by @LeSuisse Activity log
- Created automatic suggestion
-
@LeSuisse
removed
11 packages
- mastodon-bot
- bitlbee-mastodon
- mastodon-archive
- nodePackages.mastodon-bot
- python312Packages.mastodon-py
- python313Packages.mastodon-py
- python314Packages.mastodon-py
- nodePackages_latest.mastodon-bot
- home-assistant-component-tests.mastodon
- tests.home-assistant-component-tests.mastodon
- wordpressPackages.plugins.simple-mastodon-verification
-
@LeSuisse
removed
9 maintainers
- @ju1m
- @erictapen
- @ghuntley
- @dotlambda
- @fabaff
- @jpotier
- @mweinelt
- @Izorkin
- @happy-river
- @LeSuisse accepted
- @LeSuisse published on GitHub
Mastodon's signature-dependent ActivityPub collection responses cached under signature-independent keys (Web Cache Poisoning via `Rails.cache`)
Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.3.19, 4.4.13, 4.5.6, Mastodon is vulnerable to web cache poisoning via `Rails.cache. When AUTHORIZED_FETCH is enabled, the ActivityPub endpoints for pinned posts and featured hashtags have contents that depend on the account that signed the HTTP request. However, these contents are stored in an internal cache and reused with no regards to the signing actor. As a result, an empty response generated for a blocked user account may be served to requests from legitimate non-blocked actors, or conversely, content intended for non-blocked actors may be returned to blocked actors. This issue has been patched in versions 4.3.19, 4.4.13, 4.5.6.
Affected products
- ==< 4.5.6
- ==< 4.3.19
- ==< 4.4.13
Matching in nixpkgs
Ignored packages (11)
pkgs.mastodon-bot
Bot to publish twitter, tumblr or rss posts to an mastodon account.
pkgs.bitlbee-mastodon
Bitlbee plugin for Mastodon
pkgs.mastodon-archive
Utility for backing up your Mastodon content
pkgs.nodePackages.mastodon-bot
Bot to publish twitter, tumblr or rss posts to an mastodon account.
pkgs.python312Packages.mastodon-py
Python wrapper for the Mastodon API
pkgs.python313Packages.mastodon-py
Python wrapper for the Mastodon API
pkgs.python314Packages.mastodon-py
Python wrapper for the Mastodon API
pkgs.nodePackages_latest.mastodon-bot
Bot to publish twitter, tumblr or rss posts to an mastodon account.
pkgs.home-assistant-component-tests.mastodon
Open source home automation that puts local control and privacy first
pkgs.tests.home-assistant-component-tests.mastodon
Open source home automation that puts local control and privacy first
Package maintainers
Ignored maintainers (9)
-
@ju1m Julien Moutinho <julm+nixpkgs@sourcephile.fr>
-
@erictapen Kerstin Humm <kerstin@erictapen.name>
-
@ghuntley Geoffrey Huntley <ghuntley@ghuntley.com>
-
@dotlambda Robert Schütz <rschuetz17@gmail.com>
-
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
-
@jpotier Martin Potier <jpo.contributes.to.nixos@marvid.fr>
-
@mweinelt Martin Weinelt <hexa@darmstadt.ccc.de>
-
@Izorkin Yurii Izorkin <Izorkin@gmail.com>
-
@happy-river Happy River <happyriver93@runbox.com>