Public
- Public
- Network
- Groups
- Popular
- People

Conversation

Notices

tesaguri 🦀🦝 (tesaguri@fedibird.com)'s status on Sunday, 18-Feb-2024 23:13:54 JST tesaguri 🦀🦝

Lack of media type verification of Activity Streams objects allows impersonation of remote accounts · Advisory · mastodon/mastodon · GitHub
https://github.com/mastodon/mastodon/security/advisories/GHSA-jhrq-qvrm-qr36
これを報告するなどしていた
In conversation about 9 months ago from fedibird.com permalink
Attachments
1. Lack of media type verification of Activity Streams objects allows impersonation of remote accounts
  
  ### Summary When fetching remote statuses, Mastodon doesn't check that the response from the remote server has a `Content-Type` header value of the Activity Streams media type, which allows a th...

Feeds