CVE-2022-46405

Mastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue) by creating bot accounts that follow attacker-controll...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Mastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue) by creating bot accounts that follow attacker-controlled accounts on certain other servers associated with a wildcard DNS A record, such that there is uncontrolled recursion of attacker-generated messages.

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

影響パッケージ

Bitnami mastodon

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.0.3"}]}]

参照URL

advisory borg.social
advisory hackmd.io
web nvd.nist.gov