Conversation

Notices

1. Embed this notice
   Chudbere (Clairebere) :duckjam: (chudbere@chudbuds.lol)'s status on Wednesday, 16-Nov-2022 00:00:21 JST Chudbere (Clairebere) :duckjam:

   • Alex Gleason
   Is this same vulnerability possible on pleroma or soapbox? @alex
   
   RT: https://infosec.exchange/users/jerry/statuses/109348246444608881
   • Embed this notice
     Alex Gleason (alex@gleasonator.com)'s status on Wednesday, 16-Nov-2022 00:00:20 JST Alex Gleason

     in reply to
     @chudbere If you're running Soapbox with an outdated GlitchSocial backend, almost certainly yes. In Pleroma/Reased, unconfirmed (we should probably remove HTML posting). I'm patching it in Soapbox shortly to be safe.
   • Embed this notice
     dia (dia@kurosawa.moe)'s status on Wednesday, 16-Nov-2022 03:41:26 JST dia

     in reply to

     • Alex Gleason
     looks like the patch was landed an hour ago: https://gitlab.com/soapbox-pub/soapbox/-/commit/b5393b531b26913dda36e3cf6d90df6df8959f5d
     Alex Gleason likes this.
   • Embed this notice
     Chudbere (Clairebere) :duckjam: (chudbere@chudbuds.lol)'s status on Wednesday, 16-Nov-2022 03:41:27 JST Chudbere (Clairebere) :duckjam:

     in reply to

     • Alex Gleason
     I have not run an update on Soapbox since our initial install in September, will you announce when the patch is ready? And is there a guide anywhere on how to pull an update once it is ready?
     Alex Gleason repeated this.