Embed Notice

HTML Code

<blockquote style="position: relative; padding-left: 55px;"><section><a href="https://oc.todon.fr/users/val/statuses/111039545124224678">val (val@oc.todon.fr)'s status on Sunday, 10-Sep-2023 18:09:48 JST</a><a href="https://oc.todon.fr/@val" title="val@oc.todon.fr"><img src="https://gnusocial.jp/avatar/23378-48-20230910090948.webp" width="48" height="48" alt="val" style="position: absolute; left: 0; top: 0;">val</a><div><ul><li><li><a href="https://gnusocial.jp/user/169701" title="thomas@mastodon.lemarchand.io">Thomas Lemarchand</a></li></ul></div></section><article><p><a href="https://microblog.shivering-isles.com/@sheogorath">@sheogorath</a> <a href="https://mastodon.lemarchand.io/@thomas">@thomas</a> <a href="https://intahnet.co.uk/@mhamzahkhan">@mhamzahkhan</a> By default, Mastodon *executes* code from the *runtime-writeable* tmp/ dir in its source code.<br>They know it can potentially be exploited for RCE (and it was, in  CVE-2023-36460), but chose not to fix it by default: <a href="https://github.com/mastodon/mastodon/issues/4625#issuecomment-431602474" rel="nofollow noreferrer">https://github.com/mastodon/mastodon/issues/4625#issuecomment-431602474</a></p></article><footer><a rel="bookmark" href="https://gnusocial.jp/conversation/2043913#notice-4010434">In conversation</a><time datetime="2023-09-10T18:09:48+09:00" title="Sunday, 10-Sep-2023 18:09:48 JST">about a year ago</time> <span>from <span><a href="https://oc.todon.fr/@val/111039545124224678" rel="external" title="Sent from oc.todon.fr via ActivityPub">oc.todon.fr</a></span></span><a href="https://oc.todon.fr/@val/111039545124224678">permalink</a><h4>Attachments</h4><ol><li><article><header><div>Domain not in remote thumbnail source whitelist: opengraph.githubassets.com</div><h5><a href="https://github.com/mastodon/mastodon/issues/4625#issuecomment-431602474">Mastodon requires write access to tmp/ after a system update · Issue #4625 · mastodon/mastodon</a></h5><div></div></header><div>Hi, I recently restarted my server to apply a kernel upgrade. This was not a Mastodon update. After the restart, mastodon-web crashes with the following error: [1386] ! Unable to load application: ...</div><footer></footer></article></li></ol></footer></blockquote>

Corresponding Notice

Embed this notice
val (val@oc.todon.fr)'s status on Sunday, 10-Sep-2023 18:09:48 JSTval
- M. Hamzah Khan
- Thomas Lemarchand
@sheogorath @thomas @mhamzahkhan By default, Mastodon *executes* code from the *runtime-writeable* tmp/ dir in its source code.
They know it can potentially be exploited for RCE (and it was, in CVE-2023-36460), but chose not to fix it by default: https://github.com/mastodon/mastodon/issues/4625#issuecomment-431602474
In conversationabout a year ago from oc.todon.frpermalink
Attachments
1. Domain not in remote thumbnail source whitelist: opengraph.githubassets.com
  Mastodon requires write access to tmp/ after a system update · Issue #4625 · mastodon/mastodon
  Hi, I recently restarted my server to apply a kernel upgrade. This was not a Mastodon update. After the restart, mastodon-web crashes with the following error: [1386] ! Unable to load application: ...

Public

Embed Notice

HTML Code

Corresponding Notice