Conversation

Notices

1. Embed this notice
   lainy (lain@lain.com)'s status on Saturday, 27-May-2023 03:26:58 JST lainy
   Alright, we found a second exploit that is much worse than the first one I found, it involves a bug in our oembed parser. A new release is being prepared right now. Unless there's a third exploit, this can be mitigated by disabling rich media in the pleroma settings. Frontends other than pleroma-fe might also be not vulnerable.
   
   What alex is recommending here will also fix the issue, so you can do that as well:
   
   https://gleasonator.com/notice/AW3PsTi4WCWEUbN0uO
   • Embed this notice
     lainy (lain@lain.com)'s status on Saturday, 27-May-2023 03:39:08 JST lainy

     in reply to

     • anime graf mays ?️?
     @graf sorry you had to experience first before we found it, at least it should be fixed in the future.
   • Embed this notice
     anime graf mays ?️? (graf@poa.st)'s status on Saturday, 27-May-2023 03:39:09 JST anime graf mays ?️?

     in reply to
     @lain thank you for being vigilant about these fixes
   • Embed this notice
     FediJoshJ (fedijoshj@sneed.vip)'s status on Saturday, 27-May-2023 04:41:18 JST FediJoshJ

     in reply to
     @lain Which menu is that under? I don't spend much time in the Admin page.
   • Embed this notice
     FediJoshJ (fedijoshj@sneed.vip)'s status on Saturday, 27-May-2023 04:41:18 JST FediJoshJ

     in reply to

     • FediJoshJ
     @lain NVM, found it under metadata
     lainy likes this.
   • Embed this notice
     lainy (lain@lain.com)'s status on Saturday, 27-May-2023 06:50:12 JST lainy

     in reply to

     • pistolero :thispersondoesnotexist:
     @p yes, as far as i know
   • Embed this notice
     pistolero :thispersondoesnotexist: (p@freespeechextremist.com)'s status on Saturday, 27-May-2023 06:50:13 JST pistolero :thispersondoesnotexist:

     in reply to
     @lain Twitter Cards were a mistake. (Thank you for your hard work, pic related.)
     
     No media proxy and no "rich media" and CSP set to "none" should fix the issue entirely, right?
     letsalllovelain.gif
     lainy likes this.
   • Embed this notice
     pistolero :thispersondoesnotexist: (p@freespeechextremist.com)'s status on Saturday, 27-May-2023 07:51:04 JST pistolero :thispersondoesnotexist:

     in reply to
     @lain :bigbosssalute: Thanks, boss.
     
     Now if someone finds a vuln in EmojiReaction, I'm all set for maximum smugness forever.
     lainy likes this.
   • Embed this notice
     Lelouche ? (lelouchebag@shitposter.club)'s status on Saturday, 27-May-2023 07:52:35 JST Lelouche ?

     in reply to
     @lain Mr. President, a second bug has hit the fediverse
     lainy likes this.