Embed Notice

HTML Code

<blockquote style="position: relative; padding-left: 55px;"><section><a href="https://qoto.org/users/falken/statuses/111857182491184777">⊥ᵒᵚ Cᵸᵎᶺᵋᶫ∸ᵒᵘ ☑️ (falken@qoto.org)'s status on Friday, 02-Feb-2024 01:34:24 JST</a><a href="https://qoto.org/@falken" title="falken@qoto.org"><img src="https://gnusocial.jp/avatar/224397-48-20240414021528.webp" width="48" height="48" alt="⊥ᵒᵚ Cᵸᵎᶺᵋᶫ∸ᵒᵘ ☑️" style="position: absolute; left: 0; top: 0;">⊥ᵒᵚ Cᵸᵎᶺᵋᶫ∸ᵒᵘ ☑️</a><div><a href="https://qoto.org/@QOTO/111846895681383546" rel="in-reply-to">in reply to</a><ul><li></ul></div></section><article><p><a href="https://qoto.org/@QOTO">@QOTO</a> hopefully will also include fix for "pretend to be anyone" ? </p><p><a href="https://github.com/mastodon/mastodon/security/advisories/GHSA-3fjr-858r-92rw" rel="nofollow noreferrer">https://github.com/mastodon/mastodon/security/advisories/GHSA-3fjr-858r-92rw</a></p></article><footer><a rel="bookmark" href="https://gnusocial.jp/conversation/2664687#notice-5280442">In conversation</a><time datetime="2024-02-02T01:34:24+09:00" title="Friday, 02-Feb-2024 01:34:24 JST">Friday, 02-Feb-2024 01:34:24 JST</time> <span>from <span><a href="https://qoto.org/@falken/111857182491184777" rel="external" title="Sent from qoto.org via ActivityPub">qoto.org</a></span></span><a href="https://qoto.org/@falken/111857182491184777">permalink</a><h4>Attachments</h4><ol><li><article><header><div>Domain not in remote thumbnail source whitelist: opengraph.githubassets.com</div><h5><a href="https://github.com/mastodon/mastodon/security/advisories/GHSA-3fjr-858r-92rw">Remote user impersonation and takeover</a></h5><div></div></header><div>### SummaryDue to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account.Every Mastodon version prior to 3.5.17 is vulnerable, as well as...</div><footer></footer></article></li></ol></footer></blockquote>

Corresponding Notice

Embed this notice
⊥ᵒᵚ Cᵸᵎᶺᵋᶫ∸ᵒᵘ ☑️ (falken@qoto.org)'s status on Friday, 02-Feb-2024 01:34:24 JST⊥ᵒᵚ Cᵸᵎᶺᵋᶫ∸ᵒᵘ ☑️
in reply to
- QOTO Announcements & Polls
@QOTO hopefully will also include fix for "pretend to be anyone" ?
https://github.com/mastodon/mastodon/security/advisories/GHSA-3fjr-858r-92rw
In conversationFriday, 02-Feb-2024 01:34:24 JST from qoto.orgpermalink
Attachments
1. Domain not in remote thumbnail source whitelist: opengraph.githubassets.com
  Remote user impersonation and takeover
  ### Summary Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account. Every Mastodon version prior to 3.5.17 is vulnerable, as well as...

Public

Embed Notice

HTML Code

Corresponding Notice