Security News > 2024 > February > Critical vulnerability in Mastodon is pounced upon by fast-acting admins

Mastodon has called admins to action following the disclosure of a critical vulnerability affecting the decentralized social network favored by erstwhile Twitter lovers.

"Every Mastodon version prior to 3.5.17 is vulnerable, as well as 4.0.x versions prior to 4.0.13, 4.1.x version prior to 4.1.13, and 4.2.x versions prior to 4.2.5.".

"Each instance of Mastodon is hosted separately from all others, and while there are common links to allow moving between instances, they are separate, owned, and operated by different people, with different teams managing the security of each. For this reason, each instance of Mastodon requires an economy-of-scale to support its operations, including people to manage infrastructure and security engineering."

"There aren't enough details here yet to say exactly why Mastodon is vulnerable and other platforms aren't but different source code repositories won't share vulnerabilities unless there is an inherent flaw in one of the open-source packages that are shared between both products."

The good news for Mastodon users is that more than half of all active servers have already upgraded to the latest version in the space of a day, according to data from fediverse network stat collector FediDB. Such a fast patch rate was likely the product of how well the Mastodon community publicized the matter.

A quick scan of the security advisory history at Mastodon shows this isn't the only security issue the platform has had to patch over the past year, with two critical bugs, CVE-2023-36460 and CVE-2023-36459, emerging in July 2023.

News URL

https://go.theregister.com/feed/www.theregister.com/2024/02/02/critical_vulnerability_in_mastodon_is/