PT-2019-10443 · Mastodon · Mastodon

Gargron · Published 2019-09-22 · Updated 2019-09-23 · CVE-2018-21018

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 2.6.3

Description The issue arises from the mishandling of timeouts for incompletely established sessions.

Recommendations For versions prior to 2.6.3, update to version 2.6.3 or later to resolve the issue.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2018-21018

Affected Products

Mastodon

References · 7

• https://github.com/tootsuite/mastodon/pull/9329 · Patch
• https://github.com/tootsuite/mastodon/pull/9381 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-21018 · Security Note
• https://osv.dev/vulnerability/CVE-2018-21018 · Vendor Advisory
• https://github.com/tootsuite/mastodon/releases/tag/v2.6.3 · Note
• https://github.com/tootsuite/mastodon/releases/tag/v2.6.2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-21018 · Note