Conversation

Notices

1. Embed this notice
   Ryan Baumann (ryanfb@digipres.club)'s status on Sunday, 24-Mar-2024 05:43:33 JST Ryan Baumann

   I don't know who needs to hear this but #TruthSocial, which is running a forked version of Mastodon, does not from the source code appear to have appropriate mitigations in place for CVE-2023-36460, which theoretically allows attackers to create and overwrite any file Mastodon has access to, allowing Denial of Service and arbitrary Remote Code Execution https://nvd.nist.gov/vuln/detail/CVE-2023-36460 (probably other CVE's as well, but some rely on federation which Truth Social doesn't use?) #infosec

   • Haelwenn /элвэн/ :triskell: likes this.
   • Embed this notice
     Tim Chambers (tchambers@indieweb.social)'s status on Sunday, 24-Mar-2024 08:50:40 JST Tim Chambers

     in reply to

     @ryanfb Oops.

   • Embed this notice
     Alex Gleason (alex@gleasonator.com)'s status on Wednesday, 27-Mar-2024 12:23:56 JST Alex Gleason

     in reply to

     • Ji Fu
     @Fu Fake News. You can't do path traversal on an s3 instance.
   • Embed this notice
     Ji Fu (fu@hostux.social)'s status on Wednesday, 27-Mar-2024 12:23:58 JST Ji Fu

     in reply to

     • Alex Gleason

     @alex can you clear up anything here?