Nixpkgs security tracker

Try the new UI

Login with GitHub

Suggestion detail

Dismissed

Permalink CVE-2026-59825

7.4 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

updated 1 month ago by @erictapen Activity log

Created suggestion 1 month ago
@erictapen ignored
5 packages
- bitlbee-mastodon
- mastodon-archive
- python313Packages.mastodon-py
- python314Packages.mastodon-py
- wordpressPackages.plugins.simple-mastodon-verification
1 month ago
@erictapen dismissed 1 month ago

Mastodon: Unwanted deactivation of SSL/TLS certificate verification

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldap_authenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULT_PARAMS when LDAP authentication uses LDAP_TLS_NO_VERIFY=true, disabling SSL and TLS certificate verification globally for requests made by puma web processes while sidekiq background jobs remain unaffected. This issue is fixed in versions 4.4.19 and 4.5.12.

References

https://github.com/mastodon/mastodon/security/advisories/GHSA-3rhr-8phh-jm86 x_refsource_CONFIRM
https://github.com/mastodon/mastodon/pull/39571 x_refsource_MISC
https://github.com/mastodon/mastodon/commit/2ccb6ef277e725d1932295690cf8ab9d3dc03149 x_refsource_MISC
https://github.com/mastodon/mastodon/commit/5748d0b16ea09001e0933f76c7afe814e09652ef x_refsource_MISC
https://github.com/mastodon/mastodon/commit/761c61b42590a2fd91442fc15a0a7583e48bbea4 x_refsource_MISC
https://github.com/mastodon/mastodon/releases/tag/v4.4.19 x_refsource_MISC
https://github.com/mastodon/mastodon/releases/tag/v4.5.12 x_refsource_MISC

Affected products

mastodon

==< 4.4.19
==>= 4.5.0, < 4.5.12

Matching in nixpkgs

pkgs.mastodon

Self-hosted, globally interconnected microblogging software based on ActivityPub

nixos-unstable 4.6.2
- nixpkgs-unstable 4.6.2
- nixos-unstable-small 4.6.6
nixos-26.05 4.6.2
- nixos-26.05-small 4.6.6
- nixpkgs-26.05-darwin 4.6.2

Ignored packages (5)

pkgs.bitlbee-mastodon

Bitlbee plugin for Mastodon

nixos-unstable 1.4.5
- nixpkgs-unstable 1.4.5
- nixos-unstable-small 1.4.5
nixos-26.05 1.4.5
- nixos-26.05-small 1.4.5
- nixpkgs-26.05-darwin 1.4.5

pkgs.mastodon-archive

Utility for backing up your Mastodon content

nixos-unstable 1.4.8
- nixpkgs-unstable 1.4.8
- nixos-unstable-small 1.4.8
nixos-26.05 1.4.8
- nixos-26.05-small 1.4.8
- nixpkgs-26.05-darwin 1.4.8

pkgs.python313Packages.mastodon-py

Python wrapper for the Mastodon API

nixos-unstable 2.2.1
- nixpkgs-unstable 2.2.1
- nixos-unstable-small 2.2.2
nixos-26.05 2.2.1
- nixos-26.05-small 2.2.1
- nixpkgs-26.05-darwin 2.2.1

pkgs.python314Packages.mastodon-py

Python wrapper for the Mastodon API

nixos-unstable 2.2.1
- nixpkgs-unstable 2.2.1
- nixos-unstable-small 2.2.2
nixos-26.05 2.2.1
- nixos-26.05-small 2.2.1
- nixpkgs-26.05-darwin 2.2.1

pkgs.wordpressPackages.plugins.simple-mastodon-verification

None

nixos-unstable 2.0.3
- nixpkgs-unstable 2.0.3
- nixos-unstable-small 2.0.3
nixos-26.05 2.0.3
- nixos-26.05-small 2.0.3
- nixpkgs-26.05-darwin 2.0.3

Package maintainers

@happy-river Happy River <happyriver93@runbox.com>
@erictapen Kerstin Humm <kerstin@erictapen.name>
@Izorkin Yurii Izorkin <Izorkin@gmail.com>

Only Mastodon 4.6 in Nixpkgs