Embed Notice

HTML Code

<blockquote style="position: relative; padding-left: 55px;"><section><a href="https://mastodon.tokyo/users/h12o/statuses/111930747864598041">h12o (h12o@mastodon.tokyo)'s status on Thursday, 15-Feb-2024 10:35:43 JST</a><a href="https://mastodon.tokyo/@h12o" title="h12o@mastodon.tokyo"><img src="https://gnusocial.jp/avatar/32785-48-20231107021648.webp" width="48" height="48" alt="h12o" style="position: absolute; left: 0; top: 0;">h12o</a></section><article><p><a href="https://mastodon.tokyo/tags/Mastodon" rel="tag">#Mastodon</a>  が依存するRailsパッケージのひとつ、sidekiq-unique-jobsのXSS sidekiq-unique-jobs UI server vulnerability（ GHSA-cmh9-rx85-xj38 , CVE-2024-25122）等の対応でMastodon v4.2.6・v4.1.14・v4.0.14・v3.5.18がリリースされています。</p><p>今回は攻撃概念実証（PoC）も出ているので攻撃はすぐにでも始められてしまうため、急ぎアップデートが求められます。</p><p>- v4.2.6 <a href="https://github.com/mastodon/mastodon/releases/tag/v4.2.6" rel="nofollow noreferrer">https://github.com/mastodon/mastodon/releases/tag/v4.2.6</a></p></article><footer><a rel="bookmark" href="https://gnusocial.jp/conversation/2717415#notice-5391296">In conversation</a><time datetime="2024-02-15T10:35:43+09:00" title="Thursday, 15-Feb-2024 10:35:43 JST">about a year ago</time> <span>from <span><a href="https://mastodon.tokyo/@h12o/111930747864598041" rel="external" title="Sent from mastodon.tokyo via ActivityPub">mastodon.tokyo</a></span></span><a href="https://mastodon.tokyo/@h12o/111930747864598041">permalink</a><h4>Attachments</h4><ol><li><article><header><div>Domain not in remote thumbnail source whitelist: opengraph.githubassets.com</div><h5><a href="https://github.com/mastodon/mastodon/releases/tag/v4.2.6">Release v4.2.6 · mastodon/mastodon</a></h5><div></div></header><div>⚠️ This release is an important security release fixing several security issue.
Corresponding security releases are available for the 4.1.x branch, the 4.0.x branch and the 3.5.x branch.If you a...</div><footer></footer></article></li></ol></footer></blockquote>

Corresponding Notice

Embed this notice
h12o (h12o@mastodon.tokyo)'s status on Thursday, 15-Feb-2024 10:35:43 JST h12o
#Mastodon が依存するRailsパッケージのひとつ、sidekiq-unique-jobsのXSS sidekiq-unique-jobs UI server vulnerability（ GHSA-cmh9-rx85-xj38 , CVE-2024-25122）等の対応でMastodon v4.2.6・v4.1.14・v4.0.14・v3.5.18がリリースされています。
今回は攻撃概念実証（PoC）も出ているので攻撃はすぐにでも始められてしまうため、急ぎアップデートが求められます。
- v4.2.6 https://github.com/mastodon/mastodon/releases/tag/v4.2.6
In conversationabout a year ago from mastodon.tokyopermalink
Attachments
1. Domain not in remote thumbnail source whitelist: opengraph.githubassets.com
  Release v4.2.6 · mastodon/mastodon
  ⚠️ This release is an important security release fixing several security issue. Corresponding security releases are available for the 4.1.x branch, the 4.0.x branch and the 3.5.x branch. If you a...

Public

Embed Notice

HTML Code

Corresponding Notice