deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-679f-wmrg-qf57
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 5.3.2-0[PII_REDACTED]2106-a18b80ba4c32
Patched in: 5.3.2-0[PII_REDACTED]2106-a18b80ba4c32

Summary: Mattermost allows a removed team member to enumerate all public channels within a private team

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate team membership when searching channels which allows a removed team member to enumerate all public channels within a private team via the channel search API endpoint. Mattermost Advisory ID: MMSA-2025-00568
GitHub Security Advisory: GHSA-679f-wmrg-qf57
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 8.0.0[PII_REDACTED]2106-a18b80ba4c32
Patched in: 8.0.0[PII_REDACTED]2106-a18b80ba4c32

Summary: Mattermost allows a removed team member to enumerate all public channels within a private team

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate team membership when searching channels which allows a removed team member to enumerate all public channels within a private team via the channel search API endpoint. Mattermost Advisory ID: MMSA-2025-00568
GitHub Security Advisory: GHSA-34g8-9fpp-46ch
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-789: Memory Allocation with Excessive Size Value
Vulnerable versions: >= 11.3.0-rc1, < 11.3.1
Patched in: 11.3.1

Summary: Mattermost fails to limit the size of responses from integration action endpoints

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 Mattermost fails to limit the size of responses from integration action endpoints, which allows an authenticated attacker to cause server memory exhaustion and denial of service via a malicious integration server that returns an arbitrarily large response when a user clicks an interactive message button. Mattermost Advisory ID: MMSA-2026-00571
GitHub Security Advisory: GHSA-34g8-9fpp-46ch
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-789: Memory Allocation with Excessive Size Value
Vulnerable versions: >= 11.2.0-rc1, < 11.2.3
Patched in: 11.2.3

Summary: Mattermost fails to limit the size of responses from integration action endpoints

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 Mattermost fails to limit the size of responses from integration action endpoints, which allows an authenticated attacker to cause server memory exhaustion and denial of service via a malicious integration server that returns an arbitrarily large response when a user clicks an interactive message button. Mattermost Advisory ID: MMSA-2026-00571
GitHub Security Advisory: GHSA-34g8-9fpp-46ch
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-789: Memory Allocation with Excessive Size Value
Vulnerable versions: >= 10.11.0-rc1, < 10.11.11
Patched in: 10.11.11

Summary: Mattermost fails to limit the size of responses from integration action endpoints

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 Mattermost fails to limit the size of responses from integration action endpoints, which allows an authenticated attacker to cause server memory exhaustion and denial of service via a malicious integration server that returns an arbitrarily large response when a user clicks an interactive message button. Mattermost Advisory ID: MMSA-2026-00571
GitHub Security Advisory: GHSA-34g8-9fpp-46ch
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-789: Memory Allocation with Excessive Size Value
Vulnerable versions: < 5.3.2-0[PII_REDACTED]5411-fe3052073dc6
Patched in: 5.3.2-0[PII_REDACTED]5411-fe3052073dc6

Summary: Mattermost fails to limit the size of responses from integration action endpoints

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 Mattermost fails to limit the size of responses from integration action endpoints, which allows an authenticated attacker to cause server memory exhaustion and denial of service via a malicious integration server that returns an arbitrarily large response when a user clicks an interactive message button. Mattermost Advisory ID: MMSA-2026-00571
GitHub Security Advisory: GHSA-34g8-9fpp-46ch
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-789: Memory Allocation with Excessive Size Value
Vulnerable versions: < 8.0.0[PII_REDACTED]5411-fe3052073dc6
Patched in: 8.0.0[PII_REDACTED]5411-fe3052073dc6

Summary: Mattermost fails to limit the size of responses from integration action endpoints

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 Mattermost fails to limit the size of responses from integration action endpoints, which allows an authenticated attacker to cause server memory exhaustion and denial of service via a malicious integration server that returns an arbitrarily large response when a user clicks an interactive message button. Mattermost Advisory ID: MMSA-2026-00571
GitHub Security Advisory: GHSA-ph22-fw5m-w2q9
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-346: Origin Validation Error
Vulnerable versions: >= 11.3.0-rc1, < 11.3.1
Patched in: 11.3.1

Summary: Mattermost allows attackers to spoof permalink embeds

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to sanitize client-supplied post metadata which allows an authenticated attacker to spoof permalink embeds impersonating other users via crafted PUT requests to the post update API endpoint. Mattermost Advisory ID: MMSA-2025-00569
GitHub Security Advisory: GHSA-ph22-fw5m-w2q9
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-346: Origin Validation Error
Vulnerable versions: >= 11.2.0-rc1, < 11.2.3
Patched in: 11.2.3

Summary: Mattermost allows attackers to spoof permalink embeds

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to sanitize client-supplied post metadata which allows an authenticated attacker to spoof permalink embeds impersonating other users via crafted PUT requests to the post update API endpoint. Mattermost Advisory ID: MMSA-2025-00569
GitHub Security Advisory: GHSA-ph22-fw5m-w2q9
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-346: Origin Validation Error
Vulnerable versions: >= 10.11.0-rc1, < 10.11.11
Patched in: 10.11.11

Summary: Mattermost allows attackers to spoof permalink embeds

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to sanitize client-supplied post metadata which allows an authenticated attacker to spoof permalink embeds impersonating other users via crafted PUT requests to the post update API endpoint. Mattermost Advisory ID: MMSA-2025-00569
GitHub Security Advisory: GHSA-ph22-fw5m-w2q9
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-346: Origin Validation Error
Vulnerable versions: < 5.3.2-0[PII_REDACTED]1116-9efe617be8b8
Patched in: 5.3.2-0[PII_REDACTED]1116-9efe617be8b8

Summary: Mattermost allows attackers to spoof permalink embeds

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to sanitize client-supplied post metadata which allows an authenticated attacker to spoof permalink embeds impersonating other users via crafted PUT requests to the post update API endpoint. Mattermost Advisory ID: MMSA-2025-00569
GitHub Security Advisory: GHSA-ph22-fw5m-w2q9
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-346: Origin Validation Error
Vulnerable versions: < 8.0.0[PII_REDACTED]1116-9efe617be8b8
Patched in: 8.0.0[PII_REDACTED]1116-9efe617be8b8

Summary: Mattermost allows attackers to spoof permalink embeds

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to sanitize client-supplied post metadata which allows an authenticated attacker to spoof permalink embeds impersonating other users via crafted PUT requests to the post update API endpoint. Mattermost Advisory ID: MMSA-2025-00569
GitHub Security Advisory: GHSA-44mv-jq72-gj49
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-789: Memory Allocation with Excessive Size Value
Vulnerable versions: >= 11.3.0-rc1, < 11.3.1
Patched in: 11.3.1

Summary: Mattermost fails to bound memory allocation when processing PSD image files

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to bound memory allocation when processing PSD image files which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted PSD file. Mattermost Advisory ID: MMSA-2026-00572
GitHub Security Advisory: GHSA-44mv-jq72-gj49
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-789: Memory Allocation with Excessive Size Value
Vulnerable versions: >= 11.2.0-rc1, < 11.2.3
Patched in: 11.2.3

Summary: Mattermost fails to bound memory allocation when processing PSD image files

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to bound memory allocation when processing PSD image files which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted PSD file. Mattermost Advisory ID: MMSA-2026-00572
GitHub Security Advisory: GHSA-44mv-jq72-gj49
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-789: Memory Allocation with Excessive Size Value
Vulnerable versions: >= 10.11.0-rc1, < 10.11.11
Patched in: 10.11.11

Summary: Mattermost fails to bound memory allocation when processing PSD image files

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to bound memory allocation when processing PSD image files which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted PSD file. Mattermost Advisory ID: MMSA-2026-00572
GitHub Security Advisory: GHSA-44mv-jq72-gj49
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-789: Memory Allocation with Excessive Size Value
Vulnerable versions: < 5.3.2-0[PII_REDACTED]3946-38b413a27604
Patched in: 5.3.2-0[PII_REDACTED]3946-38b413a27604

Summary: Mattermost fails to bound memory allocation when processing PSD image files

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to bound memory allocation when processing PSD image files which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted PSD file. Mattermost Advisory ID: MMSA-2026-00572
GitHub Security Advisory: GHSA-44mv-jq72-gj49
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-789: Memory Allocation with Excessive Size Value
Vulnerable versions: < 8.0.0[PII_REDACTED]3946-38b413a27604
Patched in: 8.0.0[PII_REDACTED]3946-38b413a27604

Summary: Mattermost fails to bound memory allocation when processing PSD image files

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to bound memory allocation when processing PSD image files which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted PSD file. Mattermost Advisory ID: MMSA-2026-00572
GitHub Security Advisory: GHSA-2v3w-6g35-5f9v
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-1287: Improper Validation of Specified Type of Input
Vulnerable versions: >= 11.3.0-rc1, < 11.3.1
Patched in: 11.3.1

Summary: Mattermost fails to properly validate User-Agent header tokens

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate User-Agent header tokens which allows an authenticated attacker to cause a request panic via a specially crafted User-Agent header. Mattermost Advisory ID: MMSA-2026-00586
GitHub Security Advisory: GHSA-2v3w-6g35-5f9v
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-1287: Improper Validation of Specified Type of Input
Vulnerable versions: >= 11.2.0-rc1, < 11.2.3
Patched in: 11.2.3

Summary: Mattermost fails to properly validate User-Agent header tokens

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate User-Agent header tokens which allows an authenticated attacker to cause a request panic via a specially crafted User-Agent header. Mattermost Advisory ID: MMSA-2026-00586
GitHub Security Advisory: GHSA-2v3w-6g35-5f9v
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-1287: Improper Validation of Specified Type of Input
Vulnerable versions: >= 10.11.0-rc1, < 10.11.11
Patched in: 10.11.11

Summary: Mattermost fails to properly validate User-Agent header tokens

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate User-Agent header tokens which allows an authenticated attacker to cause a request panic via a specially crafted User-Agent header. Mattermost Advisory ID: MMSA-2026-00586
GitHub Security Advisory: GHSA-2v3w-6g35-5f9v
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-1287: Improper Validation of Specified Type of Input
Vulnerable versions: < 5.3.2-0[PII_REDACTED]1235-1346cf529aef
Patched in: 5.3.2-0[PII_REDACTED]1235-1346cf529aef

Summary: Mattermost fails to properly validate User-Agent header tokens

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate User-Agent header tokens which allows an authenticated attacker to cause a request panic via a specially crafted User-Agent header. Mattermost Advisory ID: MMSA-2026-00586
GitHub Security Advisory: GHSA-2v3w-6g35-5f9v
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-1287: Improper Validation of Specified Type of Input
Vulnerable versions: < 8.0.0[PII_REDACTED]1235-1346cf529aef
Patched in: 8.0.0[PII_REDACTED]1235-1346cf529aef

Summary: Mattermost fails to properly validate User-Agent header tokens

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate User-Agent header tokens which allows an authenticated attacker to cause a request panic via a specially crafted User-Agent header. Mattermost Advisory ID: MMSA-2026-00586
GitHub Security Advisory: GHSA-xv2p-wchj-qjhp
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-789: Memory Allocation with Excessive Size Value
Vulnerable versions: >= 11.3.0-rc1, < 11.3.1
Patched in: 11.3.1

Summary: Mattermost fails to bound memory allocation when processing DOC files

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to bound memory allocation when processing DOC files which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted DOC file.. Mattermost Advisory ID: MMSA-2026-00581
GitHub Security Advisory: GHSA-xv2p-wchj-qjhp
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-789: Memory Allocation with Excessive Size Value
Vulnerable versions: >= 11.2.0-rc1, < 11.2.3
Patched in: 11.2.3

Summary: Mattermost fails to bound memory allocation when processing DOC files

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to bound memory allocation when processing DOC files which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted DOC file.. Mattermost Advisory ID: MMSA-2026-00581
GitHub Security Advisory: GHSA-xv2p-wchj-qjhp
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-789: Memory Allocation with Excessive Size Value
Vulnerable versions: >= 10.11.0-rc1, < 10.11.11
Patched in: 10.11.11

Summary: Mattermost fails to bound memory allocation when processing DOC files

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to bound memory allocation when processing DOC files which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted DOC file.. Mattermost Advisory ID: MMSA-2026-00581
GitHub Security Advisory: GHSA-xv2p-wchj-qjhp
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-789: Memory Allocation with Excessive Size Value
Vulnerable versions: < 5.3.2-0[PII_REDACTED]5601-86797c508c44
Patched in: 5.3.2-0[PII_REDACTED]5601-86797c508c44

Summary: Mattermost fails to bound memory allocation when processing DOC files

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to bound memory allocation when processing DOC files which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted DOC file.. Mattermost Advisory ID: MMSA-2026-00581
GitHub Security Advisory: GHSA-xv2p-wchj-qjhp
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-789: Memory Allocation with Excessive Size Value
Vulnerable versions: < 8.0.0[PII_REDACTED]5601-86797c508c44
Patched in: 8.0.0[PII_REDACTED]5601-86797c508c44

Summary: Mattermost fails to bound memory allocation when processing DOC files

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to bound memory allocation when processing DOC files which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted DOC file.. Mattermost Advisory ID: MMSA-2026-00581
GitHub Security Advisory: GHSA-m5rv-56xx-hfc6
Package: github.com/mattermost/mattermost-server (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 11.3.0-rc1, < 11.3.1
Patched in: 11.3.1

Summary: Mattermost fails to properly handle very long passwords

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly handle very long passwords, which allows an attacker to overload the server CPU and memory via executing login attempts with multi-megabyte passwords. Mattermost Advisory ID: MMSA-2026-00587
GitHub Security Advisory: GHSA-m5rv-56xx-hfc6
Package: github.com/mattermost/mattermost-server (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 11.2.0-rc1, < 11.2.3
Patched in: 11.2.3

Summary: Mattermost fails to properly handle very long passwords

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly handle very long passwords, which allows an attacker to overload the server CPU and memory via executing login attempts with multi-megabyte passwords. Mattermost Advisory ID: MMSA-2026-00587
GitHub Security Advisory: GHSA-m5rv-56xx-hfc6
Package: github.com/mattermost/mattermost-server (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 10.11.0-rc1, < 10.11.11
Patched in: 10.11.11

Summary: Mattermost fails to properly handle very long passwords

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly handle very long passwords, which allows an attacker to overload the server CPU and memory via executing login attempts with multi-megabyte passwords. Mattermost Advisory ID: MMSA-2026-00587
GitHub Security Advisory: GHSA-m5rv-56xx-hfc6
Package: github.com/mattermost/mattermost-server (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 5.3.2-0[PII_REDACTED]4748-7201f42d955f
Patched in: 5.3.2-0[PII_REDACTED]4748-7201f42d955f

Summary: Mattermost fails to properly handle very long passwords

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly handle very long passwords, which allows an attacker to overload the server CPU and memory via executing login attempts with multi-megabyte passwords. Mattermost Advisory ID: MMSA-2026-00587
GitHub Security Advisory: GHSA-m5rv-56xx-hfc6
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 8.0.0[PII_REDACTED]4748-7201f42d955f
Patched in: 8.0.0[PII_REDACTED]4748-7201f42d955f

Summary: Mattermost fails to properly handle very long passwords

Details:
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly handle very long passwords, which allows an attacker to overload the server CPU and memory via executing login attempts with multi-megabyte passwords. Mattermost Advisory ID: MMSA-2026-00587
GitHub Security Advisory: GHSA-hxm7-9q36-c77f
Package: github.com/ctfer-io/fullchain (GO)
Severity: HIGH (CVSS 9.8)
CWE: CWE-284: Improper Access Control
Vulnerable versions: < 0.1.1
Patched in: 0.1.1

Summary: Fullchain's Invalid NetworkPolicy enables a malicious actor to pivot into another namespace

Details:
### Impact

Due to a mis-written NetworkPolicy, a malicious actor can pivot from a subverted application to any Pod out of the origin namespace.
This breaks the security-by-default property expected as part of the deployment program, leading to a potential lateral movement.

### Patch

Removing the `inter-ns` NetworkPolicy patches the vulnerability. If updates are not possible in production environments, we recommend to manually delete it and update as soon as possible.

### Workaround

Given your context, delete the failing network policy that should be prefixed by `inter-ns-` in the target namespace.
You can use the following to delete all matching network policy. If unsure of the outcome, please do it manually.

```bash
for ns in $(kubectl get ns -o jsonpath='{.items[*].metadata.name}' | tr ' ' '\n' | grep '^ns-'); do
  kubectl -n "$ns" get networkpolicy -o name \
  | grep '^networkpolicy.networking.k8s.io/inter-ns-' \
  | xargs -r kubectl -n "$ns" delete
done
```
GitHub Security Advisory: GHSA-fgm3-q9r5-43v9
Package: github.com/ctfer-io/romeo/environment/deploy (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-284: Improper Access Control
Vulnerable versions: < 0.2.1
Patched in: 0.2.1

Summary: Romeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespace 

Details:
### Impact

Due to a mis-written NetworkPolicy, a malicious actor can pivot from the "hardened" namespace to any Pod out of it.
This breaks the security-by-default property expected as part of the deployment program, leading to a potential lateral movement.

### Patch

Removing the `inter-ns` NetworkPolicy patches the vulnerability. If updates are not possible in production environments, we recommend to manually delete it and update as soon as possible.

### Workaround

Given your context, delete the failing network policy that should be prefixed by `inter-ns-` in the target namespace.