mattermost security release

Mattermost security updates 9.2.4 / 9.1.5 / 8.1.8 (ESR) released

We’re informing you about a Mattermost security update, which addresses low- to medium-level severity vulnerabilities. We highly recommend that you apply the update.

The security update is available for Mattermost dot releases 9.2.4, 9.1.5, and 8.1.8 (Extended Support Release) for both Team Edition and Enterprise Edition. They are available for download here.

Customer safety and data security are the utmost priorities for Mattermost. For our customers’ protection, and as outlined in our Responsible Disclosure policy, Mattermost does not disclose specifics on this vulnerability until 30 days after this announcement. After 30 days, we will publish specific details on the vulnerability on our Security Updates webpage.

9.2.4 and 9.1.5 versions also include the following fixes:

  • Fixed an issue where invalid reactions could be added to posts. Added default limit of the number of reactions per post.

8.1.8 version also includes the following fixes:

  • Fixed an issue with double URL encoding of OAuth redirect URI params.
  • Pre-packaged Jira plugin version v4.0.1. Also see v4.0.0 for recent breaking changes.
  • Fixed an issue where invalid reactions could be added to posts. Added default limit of the number of reactions per post.

You can follow the standard upgrade instructions to apply the updates.

mm

Amy Blais is the Release Manager at Mattermost, Inc. Her other roles include Community and Customer Support. She previously served as the company’s Associate Marketing Manager.