PT-2023-7361 · Mastodon · Mastodon

Cure53 · Publicado 2023-07-06 · Atualizado 2024-03-06 · CVE-2023-36461

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 3.5.9 Mastodon versions prior to 4.0.5 Mastodon versions prior to 4.1.3

Description The issue is related to Mastodon's handling of outgoing HTTP queries, where a timeout is set on individual read operations. A malicious server can extend the response duration indefinitely through slowloris-type attacks, keeping all Mastodon workers busy and leading to the server becoming unresponsive.

Recommendations For versions prior to 3.5.9, update to version 3.5.9 or later. For versions prior to 4.0.5, update to version 4.0.5 or later. For versions prior to 4.1.3, update to version 4.1.3 or later.

Exploit

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

BDU:2023-08393

BIT-MASTODON-2023-36461

CVE-2023-36461

GHSA-9PXV-6QVF-PJWC

Produtos afetados

Mastodon

Referências · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36461.json · Exploit
• https://github.com/mastodon/mastodon/releases/tag/v4.1.3 · Nota
• https://github.com/mastodon/mastodon/security/advisories/GHSA-9pxv-6qvf-pjwc · Nota
• https://github.com/mastodon/mastodon/commit/c5929798bf7e56cc2c79b15bed0c4692ded3dcb6 · Correção
• https://github.com/mastodon/mastodon/releases/tag/v4.0.5 · Nota
• https://github.com/mastodon/mastodon/releases/tag/v3.5.9 · Nota
• https://osv.dev/vulnerability/CVE-2023-36461 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-mastodon-2023-36461 · Aviso do Fabricante
• https://t.me/true_secator/4597 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-36461 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-08393 · Nota de Segurança
• https://t.me/cibsecurity/66153 · Publicação no Telegram
• http://openwall.com/lists/oss-security/2023/07/06/7 · Nota
• https://t.me/cvenotify/53823 · Publicação no Telegram