[<prev] [next>] [day] [month] [year] [list]
Message-ID: <gls7xbf5iixk7edjmkojbhc7zjxebrzczvoqce6ljjn4lwalie@mavmx3pl4fto>
Date: Fri, 2 Feb 2024 14:10:05 +0200
From: Valtteri Vuorikoski <vuori@...com.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2024-23832: Mastodon: Remote user impersonation and takeover
The Mastodon project [1] has published a Github advisory for a
high-severity issue which allows user impersonation and account
takeover with the identifier CVE-2024-23832. The team's Fediverse
postings indicate that everyone should urgently update their
instances. CVSS 3.1 is given as 9.4/10.
The advisory at
<https://github.com/mastodon/mastodon/security/advisories/GHSA-3fjr-858r-92rw>
states:
Due to insufficient origin validation in all Mastodon, attackers can
impersonate and take over any remote account.
Every Mastodon version prior to 3.5.17 is vulnerable, as well as 4.0.x
versions prior to 4.0.13, 4.1.x version prior to 4.1.13, and 4.2.x
versions prior to 4.2.5.
Details are not currently posted, but an update on Feb 15 is
promised. Commit
<https://github.com/mastodon/mastodon/commit/a6641f828b9e6f5806be01754318279c2532ae82>
appears to be the fix.
-Valtteri
[1] "Mastodon is a free, open-source social network server based on
ActivityPub where users can follow friends and discover new ones."
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
