Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/vulndb: potential Go vuln in github.com/mattermost/mattermost-server/v6: GHSA-7ggc-5r84-xf54 #540

Closed
julieqiu opened this issue Aug 1, 2022 · 3 comments
Closed

x/vulndb: potential Go vuln in github.com/mattermost/mattermost-server/v6: GHSA-7ggc-5r84-xf54 #540

julieqiu opened this issue Aug 1, 2022 · 3 comments
Assignees
@rolandshoemaker
Labels
excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module.

Comments

@julieqiu
Copy link
Member

julieqiu commented Aug 1, 2022

In GitHub Security Advisory GHSA-7ggc-5r84-xf54, there is a vulnerability in the following Go packages or modules:

Unit Fixed Vulnerable Ranges
github.com/mattermost/mattermost-server/v6 6.7.1 = 6.7.0

See doc/triage.md for instructions on how to triage this report.

packages:
  - package: github.com/mattermost/mattermost-server/v6
    versions:
      - introduced: TODO (earliest fixed "6.7.1", vuln range "= 6.7.0")
  - package: github.com/mattermost/mattermost-server/v6
    versions:
      - introduced: 6.6.0
        fixed: 6.6.2
  - package: github.com/mattermost/mattermost-server/v6
    versions:
      - introduced: 6.4.0
        fixed: 6.5.2
  - package: github.com/mattermost/mattermost-server/v6
    versions:
      - fixed: 6.3.9
description: Unrestricted information disclosure of all users in Mattermost version
    6.7.0 and earlier allows team members to access some sensitive information by
    directly accessing the APIs.
published: 2022-07-15T00:00:16Z
last_modified: 2022-07-21T22:35:35Z
cves:
  - CVE-2022-2401
ghsas:
  - GHSA-7ggc-5r84-xf54
links:
    context:
      - https://github.com/advisories/GHSA-7ggc-5r84-xf54
@rolandshoemaker
Copy link
Member

Vuln in tool.

@neild neild added excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module. and removed NotGoVuln NeedsTriage labels Aug 10, 2022
This was referenced Apr 7, 2023
Closed
Closed
@GoVulnBot GoVulnBot mentioned this issue Apr 15, 2023
Closed
@GoVulnBot GoVulnBot mentioned this issue May 12, 2023
Closed
@GoVulnBot GoVulnBot mentioned this issue Jun 28, 2023
Closed
This was referenced Aug 11, 2023
Closed
Closed
Closed
Closed
This was referenced Sep 30, 2023
Closed
Closed
Closed
Closed
Closed
This was referenced Nov 28, 2023
Closed
Closed
Closed
Closed
Closed
Closed
gopherbot pushed a commit that referenced this issue Aug 21, 2024
@tatianab @gopherbot
data/reports: unexclude 20 reports (18)
2c69a3a 
  - data/reports/GO-2022-0507.yaml
  - data/reports/GO-2022-0508.yaml
  - data/reports/GO-2022-0509.yaml
  - data/reports/GO-2022-0510.yaml
  - data/reports/GO-2022-0511.yaml
  - data/reports/GO-2022-0512.yaml
  - data/reports/GO-2022-0516.yaml
  - data/reports/GO-2022-0517.yaml
  - data/reports/GO-2022-0518.yaml
  - data/reports/GO-2022-0540.yaml
  - data/reports/GO-2022-0547.yaml
  - data/reports/GO-2022-0550.yaml
  - data/reports/GO-2022-0554.yaml
  - data/reports/GO-2022-0556.yaml
  - data/reports/GO-2022-0559.yaml
  - data/reports/GO-2022-0560.yaml
  - data/reports/GO-2022-0561.yaml
  - data/reports/GO-2022-0562.yaml
  - data/reports/GO-2022-0566.yaml
  - data/reports/GO-2022-0570.yaml

Updates #507
Updates #508
Updates #509
Updates #510
Updates #511
Updates #512
Updates #516
Updates #517
Updates #518
Updates #540
Updates #547
Updates #550
Updates #554
Updates #556
Updates #559
Updates #560
Updates #561
Updates #562
Updates #566
Updates #570

Change-Id: I3197ea86e01d2ed4ae9e7f17dbd7a3e495c903e4
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/607220
Reviewed-by: Damien Neil <dneil@google.com>
Auto-Submit: Tatiana Bradley <tatianabradley@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
This was referenced Aug 22, 2024
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
@GoVulnBot GoVulnBot mentioned this issue Sep 27, 2024
Closed
This was referenced Oct 28, 2024
Closed
Closed
Closed
Closed
Closed
This was referenced Dec 13, 2024
Closed
Closed
Closed
Closed
This was referenced Jan 9, 2025
Closed
Closed
Closed
Closed
Closed
Closed
@GoVulnBot GoVulnBot mentioned this issue Jan 17, 2025
Closed
This was referenced Feb 24, 2025
Open
Open
Open
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@rolandshoemaker rolandshoemaker

Labels
excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@neild @rolandshoemaker @julieqiu @gopherbot