Embed Notice

HTML Code

<blockquote style="position: relative; padding-left: 55px;"><section><a href="https://fedibird.com/users/tesaguri/statuses/111946617740240812">tesaguri ?? (tesaguri@fedibird.com)'s status on Sunday, 18-Feb-2024 23:11:48 JST</a><a href="https://fedibird.com/@tesaguri" title="tesaguri@fedibird.com"><img src="https://gnusocial.jp/avatar/111132-48-20230405130115.webp" width="48" height="48" alt="tesaguri ??" style="position: absolute; left: 0; top: 0;">tesaguri ??</a></section><article><p>Lack of media type verification of Activity Streams objects allows impersonation of remote accounts · Advisory · mastodon/mastodon · GitHub<br><a href="https://github.com/mastodon/mastodon/security/advisories/GHSA-jhrq-qvrm-qr36" rel="nofollow noreferrer">https://github.com/mastodon/mastodon/security/advisories/GHSA-jhrq-qvrm-qr36</a><br>これを報告するなどしていた</p></article><footer><a rel="bookmark" href="https://gnusocial.jp/conversation/2732290#notice-5419527">In conversation</a><time datetime="2024-02-18T23:11:48+09:00" title="Sunday, 18-Feb-2024 23:11:48 JST">about 9 months ago</time> <span>from <span><a href="https://fedibird.com/@tesaguri/111946617740240812" rel="external" title="Sent from fedibird.com via ActivityPub">fedibird.com</a></span></span><a href="https://fedibird.com/@tesaguri/111946617740240812">permalink</a><h4>Attachments</h4><ol><li><article><header><div>Domain not in remote thumbnail source whitelist: opengraph.githubassets.com</div><h5><a href="https://github.com/mastodon/mastodon/security/advisories/GHSA-jhrq-qvrm-qr36">Lack of media type verification of Activity Streams objects allows impersonation of remote accounts</a></h5><div></div></header><div>### SummaryWhen fetching remote statuses, Mastodon doesn't check that the response from the remote server has a `Content-Type` header value of the Activity Streams media type, which allows a th...</div><footer></footer></article></li></ol></footer></blockquote>

Corresponding Notice

Embed this notice
tesaguri ?? (tesaguri@fedibird.com)'s status on Sunday, 18-Feb-2024 23:11:48 JST tesaguri ??
Lack of media type verification of Activity Streams objects allows impersonation of remote accounts · Advisory · mastodon/mastodon · GitHub
https://github.com/mastodon/mastodon/security/advisories/GHSA-jhrq-qvrm-qr36
これを報告するなどしていた
In conversationabout 9 months ago from fedibird.compermalink
Attachments
1. Domain not in remote thumbnail source whitelist: opengraph.githubassets.com
  Lack of media type verification of Activity Streams objects allows impersonation of remote accounts
  ### Summary When fetching remote statuses, Mastodon doesn't check that the response from the remote server has a `Content-Type` header value of the Activity Streams media type, which allows a th...

Public

Embed Notice

HTML Code

Corresponding Notice