Skip to main content

Mastodon 近期发布了 4.1.3/4.0.5/3.5.9 版本，修复了许多漏洞，其中包括一些应 Mozilla 之请求由 Cure53 进行代码审计过程中发现的严重漏洞

  1. Forwarded from 层叠 - The Cascading
    Mastodon 近期发布了 4.1.3/4.0.5/3.5.9 版本，修复了许多漏洞，其中包括一些应 Mozilla 之请求由 Cure53 进行代码审计过程中发现的严重漏洞。建议各位 Mastodon 实例运营者尽快更新。

    - https://github.com/mastodon/mastodon/security/advisories/GHSA-9928-3cp5-93fm
    - https://github.com/mastodon/mastodon/security/advisories/GHSA-ccm4-vgcc-73hp

    CVE: CVE-2023-36460
    CVSS: 9.9

    #CVE #Mastodon
    GitHub
    Arbitrary file creation through media attachments
    (This advisory describes an issue found by Cure53 as part of an audit performed at Mozilla's request)

    Using carefully crafted media files, attackers can cause Mastodon's media processing...