Nixpkgs security tracker
6.5 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): Low (L)
- Integrity (I): None (N)
- Availability (A): Low (L)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): Low (L)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): Low (L)
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
11 packages
- mastodon-bot
- bitlbee-mastodon
- mastodon-archive
- nodePackages.mastodon-bot
- python312Packages.mastodon-py
- python313Packages.mastodon-py
- python314Packages.mastodon-py
- nodePackages_latest.mastodon-bot
- home-assistant-component-tests.mastodon
- tests.home-assistant-component-tests.mastodon
- wordpressPackages.plugins.simple-mastodon-verification
-
@LeSuisse
deleted
maintainer.delete
9 maintainers
- @ju1m
- @erictapen
- @ghuntley
- @dotlambda
- @fabaff
- @jpotier
- @mweinelt
- @Izorkin
- @happy-river
- @LeSuisse accepted
- @LeSuisse published on GitHub
Mastodon's signature-dependent ActivityPub collection responses cached under signature-independent keys (Web Cache Poisoning via `Rails.cache`)
Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.3.19, 4.4.13, 4.5.6, Mastodon is vulnerable to web cache poisoning via `Rails.cache. When AUTHORIZED_FETCH is enabled, the ActivityPub endpoints for pinned posts and featured hashtags have contents that depend on the account that signed the HTTP request. However, these contents are stored in an internal cache and reused with no regards to the signing actor. As a result, an empty response generated for a blocked user account may be served to requests from legitimate non-blocked actors, or conversely, content intended for non-blocked actors may be returned to blocked actors. This issue has been patched in versions 4.3.19, 4.4.13, 4.5.6.
References
-
https://github.com/mastodon/mastodon/security/advisories/GHSA-ccpr-m53r-mfwr x_refsource_CONFIRM
Affected products
- ==< 4.3.19
- ==< 4.4.13
- ==< 4.5.6
Matching in nixpkgs
Ignored packages (11)
pkgs.mastodon-bot
Bot to publish twitter, tumblr or rss posts to an mastodon account.
pkgs.bitlbee-mastodon
Bitlbee plugin for Mastodon
pkgs.mastodon-archive
Utility for backing up your Mastodon content
pkgs.nodePackages.mastodon-bot
Bot to publish twitter, tumblr or rss posts to an mastodon account.
pkgs.python312Packages.mastodon-py
Python wrapper for the Mastodon API
pkgs.python313Packages.mastodon-py
Python wrapper for the Mastodon API
pkgs.python314Packages.mastodon-py
Python wrapper for the Mastodon API
pkgs.nodePackages_latest.mastodon-bot
Bot to publish twitter, tumblr or rss posts to an mastodon account.
pkgs.home-assistant-component-tests.mastodon
Open source home automation that puts local control and privacy first
pkgs.tests.home-assistant-component-tests.mastodon
Open source home automation that puts local control and privacy first
Package maintainers
Ignored maintainers (4)
-
@Izorkin Yurii Izorkin <Izorkin@gmail.com>
-
@ghuntley Geoffrey Huntley <ghuntley@ghuntley.com>
-
@happy-river Happy River <happyriver93@runbox.com>
-
@erictapen Kerstin Humm <kerstin@erictapen.name>