Public
- Public
- Network
- Groups
- Featured
- Popular
- People

Conversation

Notices

Embed this notice
tesaguri ?? (tesaguri@fedibird.com)'s status on Sunday, 18-Feb-2024 23:11:48 JST tesaguri ??

Lack of media type verification of Activity Streams objects allows impersonation of remote accounts · Advisory · mastodon/mastodon · GitHub
https://github.com/mastodon/mastodon/security/advisories/GHSA-jhrq-qvrm-qr36
これを報告するなどしていた
In conversation about 9 months ago from fedibird.com permalink
Attachments
1. Domain not in remote thumbnail source whitelist: opengraph.githubassets.com
  
  Lack of media type verification of Activity Streams objects allows impersonation of remote accounts
  
  ### Summary When fetching remote statuses, Mastodon doesn't check that the response from the remote server has a `Content-Type` header value of the Activity Streams media type, which allows a th...

Feeds