Mastodon 近期发布了 4.1.3/4.0.5/3.5.9 版本，修复了许多漏洞，其中包括一些应 Mozilla 之请求由 Cure53 进行代码审计过程中发现的严重漏洞。建议各位 Mastodon 实例运营者尽快更新。
- https://github.com/mastodon/mastodon/security/advisories/GHSA-9928-3cp5-93fm
- https://github.com/mastodon/mastodon/security/advisories/GHSA-ccm4-vgcc-73hp
CVE: CVE-2023-36460
CVSS: 9.9
#CVE #Mastodon
- https://github.com/mastodon/mastodon/security/advisories/GHSA-9928-3cp5-93fm
- https://github.com/mastodon/mastodon/security/advisories/GHSA-ccm4-vgcc-73hp
CVE: CVE-2023-36460
CVSS: 9.9
#CVE #Mastodon
GitHub
Arbitrary file creation through media attachments
(This advisory describes an issue found by Cure53 as part of an audit performed at Mozilla's request)
Using carefully crafted media files, attackers can cause Mastodon's media processing...
Using carefully crafted media files, attackers can cause Mastodon's media processing...
