Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 2 Feb 2024 14:10:05 +0200
From: Valtteri Vuorikoski <>
Subject: CVE-2024-23832: Mastodon: Remote user impersonation and takeover

The Mastodon project [1] has published a Github advisory for a
high-severity issue which allows user impersonation and account
takeover with the identifier CVE-2024-23832. The team's Fediverse
postings indicate that everyone should urgently update their
instances. CVSS 3.1 is given as 9.4/10.

The advisory at

  Due to insufficient origin validation in all Mastodon, attackers can
  impersonate and take over any remote account.

  Every Mastodon version prior to 3.5.17 is vulnerable, as well as 4.0.x
  versions prior to 4.0.13, 4.1.x version prior to 4.1.13, and 4.2.x
  versions prior to 4.2.5.

Details are not currently posted, but an update on Feb 15 is
promised. Commit
appears to be the fix.


[1] "Mastodon is a free, open-source social network server based on
ActivityPub where users can follow friends and discover new ones."

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.