CVE-2024-39830

Name of the Vulnerable Software and Affected Versions Mattermost versions 9.5.x through 9.5.5 Mattermost versions 9.6.x through 9.6.2 Mattermost versions 9.7.x through 9.7.4 Mattermost versions 9.8.x through 9.8.0

Description The issue arises when shared channels are enabled, and the software fails to use constant time comparison for remote cluster tokens. This allows an attacker to potentially retrieve the remote cluster token via a timing attack during remote cluster token comparison.

Recommendations For Mattermost versions 9.5.x through 9.5.5, update to a version that uses constant time comparison for remote cluster tokens. For Mattermost versions 9.6.x through 9.6.2, update to a version that uses constant time comparison for remote cluster tokens. For Mattermost versions 9.7.x through 9.7.4, update to a version that uses constant time comparison for remote cluster tokens. For Mattermost versions 9.8.x through 9.8.0, update to a version that uses constant time comparison for remote cluster tokens.