Conversation

Notices

1. Embed this notice
   buherator (buherator@infosec.place)'s status on Thursday, 17-Apr-2025 03:22:22 JST buherator
   Unauthenticated Remote Code Execution in Erlang/OTP SSH
   
   https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2
   
   Not much details and unfortunately I don't know much Erlang (yet), but this one seems pretty interesting!
   
   CVE-2025-32433
   • pistolero repeated this.
   • Embed this notice
     :blank: (i@declin.eu)'s status on Thursday, 17-Apr-2025 03:22:21 JST :blank:

     in reply to

     • 
     • pistolero
     @buherator @p @mint more fun dropped, not sure who has the old/sshocial frontends enabled
      and pistolero like this.
   • Embed this notice
      (mint@ryona.agency)'s status on Thursday, 17-Apr-2025 03:23:58 JST 

     in reply to

     • :blank:
     • pistolero
     @i @p @buherator Don't think I ever enabled it, I even had to disable Gopher since it calls timeline fetch directly with no ratelimiting, letting anyone with an F5 key DoS the instance.
     pistolero likes this.
   • Embed this notice
      (mint@ryona.agency)'s status on Thursday, 17-Apr-2025 03:24:54 JST 

     in reply to

     • 
     • :blank:
     • pistolero
     @i @buherator @p pede make a gopher interface for rebolter
     pistolero likes this.
   • Embed this notice
     pistolero (p@fsebugoutzone.org)'s status on Thursday, 17-Apr-2025 03:47:18 JST pistolero

     in reply to

     • 
     • :blank:
     @i @buherator @mint gat dammit
   • Embed this notice
     pistolero (p@fsebugoutzone.org)'s status on Thursday, 17-Apr-2025 03:50:16 JST pistolero

     in reply to

     • 
     • :blank:
     @mint @buherator @i All right, it's gonna be a weird day.
      likes this.
   • Embed this notice
     tsoifan1997 (sysrq@lab.nyanide.com)'s status on Thursday, 17-Apr-2025 05:04:04 JST tsoifan1997

     in reply to

     • 
     • :blank:
     • pistolero
     @p @i @buherator @mint pede implement RFC9421 properly please by tuesday #mutualaid
     pistolero likes this.
   • Embed this notice
     pistolero (p@fsebugoutzone.org)'s status on Thursday, 17-Apr-2025 05:08:29 JST pistolero

     in reply to

     • 
     • :blank:
     • tsoifan1997
     @sysrq @buherator @i @mint I had to run /lib/rfc/grabrfc because I didn't have that one.
     
     Am I implementing it improperly? I basically just copied what Mastodon was doing.
     
     I am going to shit a thing out related to thread.
   • Embed this notice
     tsoifan1997 (sysrq@lab.nyanide.com)'s status on Thursday, 17-Apr-2025 05:34:23 JST tsoifan1997

     in reply to

     • 
     • :blank:
     • pistolero
     @p @i @buherator @mint
     I dunno if you are or not I'm just still annoyed over a bug in Erlang that's been fixed for five months now that affects Pleroma.
     pistolero likes this.
   • Embed this notice
     pistolero (p@fsebugoutzone.org)'s status on Thursday, 17-Apr-2025 05:35:07 JST pistolero

     in reply to

     • 
     • :blank:
     • tsoifan1997
     @sysrq @buherator @i @mint
     
     > I'm just still annoyed over a bug in Erlang that's been fixed for five months now that affects Pleroma.
     
     Jill Sandwich.
   • Embed this notice
     tsoifan1997 (sysrq@lab.nyanide.com)'s status on Thursday, 17-Apr-2025 05:35:11 JST tsoifan1997

     in reply to

     • 
     • :blank:
     • tsoifan1997
     • pistolero
     @p @buherator @i @mint
     I don't intend to shut up over it. :facesofautism:
     pistolero likes this.
   • Embed this notice
     pistolero (p@fsebugoutzone.org)'s status on Thursday, 17-Apr-2025 05:36:12 JST pistolero

     in reply to

     • 
     • :blank:
     • tsoifan1997
     @sysrq @buherator @i @mint You say that like shutting up is the sensible strategy.
     gas_the_normies.png
   • Embed this notice
     :blank: (i@declin.eu)'s status on Thursday, 17-Apr-2025 05:37:53 JST :blank:

     in reply to

     • 
     • tsoifan1997
     • pistolero
     @sysrq @p @buherator @mint the rfc wasn't finished by the time mastodon did theirs, so people are forced to ignore the later 13 draft revisions of subtle differences
     pistolero likes this.
   • Embed this notice
     pistolero (p@fsebugoutzone.org)'s status on Thursday, 17-Apr-2025 06:41:02 JST pistolero

     in reply to

     • 
     • :blank:
     @i @mint @buherator The Github link had basically no useful information, but Fyodor never lets you down: https://seclists.org/oss-sec/2025/q2/52
   • Embed this notice
     Phantasm (phnt@fluffytail.org)'s status on Thursday, 17-Apr-2025 18:06:30 JST Phantasm

     in reply to

     • 
     • :blank:
     • pistolero
     @p @i @buherator @mint Was wondering why I saw 4 OTP releases yesterday in my Inbox. Now I know the answer.
     pistolero likes this.
   • Embed this notice
     pistolero (p@fsebugoutzone.org)'s status on Friday, 18-Apr-2025 05:16:50 JST pistolero

     in reply to

     • 
     • :blank:
     • Phantasm
     @phnt @buherator @i @mint :helpcomputer:
     Phantasm likes this.