
GitHub Security Advisory: GHSA-4f99-4q7p-p3gh
Package: github.com/sirupsen/logrus (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: = 1.9.0
Patched in: 1.9.1

Summary: Logrus is vulnerable to DoS when using Entry.Writer()

Details:
A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.
GitHub Security Advisory: GHSA-4f99-4q7p-p3gh
Package: github.com/sirupsen/logrus (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.8.3
Patched in: 1.8.3

Summary: Logrus is vulnerable to DoS when using Entry.Writer()

Details:
A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.
GitHub Security Advisory: GHSA-hjqh-j6rj-gh8q
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 4.3.0-rc1, < 4.3.0
Patched in: 4.3.0

Summary: Mattermost Server is vulnerable to Path Traversal when files are stored locally

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can test for the existence of an arbitrary file.
GitHub Security Advisory: GHSA-hjqh-j6rj-gh8q
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 4.2.0-rc1.0[PII_REDACTED]4238-fadd9514f6e7, < 4.2.1-0[PII_REDACTED]4140-6d3cb2ce07fc
Patched in: 4.2.1-0[PII_REDACTED]4140-6d3cb2ce07fc

Summary: Mattermost Server is vulnerable to Path Traversal when files are stored locally

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can test for the existence of an arbitrary file.
GitHub Security Advisory: GHSA-hjqh-j6rj-gh8q
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 4.1.2-0[PII_REDACTED]1910-6be8113eb60c
Patched in: 4.1.2-0[PII_REDACTED]1910-6be8113eb60c

Summary: Mattermost Server is vulnerable to Path Traversal when files are stored locally

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can test for the existence of an arbitrary file.
GitHub Security Advisory: GHSA-9rr5-q43r-ccv4
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 4.3.0-rc1, < 4.3.0
Patched in: 4.3.0

Summary: Mattermost Server does not prevent System Admin from arbitrary file creation

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary files.
GitHub Security Advisory: GHSA-9rr5-q43r-ccv4
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 4.2.0-rc1.0[PII_REDACTED]4238-fadd9514f6e7, < 4.2.1-0[PII_REDACTED]4140-6d3cb2ce07fc
Patched in: 4.2.1-0[PII_REDACTED]4140-6d3cb2ce07fc

Summary: Mattermost Server does not prevent System Admin from arbitrary file creation

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary files.
GitHub Security Advisory: GHSA-9rr5-q43r-ccv4
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 4.1.2-0[PII_REDACTED]1910-6be8113eb60c
Patched in: 4.1.2-0[PII_REDACTED]1910-6be8113eb60c

Summary: Mattermost Server does not prevent System Admin from arbitrary file creation

Details:
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary files.
GitHub Security Advisory: GHSA-jwfv-5hwq-f97r
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 4.0.5-rc1, < 4.1.0
Patched in: 4.1.0

Summary: Mattermost Server exposes team invite IDs through API endpoints

Details:
An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover team invite IDs via team API endpoints.
GitHub Security Advisory: GHSA-jwfv-5hwq-f97r
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 4.0.0, < 4.0.4
Patched in: 4.0.4

Summary: Mattermost Server exposes team invite IDs through API endpoints

Details:
An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover team invite IDs via team API endpoints.
GitHub Security Advisory: GHSA-jwfv-5hwq-f97r
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 3.10.3
Patched in: 3.10.3

Summary: Mattermost Server exposes team invite IDs through API endpoints

Details:
An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover team invite IDs via team API endpoints.
GitHub Security Advisory: GHSA-jc6w-8r7f-vmp5
Package: github.com/mattermost/mattermost-server (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-248: Uncaught Exception
Vulnerable versions: >= 4.5.0-rc1, < 4.5.0
Patched in: 4.5.0

Summary: Mattermost Server vulnerable to Denial of Service through `@` character prefix inserted into JavaScript field names

Details:
An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denial of service (application crash) via an @ character before a JavaScript field name.
GitHub Security Advisory: GHSA-jc6w-8r7f-vmp5
Package: github.com/mattermost/mattermost-server (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-248: Uncaught Exception
Vulnerable versions: >= 4.4.0-rc1, < 4.4.5
Patched in: 4.4.5

Summary: Mattermost Server vulnerable to Denial of Service through `@` character prefix inserted into JavaScript field names

Details:
An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denial of service (application crash) via an @ character before a JavaScript field name.
GitHub Security Advisory: GHSA-jc6w-8r7f-vmp5
Package: github.com/mattermost/mattermost-server (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-248: Uncaught Exception
Vulnerable versions: >= 4.3.0-rc1, < 4.3.4
Patched in: 4.3.4

Summary: Mattermost Server vulnerable to Denial of Service through `@` character prefix inserted into JavaScript field names

Details:
An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denial of service (application crash) via an @ character before a JavaScript field name.
GitHub Security Advisory: GHSA-jc6w-8r7f-vmp5
Package: github.com/mattermost/mattermost-server (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-248: Uncaught Exception
Vulnerable versions: < 4.2.2
Patched in: 4.2.2

Summary: Mattermost Server vulnerable to Denial of Service through `@` character prefix inserted into JavaScript field names

Details:
An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denial of service (application crash) via an @ character before a JavaScript field name.
GitHub Security Advisory: GHSA-9j9j-mm2r-9rfm
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-732: Incorrect Permission Assignment for Critical Resource
Vulnerable versions: > 4.5.0-rc1, < 4.5.0
Patched in: 4.5.0

Summary: Mattermost Server has mishandled webhook access control

Details:
An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4. It mishandled webhook access control in the EnableOnlyAdminIntegrations case.
GitHub Security Advisory: GHSA-9j9j-mm2r-9rfm
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-732: Incorrect Permission Assignment for Critical Resource
Vulnerable versions: >= 4.4.0-rc1, < 4.4.5
Patched in: 4.4.5

Summary: Mattermost Server has mishandled webhook access control

Details:
An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4. It mishandled webhook access control in the EnableOnlyAdminIntegrations case.
GitHub Security Advisory: GHSA-9j9j-mm2r-9rfm
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-732: Incorrect Permission Assignment for Critical Resource
Vulnerable versions: < 4.3.4
Patched in: 4.3.4

Summary: Mattermost Server has mishandled webhook access control

Details:
An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4. It mishandled webhook access control in the EnableOnlyAdminIntegrations case.
GitHub Security Advisory: GHSA-h8cp-697h-8c8p
Package: github.com/smallstep/certificates (GO)
Severity: CRITICAL (CVSS 10.0)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: <= 0.28.4
Patched in: 0.29.0

Summary: Step CA Has Authorization Bypass in ACME and SCEP Provisioners

Details:
## Summary

A security fix is now available for Step CA that resolves a vulnerability affecting deployments configured with ACME and/or SCEP provisioners.
All operators running these provisioners should upgrade to the latest release (`v0.29.0`) immediately.

The issue was discovered and disclosed by a research team during a security review. There is no evidence of active exploitation.

To limit exploitation risk during a coordinated disclosure window, we are withholding detailed technical information for now. A full write-up will be published in several weeks.

---

## Embargo List

If your organization runs Step CA in production and would like advance, embargoed notification of future security updates, visit https://u.step.sm/disclosure to request inclusion on our embargo list.

---

## Acknowledgements

This issue was identified and reported by Stephen Kubik of the Cisco Advanced Security Initiatives Group (ASIG)

---

Stay safe, and thank you for helping us keep the ecosystem secure.