Mastodon's rate-limits are missing on `/auth/setup`(CVE-2025-27157)

概要

Mastodon's rate-limits are missing on /auth/setup

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are missing on /auth/setup. Without those rate limits, an attacker can craft requests that will send an email to an arbitrary addresses. Versions 4.2.16 and 4.3.4 fix the issue.

出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

影響パッケージ

Bitnami mastodon

[{"type":"SEMVER","events":[{"introduced":"4.2.0"},{"fixed":"4.3.4"}]}]

参照URL

advisory github.com
patch github.com
web nvd.nist.gov