Mastodon v4.6.4 Security Update: Fixes Improper Privilege Execution and IPv6 SSRF Bypass

Vulnerability Overview Fixes incorrect permission execution (GHSA-7jvw-ffmg-qp9x, GHSA-hx34-2p9v-2qjl) Fixes SSRF protection bypass via IPv4-compatible IPv6 addresses (GHSA-vwhj-3p83-v276) Impact Scope Incorrect permission execution may lead to unauthorized access or operations. SSRF protection bypass may enable Server-Side Request Forgery (SSRF) attacks. Remediation Permission execution fix: Ensure permissions checks are correctly implemented to prevent unauthorized access. SSRF protection fix: Update the SSRF protection mechanism to prevent bypasses via IPv4-compatible IPv6 addresses. Additional Information Update dependencies: Update related dependencies to enhance security. Upgrade Instructions Retrieve v4.6.4 code: Use . Backup the database: Ensure you have a database backup before performing any upgrade. Upgrade steps: - Non-Docker environment: 1. Install dependencies: 2. Precompile assets: 3. Restart all Mastodon processes. - Docker environment: 1. Restart all Mastodon processes. Dependencies Ruby: 3.3 or higher PostgreSQL: 14 or higher Elasticsearch: 7.x (recommended for full-text search; OpenSearch also works) LibreTranslate: 1.3.3 or higher (optional, for translation) Redis: 7.0 or higher Node: 22 or higher libvips: 8.13 or higher FFmpeg: 5.1 or higher Contributors Contributors include @ClearlyClaire, @shleeable, @diondiondion, @oneiros, @ChaosExAnima, among others. Assets All reactions: People have reacted. Summary Vulnerability Overview: Fixes for incorrect permission execution and SSRF protection bypass were addressed. Impact Scope: May lead to unauthorized access and Server-Side Request Forgery attacks. Remediation: Updated permission checks and SSRF protection mechanisms, along with dependency updates.

Goal Reached Thanks to every supporter — we hit 100%!

Mastodon v4.6.4 Security Update: Fixes Improper Privilege Execution and IPv6 SSRF Bypass

More from this source