Hachyderm.io

0 posts0 participants0 posts today

Ryan BaumannHere's an article from <a href="https://infosec.exchange/@dangoodin" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@dangoodin</a> explaining the severity of the original CVE-2023-36460 (dubbed <a href="https://digipres.club/tags/TootRoot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TootRoot</a> by <a href="https://cyberplace.social/@GossiTheDog" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@GossiTheDog</a>): <a href="https://arstechnica.com/security/2023/07/mastodon-fixes-critical-tootroot-vulnerability-allowing-node-hijacking/" rel="nofollow noopener noreferrer" target="_blank">https://arstechnica.com/security/2023/07/mastodon-fixes-critical-tootroot-vulnerability-allowing-node-hijacking/</a>

FraYoshi the 2ndoh... there's <a href="https://mstdn.social/@stux" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@stux</a> on the video of Mentally Outlaw about <a href="https://mstdn.social/tags/TootRoot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TootRoot</a>! <a href="https://youtu.be/3KCyhltnz7w?t=721" rel="nofollow noopener noreferrer" target="_blank">https://youtu.be/3KCyhltnz7w?t=721</a>

GMate8<a href="https://mas.to/@iamdtms" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@iamdtms</a> good they found it! By the way <a href="https://mozilla.social/@mozilla" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@mozilla</a> hired a pentester group and they found the <a href="https://mastodon.online/tags/TootRoot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TootRoot</a> vulnerability in Mastodon

Quinn Blueheart 🔞✍️🔥<a href="https://smutlandia.com/@monster_mistress" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@monster_mistress</a> are you on this <a href="https://smutlandia.com/tags/tootroot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#tootroot</a> fix already? Thanks for all you do! 💙💙💙<a href="https://glitterkitten.co.uk/@doot/110705662211310545" rel="nofollow noopener noreferrer" target="_blank">https://glitterkitten.co.uk/@doot/110705662211310545</a>

SethEven exploits on <a href="https://social.sethmb.xyz/tags/mastodon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mastodon</a> sound cute. Luckily, <a href="https://social.sethmb.xyz/tags/tootroot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#tootroot</a> is now fixed ☺️

Chris McDonough ✅I run a Mastodon instance on Digital Ocean. Upgrading a 4.0.X instance there was pretty darn easy.<a href="https://chattingdarkly.org/tags/TootRoot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TootRoot</a> <a href="https://arstechnica.com/security/2023/07/mastodon-fixes-critical-tootroot-vulnerability-allowing-node-hijacking/" rel="nofollow noopener noreferrer" target="_blank">https://arstechnica.com/security/2023/07/mastodon-fixes-critical-tootroot-vulnerability-allowing-node-hijacking/</a>

mrp<a href="https://climatejustice.social/@PaulaToThePeople" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@PaulaToThePeople</a> have you updated your mastodon servers to patch <a href="https://climatejustice.rocks/tags/tootroot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#tootroot</a> ? <a href="https://github.com/mastodon/mastodon/security" rel="nofollow noopener noreferrer" target="_blank">https://github.com/mastodon/mastodon/security</a>

MOULE | :CTRL: Album Out Now!I hope every <a href="https://mastodon.moule.world/tags/MastoAdmin" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MastoAdmin</a> has updated their <a href="https://mastodon.moule.world/tags/Mastodon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Mastodon</a> <a href="https://mastodon.moule.world/tags/Instance" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Instance</a> to the latest version by now...the <a href="https://mastodon.moule.world/tags/TootRoot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TootRoot</a> <a href="https://mastodon.moule.world/tags/vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vulnerability</a> is not a joke! <a href="https://mastodon.moule.world/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurity</a> <a href="https://mastodon.moule.world/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InfoSec</a> <a href="https://mastodon.moule.world/tags/Security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Security</a> <a href="https://arstechnica.com/security/2023/07/mastodon-fixes-critical-tootroot-vulnerability-allowing-node-hijacking/" rel="nofollow noopener noreferrer" target="_blank">https://arstechnica.com/security/2023/07/mastodon-fixes-critical-tootroot-vulnerability-allowing-node-hijacking/</a>

DarkChocobo :gaming_magoscuro:Los de Mozilla Fundation han hecho pentesting en su instancia y han descubierto una nueva vulnerabilidad que afecta todo Mastodon que consiste en atacar la ruta de los attachment(fotos, gifs, videos, etc..).¿Tenemos la instancia actualizada , <a href="https://tkz.one/@trankten" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@trankten</a>? Esto es muy nuevo. Y te puede interesar <a href="https://tkz.one/tags/Tootroot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Tootroot</a><a href="https://www.youtube.com/watch?v=3KCyhltnz7w" rel="nofollow noopener noreferrer" target="_blank">https://www.youtube.com/watch?v=3KCyhltnz7w</a>

stl1988<a href="https://layer8.space/@Sammy8806" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@Sammy8806</a> Hast du layer8.space bereits auf 4.1.3 geupdatet? Dieses Update behebt eine kritische Sicherheitslücke namens <a href="https://layer8.space/tags/Tootroot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Tootroot</a>.

ben<a href="https://infosec.exchange/@jerry" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@jerry</a> out of curiosity since you have experience with both mastodon and infosec , what’s your take on the recent <a href="https://infosec.exchange/tags/tootroot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#tootroot</a> vulnerability? I’m sure your on top of it with infosec.exchange but what does this mean for other admins who possibly don’t patch?

Evan 🫠 🔙 MAGFest 🦔💨🥏<a href="https://gamedev.lgbt/@bram" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@bram</a> idk how to check as a user but can you check if this instance is updated to 4.1.3 or later to prevent <a href="https://gamedev.lgbt/tags/TootRoot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TootRoot</a> ?

zbecker<a href="https://mastodon.zbecker.cc/tags/mastodon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mastodon</a> <a href="https://mastodon.zbecker.cc/tags/Fediverse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Fediverse</a> <a href="https://mastodon.zbecker.cc/tags/mastoadmin" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mastoadmin</a>Make sure your server is on version 4.1.3+Critical CVE Found <a href="https://mastodon.zbecker.cc/tags/cve202336459" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cve202336459</a> also known as <a href="https://mastodon.zbecker.cc/tags/tootRoot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#tootRoot</a> <a href="https://www.youtube.com/watch?v=3KCyhltnz7w" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.youtube.com/watch?v=3KCyhltnz7w</a>

HyreinDrawStuffHave the @admin of Mastodon.art patch out the tootroot bug yet? <a href="https://mastodon.art/tags/tootroot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#tootroot</a>

rina :v_trans:<a href="https://tech.lgbt/@mods" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@mods</a> please deal with <a href="https://tech.lgbt/tags/tootroot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#tootroot</a> if you haven't !!

🌈 BarbaPulpe 😇 ᴹᵃˢᵗᵒᵈᵒⁿConcernant les dernières failles de sécurité : agissons ensemble pour une fédiverse sûre !La dernière mise à jour de Mastodon va démontrer les défis d'une architecture fédérée avec un ensemble d'administrateurs répartis dans le monde, de compétences diverses en administration de serveurs et agissant pour la plupart dans leur temps libre.Et pourtant, il y a cinq vulnérabilités dont la plus critique a un score CVSS de 9,9 sur 10 (et la suivante de 9,3), ce qui en fait une faille critique et facile à exploiter. Envoyer un pouet construit à cette fin peut suffire à implanter un code arbitraire sur le serveur cible, et ainsi à en prendre le contrôle ou bien capturer toutes les informations qui y sont stockées (dont les IP et adresses mail de ses utilisateurs).Facile à résoudre, il faut que l'administrateur mette à jour son serveur (au moins vers 4.1.3, ou bien 4.0.5 ou 3.5.9 s'il est sur d'anciennes branches). Heureusement cela n'affectera a priori que son serveur, mais qui sait ce qu'un attaquant pourrait faire à partir d'un serveur compromis fédéré avec le reste de la fédiverse ? Se faire passer pour un autre par exemple ?Si vous êtes sur un serveur à jour vos données sont protégées. Si ce n'est pas le cas contactez votre administrateur pour qu'il fasse cette mise à jour dès que possible. Il ne serait pas responsable de rester encore une semaine sans résoudre ce problème, d'autant que la solution est disponible et facile à appliquer, et que la vulnérabilité est désormais connue et exploitable. Chaque administrateur a probablement reçu un mail pour le prévenir directement (c'est mon cas et beaucoup d'autres que je connais), donc... y a plus qu'à !<a href="https://gayfr.social/tags/MastoAdmin" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MastoAdmin</a> <a href="https://gayfr.social/tags/MastodonAdmin" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MastodonAdmin</a> <a href="https://gayfr.social/tags/Admin" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Admin</a> <a href="https://gayfr.social/tags/TootRoot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TootRoot</a><a href="https://arstechnica.com/security/2023/07/mastodon-fixes-critical-tootroot-vulnerability-allowing-node-hijacking/" rel="nofollow noopener noreferrer" target="_blank">https://arstechnica.com/security/2023/07/mastodon-fixes-critical-tootroot-vulnerability-allowing-node-hijacking/</a>

Genders: ♾️, 🟪⬛🟩; Soni L.it'd be funny if ppl started using <a href="https://chaos.social/tags/TootRoot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TootRoot</a> to patch TootRoot.

Matt WillemsenMastodon fixes critical “TootRoot” vulnerability allowing node hijacking Most critical of the bugs allowed attackers to root federated instances. <a href="https://arstechnica.com/security/2023/07/mastodon-fixes-critical-tootroot-vulnerability-allowing-node-hijacking/" rel="nofollow noopener noreferrer" target="_blank">https://arstechnica.com/security/2023/07/mastodon-fixes-critical-tootroot-vulnerability-allowing-node-hijacking/</a> <a href="https://fedibird.com/tags/Mastodon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Mastodon</a> <a href="https://fedibird.com/tags/fixes" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#fixes</a> <a href="https://fedibird.com/tags/TootRoot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TootRoot</a> <a href="https://fedibird.com/tags/vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vulnerability</a> <a href="https://fedibird.com/tags/NodeHijacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NodeHijacking</a> <a href="https://fedibird.com/tags/attackers" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#attackers</a> <a href="https://fedibird.com/tags/root" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#root</a> <a href="https://fedibird.com/tags/FederatedInstances" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FederatedInstances</a>.

WuzzyAnd the prize for the funniest name of a security vulnerability goes to: Tootroot! 🎉 (CVE-2023-36460)<a href="https://cyberplace.social/tags/Tootroot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Tootroot</a> <a href="https://cyberplace.social/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a> <a href="https://cyberplace.social/tags/Mastodon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Mastodon</a> <a href="https://cyberplace.social/tags/CVE202336460" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CVE202336460</a>

Wildy :verified_paw:Updated my <a href="https://socialpa.ws/tags/mastodon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mastodon</a> server to 4.1.4.Dear <a href="https://socialpa.ws/tags/mastodon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mastodon</a> admins, there was a new <a href="https://socialpa.ws/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a> vulnerability discovered called <a href="https://socialpa.ws/tags/TootRoot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TootRoot</a>, please update your servers!

Recent searches

Search options

Administered by:

Server stats:

#tootroot