262

Mastodon security update: every version prior to today's is vulnerable to remote user impersonation and takeover (github.com)

submitted 11 months ago* (last edited 11 months ago) by otter@lemmy.ca to c/fediverse@lemmy.world

18 comments fedilink hide all child comments

If your instance is not up to date (see footer), you can pass this along to your admins to check

you are viewing a single comment's thread
view the rest of the comments

[-] jonne@infosec.pub 65 points 11 months ago

I wonder if the companies that forked mastodon (like truth social) will bother to update. I can see someone posting stuff as a former president with this flaw.

[-] shnizmuffin@lemmy.inbutts.lol 92 points 11 months ago

[-] roguetrick@kbin.social 25 points 11 months ago

Eh, stuff like truth social doesn't federate with anything anyway, so unfortunately this isn't a vulnerability for them.

[-] jonne@infosec.pub 10 points 11 months ago

Has it been confirmed this is a federation bug?

[-] skullgiver@popplesburger.hilciferous.nl 25 points 11 months ago

Has it been confirmed this is a federation bug?

Based on this commit, which fixes the vulnerability, the bug seems to lie within the ActivityPub receive logic, specifically validation of remote resources.