CVE-2017-18917: Mattermost Server uses weak hashing for OAuth, email verification tokens and invitations
(updated )
An issue was discovered in Mattermost Server before 3.8.2 and 3.7.5. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification tokens.
References
- github.com/advisories/GHSA-jxc4-w54c-qv5r
- github.com/mattermost/mattermost
- github.com/mattermost/mattermost/commit/247cd1e51a8c943628dc650e87e794b06aad4c2b
- github.com/mattermost/mattermost/commit/b74e85653660525d351d090a1e1874ae933bcbc8
- mattermost.com/security-updates
- nvd.nist.gov/vuln/detail/CVE-2017-18917
Code Behaviors & Features
Detect and mitigate CVE-2017-18917 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →