mirror of
https://github.com/hanzoai/team.git
synced 2026-09-30 01:57:35 +00:00
bc56925599
* feat(docs): move docs-experimental content into monorepo docs/ * Remove plan related files and comments * Cleanup comments, remove generated files --------- Co-authored-by: Hanzo Dev <[email protected]>
52 lines
1.9 KiB
Plaintext
52 lines
1.9 KiB
Plaintext
---
|
|
title: "Dependency Vulnerability Analysis"
|
|
---
|
|
This document provides context on why certain third-party dependencies in Mattermost, although flagged as vulnerable by security scanners, do not pose a risk in Mattermost deployments.
|
|
|
|
This analysis is regularly updated as new vulnerability reports are received and evaluated.
|
|
|
|
## Overview
|
|
|
|
Mattermost regularly scans its dependencies for known vulnerabilities. Some dependencies may be flagged as vulnerable by security scanners, but these vulnerabilities might not be applicable to Mattermost due to:
|
|
|
|
- How the dependency is used in Mattermost
|
|
- The specific version or configuration implemented
|
|
- Mitigations already in place
|
|
- False positives in the scanning process
|
|
|
|
## Dependency Analysis Table
|
|
|
|
Below is a list of dependencies flagged as vulnerable by security scanners for our latest release, along with the justification for why each issue is not relevant to Mattermost deployments:
|
|
|
|
<table>
|
|
<colgroup>
|
|
<col style={{width: '25%'}} />
|
|
<col style={{width: '25%'}} />
|
|
<col style={{width: '50%'}} />
|
|
</colgroup>
|
|
<thead>
|
|
<tr>
|
|
<th>Dependency / Version</th>
|
|
<th>Vulnerability</th>
|
|
<th>False Positive Justification</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td>github.com/mattermost/ mattermost/server/v8</td>
|
|
<td>Multiple CVE IDs</td>
|
|
<td>Mattermost uses Go module workspaces, which override go.mod dependency versions with local filesystem code at build time. The vulnerable versions are never included in final Docker images.</td>
|
|
</tr>
|
|
<tr>
|
|
<td>golang.org/x/crypto v0.44.0</td>
|
|
<td>GHSA-f6x5-jh6r-wrfv CVE-2025-47914</td>
|
|
<td>Mattermost doesn't utilize the vulnerable golang.org/x/crypto/ssh package. Upgrade is planned for v11.4</td>
|
|
</tr>
|
|
<tr>
|
|
<td>golang.org/x/crypto v0.44.0</td>
|
|
<td>GGHSA-j5w8-q4qc-rx2x CVE-2025-58181</td>
|
|
<td>Mattermost doesn't utilize the vulnerable golang.org/x/crypto/ssh package. Upgrade is planned for v11.4</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|