Mastodon security update: every version prior to today's is vulnerable to remote user impersonation and takeover

Arthur Besse@lemmy.ml to Fediverse@lemmy.ml – 187 points –
Remote user impersonation and takeover
github.com
15

You are viewing a single comment

Could you explain what you're saying in common language?

The lack of details in the advisory is only a minor impediment for a malicious person who wants to figure out how to implement their own exploit for this vulnerability. Anyone can read the patch that fixes it and figure it out.

TLDR: if you run your own instance, update it ASAP. If an instance you rely on hasn't updated yet, consider asking its admins to do so. And if they don't update it soon, you might want to reconsider your choice of instance.

And if they don't update it soon, you might want to reconsider your choice of instance.

The advisory went up about 4h ago. About 3h ago, my instance admin sent out an announcement that the patch had been applied. That was before I even heard about the issue.

Nice work :)

1 more...
1 more...