deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-7g3r-8c6v-hfmr
Package: github.com/hashicorp/consul (GO)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 1.22.0
Patched in: 1.22.0

Summary: Consul key/value endpoint is vulnerable to denial of service

Details:
Consul and Consul Enterprise’s (“Consul”) key/value endpoint is vulnerable to denial of service (DoS) due to incorrect Content Length header validation. This vulnerability, CVE-2025-11374, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12.
GitHub Security Advisory: GHSA-hq76-6gh2-5g4q
Package: github.com/edgelesssys/constellation/v2 (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-347: Improper Verification of Cryptographic Signature, CWE-552: Files or Directories Accessible to External Parties
Vulnerable versions: <= 2.23.1
Patched in: 2.24.0

Summary: Constellation has insecure LUKS2 persistent storage partitions which may be opened and used

Details:
### Summary
A malicious host may provide a crafted LUKS2 volume to a confidential computing guest that is using the [OpenCryptDevice](https://github.com/edgelesssys/constellation/blob/6eff250f16f8ae48221d412550e4a64a4bf0d77b/csi/cryptmapper/cryptmapper.go#L89) feature. The guest will open the volume and write secret data using a volume key known to the attacker. The attacker can also pre-load data on the device, which could potentially compromise guest execution.


LUKS2 volume metadata is not authenticated and supports null key-encryption algorithms, allowing an attacker to create a volume such that the volume:
- Opens (cryptsetup open) without error using any passphrase or token
- Records all writes in plaintext (or ciphertext with an attacker-known key)
- Contains arbitrary data chosen by the attacker


### Details
The Constellation CVM image uses LUKS2-encrypted volumes for persistent storage. When opening an encrypted storage device, the CVM uses the `libcryptsetup`  function [crypt_activate_by_passhrase](https://github.com/martinjungblut/go-cryptsetup/blob/fd0874fd07a6e477f0a4d18f2e80234983afe74f/device.go#L261). If the VM is successful in opening the partition with the disk encryption key, it treats the volume as confidential. However, due to the unsafe handling of null keyslot algorithms in the cryptsetup 2.8.1,  it is possible that the opened volume is not encrypted at all.

Cryptsetup prior to version 2.8.1 does not report an error when processing LUKS2-formatted disks that use the `cipher_null-ecb` algorithm in the keyslot `encryption` field.

### Impact

A LUKS2 disk encrypted with a master key, which is in turn encrypted with user passwords stored in some number of keyslots. By creating a malicious disk which sets the keyslot encryption algorithm to `”crypto_null-ecb”`, an attacker can construct a disk such that keyslot decryption does not depend in any way on the enclave-held secret data. When a confidential guest opens such a device using `cryptsetup open`, the mapped disk is created without error, and any further writes to the disk are encrypted using an attacker-controlled key.

### Patches

To protect against this and similar attacks, Constellation now performs detached reading of LUKS headers. The header is copied into the encrypted memory of the CVM and then verified. The verified header is then used to open the encrypted LUKS device in detached header mode. This was implemented in https://github.com/edgelesssys/constellation/pull/3927 and release as part of [Constellation v2.24.0](https://github.com/edgelesssys/constellation/releases/tag/v2.24.0).
GitHub Security Advisory: GHSA-hgrp-fgm8-56g8
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 4.4.0-rc1, < 4.4.3
Patched in: 4.4.3

Summary: Mattermost Server's OAuth 2.0 service is vulnerable to attack through Missing Authorization

Details:
An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider.
GitHub Security Advisory: GHSA-hgrp-fgm8-56g8
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 4.3.3
Patched in: 4.3.3

Summary: Mattermost Server's OAuth 2.0 service is vulnerable to attack through Missing Authorization

Details:
An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider.
GitHub Security Advisory: GHSA-5qjg-9mjh-4r92
Package: github.com/karmada-io/dashboard (GO)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 0.2.0
Patched in: 0.2.0

Summary: Karmada Dashboard API Unauthorized Access Vulnerability 

Details:
### Impact
This is an authentication bypass vulnerability in the Karmada Dashboard API. The backend API endpoints (e.g., /api/v1/secret, /api/v1/service) did not enforce authentication, allowing unauthenticated users to access sensitive cluster information such as Secrets and Services directly. Although the web UI required a valid JWT for access, the API itself remained exposed to direct requests without any authentication checks. Any user or entity with network access to the Karmada Dashboard service could exploit this vulnerability to retrieve sensitive data.

### Patches
The issue has been fixed in Karmada Dashboard v0.2.0. This release enforces authentication for all API endpoints. Users are strongly advised to upgrade to version v0.2.0 or later as soon as possible.

### Workarounds
If upgrading is not immediately feasible, users can mitigate the risk by:

- Restricting network access to the Karmada Dashboard service using Kubernetes Network Policies, firewall rules, or ingress controls.
- Placing the Dashboard behind a reverse proxy that enforces authentication (e.g., OAuth2 proxy) to add an additional layer of security.

### References
- Karmada Dashboard v0.2.0 Release : https://github.com/karmada-io/dashboard/releases/tag/v0.2.0
- Fix PR #271
- Fix PR #280
GitHub Security Advisory: GHSA-j4vr-pcmw-hx59
Package: github.com/rancher/rancher (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-281: Improper Preservation of Permissions
Vulnerable versions: < 0.0.0[PII_REDACTED]2116-7faa74a968c2
Patched in: 0.0.0[PII_REDACTED]2116-7faa74a968c2

Summary: Rancher user retains access to clusters despite Global Role removal

Details:
### Impact
A vulnerability has been identified within Rancher Manager, where after removing a custom GlobalRole that gives administrative access or the corresponding binding, the user still retains access to clusters.
This only affects custom Global Roles that:
- Have a `*` on `*` in `*` rule for resources
- Have a `*` on `*` rule for non-resource URLs

For example
```yaml
apiVersion: management.cattle.io/v3
kind: GlobalRole
metadata:
  name: custom-admin
rules:
  - apiGroups:
      - '*'
    resources:
      - '*'
    verbs:
      - '*'
  - nonResourceURLs:
      - '*'
    verbs:
      - '*'
```

Specifically:
- When a user is bound to a custom admin `GlobalRole`, a corresponding `ClusterRoleBinding` is created on all clusters that binds them to the cluster-admin `ClusterRole`.
- When such a `GlobalRole` or the `GlobalRoleBinding` (e.g., when the user is unassigned from this role in UI) is deleted, the `ClusterRoleBinding` that binds them to the cluster-admin ClusterRole stays behind.

This issue allows a user to continue having access to clusters after they have been unassigned from the custom admin global role or the role has been deleted.

Please consult the associated  [MITRE ATT&CK - Technique - Account Access Removal](https://attack.mitre.org/techniques/T1531/) for further information about this category of attack.

### Patches
This vulnerability is addressed by removing the corresponding `ClusterRoleBindings` whenever the admin `GlobalRole` or its `GlobalRoleBindings` are deleted. Previously orphaned `ClusterRoleBindings` are marked with the annotation `authz.cluster.cattle.io/admin-globalrole-missing=true` and should be deleted manually.

Orphaned ClusterRoleBindings can be listed with:
```
kubectl get clusterrolebinding -o jsonpath='{range .items[?(@.metadata.annotations.authz\.cluster\.cattle\.io/admin-globalrole-missing=="true")]}{.metadata.name}{"\n"}{end}'
```

Patched versions of Rancher include releases `v2.12.3`, `v2.11.7`.

Complications with the restricted admin functionality prevented the patches from being included in `v2.10` and `v2.9`.

### Workarounds
If the deployment can't be upgraded to a fixed version, users are advised to manually identify the orphaned `ClusterRoleBindings` and remove them.

### References
If you have any questions or comments about this advisory:
- Contact the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.
- Open an issue in the [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.
- Verify with our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).
GitHub Security Advisory: GHSA-vp5w-xcfc-73wf
Package: github.com/hashicorp/vault (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 1.20.3, < 1.21.0
Patched in: 1.21.0

Summary: Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON

Details:
Vault and Vault Enterprise ("Vault") are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due to a regression from a previous fix for [+HCSEC-2025-24+|https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393]  which allowed for processing JSON payloads before applying rate limits. This vulnerability, CVE-2025-12044, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.16.27, 1.19.11, 1.20.5, and 1.21.0.
GitHub Security Advisory: GHSA-9g4h-h484-3578
Package: github.com/hashicorp/vault (GO)
Severity: HIGH (CVSS 8.1)
CWE: CWE-288: Authentication Bypass Using an Alternate Path or Channel
Vulnerable versions: >= 0.6.0, < 1.21.0
Patched in: 1.21.0

Summary: HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass

Details:
Vault and Vault Enterprise's ("Vault") AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_principal_iam is the same across AWS accounts, or uses a wildcard. This vulnerability is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.21.0, 1.20.5, 1.19.11, and 1.16.27.
GitHub Security Advisory: GHSA-x6fh-7qmf-69xh
Package: github.com/slackhq/nebula (GO)
Severity: MODERATE (CVSS 4.9)
CWE: CWE-420: Unprotected Alternate Channel
Vulnerable versions: >= 1.9.4, < 1.9.7
Patched in: 1.9.7

Summary: Slack Nebula may accept arbitrary source IP addresses 

Details:
Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.
GitHub Security Advisory: GHSA-jp7h-4f3c-9rc7
Package: github.com/openbao/openbao-plugins (GO)
Severity: HIGH (CVSS 8.1)
CWE: CWE-694: Use of Multiple Resources with Duplicate Identifier, CWE-863: Incorrect Authorization
Vulnerable versions: <= 0.1.0
Patched in: 0.1.1

Summary: OpenBao AWS Plugin Vulnerable to Cross-Account IAM Role Impersonation in AWS Auth Method

Details:
### Impact
This is a cross-account impersonation vulnerability in the `auth-aws` plugin. The vulnerability allows an IAM role from an untrusted AWS account to authenticate by impersonating a role with the **same name** in a trusted account, leading to unauthorized access.

This impacts all users of the `auth-aws` plugin who operate in a multi-account AWS environment where IAM role names may not be unique across accounts.

The core of the vulnerability is a flawed caching mechanism that fails to validate the AWS Account ID during authentication. While the use of wildcards in a `bound_iam_principal_arn configuration` significantly increases the attack surface, **wildcards are not a prerequisite for exploitation**. The vulnerability can be exploited with specific ARN bindings if a role name collision occurs.

Successful exploitation can lead to unauthorized access to secrets, data exfiltration, and privilege escalation. Given that the only prerequisite is a duplicate role name, the severity is considered **high**.

### Patches
This vulnerability has been patched in version **0.1.1** of the `auth-aws` plugin.
Users are advised to upgrade to version **0.1.1** or later to remediate this vulnerability.

### Workarounds
For users who are unable to upgrade to version **0.1.1** immediately, the most effective workaround is to **guarantee that IAM role names are unique across all AWS accounts** that could potentially interact with your OpenBao environment. This is the most critical mitigation step.

**Primary Mitigation**: Audit your AWS organizations to identify and rename any duplicate IAM role names. Enforce a naming convention that includes account-specific identifiers to prevent future collisions.

While removing wildcards from your `bound_iam_principal_arn` configuration is still recommended as a security best practice, it **will not** mitigate this vulnerability if duplicate role names exist.

### Credits
This vulnerability was discovered and reported by [Pavlos Karakalidis](https://github.com/pkarakal/)
GitHub Security Advisory: GHSA-vw57-55f8-c73q
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: < 2.1.0
Patched in: 2.1.0

Summary: Mattermost Server allows XSS via CSRF

Details:
An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF.
GitHub Security Advisory: GHSA-rm24-25xm-9454
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.2.0
Patched in: 2.2.0

Summary: Mattermost Server: Files may be rendered inline instead of downloaded, allowing script execution

Details:
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window.
GitHub Security Advisory: GHSA-m78r-2x6w-qqjp
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.2.0
Patched in: 2.2.0

Summary: Mattermost Server is vulnerable to XSS through crafted links

Details:
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link.
GitHub Security Advisory: GHSA-5q37-9874-qxcw
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 2.2.0
Patched in: 2.2.0

Summary: Mattermost Server exposes information stored by a web browser

Details:
An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser.
GitHub Security Advisory: GHSA-g3f3-p9rc-775p
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 3.0.0
Patched in: 3.0.0

Summary: Mattermost Server exposes account details to any Team Administrator

Details:
An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details.
GitHub Security Advisory: GHSA-2j9c-76pp-xc5q
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 3.0.0
Patched in: 3.0.0

Summary:  Mattermost Server allows XSS via redirect URL

Details:
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL.
GitHub Security Advisory: GHSA-h3qg-w9j5-wh3m
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 3.1.0
Patched in: 3.1.0

Summary: Mattermost Server is vulnerable to XSS through lack of link relationship attributes `noreferrer` and `noopener`

Details:
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place.
GitHub Security Advisory: GHSA-9w4v-9c99-hv7r
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 3.0.0
Patched in: 3.0.0

Summary: Mattermost Server exposes sensitive information via its System Console UI

Details:
An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information (credential fields within config.json) via the System Console UI.
GitHub Security Advisory: GHSA-mj8v-773w-5qhj
Package: github.com/mattermost/mattermost-server (GO)
Severity: LOW (CVSS 2.7)
CWE: CWE-732: Incorrect Permission Assignment for Critical Resource
Vulnerable versions: < 3.0.0
Patched in: 3.0.0

Summary: Mattermost Server allows System Admin to modify LDAP account names and email addresses

Details:
An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of an LDAP account.
GitHub Security Advisory: GHSA-379p-37xc-q963
Package: github.com/mattermost/mattermost-server (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-295: Improper Certificate Validation, CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Vulnerable versions: < 3.0.0
Patched in: 3.0.0

Summary: Mattermost Server does not check if cookies are used over SSL

Details:
An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL.
GitHub Security Advisory: GHSA-q3g9-hgrx-hwhx
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 2.0.1-0[PII_REDACTED]0916-26ad6d2c7696
Patched in: 2.0.1-0[PII_REDACTED]0916-26ad6d2c7696

Summary: Mattermost Server exposes sensitive information about team URLs via an API

Details:
An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive information about team URLs via an API.
GitHub Security Advisory: GHSA-j26g-95ph-2mwv
Package: github.com/mattermost/mattermost-server (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-287: Improper Authentication
Vulnerable versions: < 3.0.0
Patched in: 3.0.0

Summary: Mattermost Server: Insufficient Password-Reset Link Invalidation

Details:
An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused.
GitHub Security Advisory: GHSA-9jrx-fgrm-96qh
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 3.0.0
Patched in: 3.0.0

Summary: Mattermost Server is vulnerable to XSS via a Legal or Support setting

Details:
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting.
GitHub Security Advisory: GHSA-43m6-wvc8-2m7j
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 6.5)
Vulnerable versions: < 3.0.2
Patched in: 3.0.2

Summary: Mattermost Server's Session ID and Session Token are potentially compromised

Details:
An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled.
GitHub Security Advisory: GHSA-rc54-2g2c-g36g
Package: github.com/openbao/openbao (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: < 0.0.0[PII_REDACTED]5510-cc2c476bac66
Patched in: 0.0.0[PII_REDACTED]5510-cc2c476bac66

Summary: OpenBao and Vault Leak []byte Fields in Audit Logs 

Details:
### Impact

OpenBao's audit log did not appropriately redact fields when relevant subsystems sent `[]byte` response parameters rather than `string`s. This includes, but is not limited to:

- `sys/raw` with use of `encoding=base64`, all data would be emitted unredacted to the audit log.
- Transit, when performing a signing operation with a derived Ed25519 key, would emit public keys to the audit log.

Third-party plugins may be affected.

This issue has been present since HashiCorp Vault and continues to impact Vault as of v1.20.4. 

### Patches

OpenBao v2.4.2 will patch this issue.

### Workarounds

If users do not use the above functionality, they are not impacted. To prohibit the use of `sys/raw` globally, ensure `raw_storage_endpoint=false` is set or missing from the server configuration.
GitHub Security Advisory: GHSA-h8qw-xqm9-q66j
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 3.1.0
Patched in: 3.1.0

Summary: Mattermost Server is vulnerable to XSS through customizable theme color-code values

Details:
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values.
GitHub Security Advisory: GHSA-qrf6-h5fc-7m96
Package: github.com/mattermost/mattermost-server (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-799: Improper Control of Interaction Frequency
Vulnerable versions: < 3.2.0
Patched in: 3.2.0

Summary: Mattermost Server does not enforce rate limits on password change attempts

Details:
An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change.
GitHub Security Advisory: GHSA-ghfh-fmx4-26h8
Package: github.com/openbao/openbao (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: >= 0.0.0[PII_REDACTED]5727-b1235e585db7, < 0.0.0[PII_REDACTED]5510-cc2c476bac66
Patched in: 0.0.0[PII_REDACTED]5510-cc2c476bac66

Summary: OpenBao leaks HTTPRawBody in Audit Logs

Details:
### Impact

OpenBao's audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted (HMAC'd).  This impacted the following subsystems:

 - When using the ACME functionality of PKI, this would result in short-lived ACME verification challenge codes being leaked in the audit logs.
 - When using the OIDC issuer functionality of the identity subsystem, auth and token response codes along with claims could be leaked in the audit logs.

Third-party plugins may be affected.

### Patches

OpenBao v2.4.2 will patch this issue.

### Workarounds

If users do not use the above functionality, they are not impacted. ACME verification codes are not usable after verification or challenge expiry so are of limited long-term use.
GitHub Security Advisory: GHSA-7vmw-6c7h-rrrv
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.3)
Vulnerable versions: < 3.2.0
Patched in: 3.2.0

Summary: Mattermost Server is vulnerable to Code Injection through its LDAP fields

Details:
An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection.
GitHub Security Advisory: GHSA-ffcc-qr2v-3qmv
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 3.2.0
Patched in: 3.2.0

Summary: Mattermost Server is vulnerable to Uncontrolled Resource Consumption

Details:
An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang.