GNU social JP
  • FAQ
  • Login
GNU social JPは日本のGNU socialサーバーです。
Usage/ToS/admin/test/Pleroma FE

  • Public

    • Public
    • Network
    • Groups
    • Featured
    • Popular
    • People

Conversation

Notices

  1. Embed this notice
    🔔 Update Notifications (update_notifications@mastodon.social)'s status on Friday, 05-Jul-2024 03:35:14 JST 🔔 Update Notifications 🔔 Update Notifications

    🚨 Mastodon security patch released

    The :mastodon: Mastodon team has released new versions that fix several security issues.
    It is strongly recommended that admins upgrade to the latest version of their branch ASAP.
    Servers running nightly should upgrade to nightly.2024-07-05-security.

    See the changelog for more info:
    4.2.10 https://github.com/mastodon/mastodon/releases/tag/v4.2.10
    4.1.18 https://github.com/mastodon/mastodon/releases/tag/v4.1.18

    Advisories:
    🟠️ https://github.com/mastodon/mastodon/security/advisories/GHSA-xjvf-fm67-4qc3
    🟡️ https://github.com/mastodon/mastodon/security/advisories/GHSA-58x8-3qxw-6hm7
    ⚪ https://github.com/mastodon/mastodon/security/advisories/GHSA-vp5r-5pgw-jwqx

    #MastoAdmin

    In conversation about 5 months ago from mastodon.social permalink

    Attachments

    1. Domain not in remote thumbnail source whitelist: opengraph.githubassets.com
      Release v4.2.10 · mastodon/mastodon
      WarningThis release is an important security release fixing a major security issue. A corresponding security release is available for the 4.1.x branch. NoteIf you are using nightly builds, do not ...

    3. Domain not in remote thumbnail source whitelist: opengraph.githubassets.com
      Improper authorship check on audience extension for existing posts
      ### Summary By crafting specific activities, an attacker can extend the audience of a post they do not own to other Mastodon users on a target server, thus gaining access to the contents of a po...
    4. Domain not in remote thumbnail source whitelist: opengraph.githubassets.com
      Insufficient permission checking on multiple API endpoints
      ### Summary Various API controllers that were conditionally checking existence of an authentication token were failing to check they were owned by an actual user, allowing access to certain reso...
    5. Domain not in remote thumbnail source whitelist: opengraph.githubassets.com
      Streaming continues to send events for a user after access token is revoked
      ### Summary After a user revokes an application’s access token, the application can still receive the user’s private mentions, notifications, etc via existing connection(s) to the streaming API. ...

    Feeds

    • Activity Streams
    • RSS 2.0
    • Atom
    • Help
    • About
    • FAQ
    • TOS
    • Privacy
    • Source
    • Version
    • Contact

    GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.

    Creative Commons Attribution 3.0 All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.