Public
- Public
- Network
- Groups
- Featured
- Popular
- People

Conversation

Notices

Embed this notice
Pawlicker (pawlicker@makai.chaotic.ninja)'s status on Friday, 02-Feb-2024 01:15:07 JST Pawlicker

PSA: update your mastodon install now
https://github.com/mastodon/mastodon/security/advisories/GHSA-3fjr-858r-92rw
In conversation about 10 months ago from makai.chaotic.ninja permalink
Attachments
1. Domain not in remote thumbnail source whitelist: opengraph.githubassets.com
  
  Remote user impersonation and takeover
  
  ### Summary Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account. Every Mastodon version prior to 3.5.17 is vulnerable, as well as...
- Embed this notice
  (mint@ryona.agency)'s status on Friday, 02-Feb-2024 01:15:06 JST
  in reply to
  - Alex Gleason
  @Pawlicker Either webfinger (more like webnigger) or faulty URI parser. I think @alex was complaining about the former a while ago.
  
  In conversation about 10 months ago permalink
- Embed this notice
  (mint@ryona.agency)'s status on Friday, 02-Feb-2024 01:16:59 JST
  in reply to
  - Alex Gleason
  @Pawlicker @alex Looks to be the latter.
  https://github.com/fedibird/mastodon/commit/0dae13c668ca5973fb8c4617faadf435c0564310
  In conversation about 10 months ago permalink
  Attachments
  1. Domain not in remote thumbnail source whitelist: opengraph.githubassets.com
    
    Merge pull request #18 from ClearlyClaire/security/fedibird-2024-02-01 · fedibird/mastodon@0dae13c
    
    Fix insufficient origin validation

Feeds