PT-2023-7361 · Mastodon · Mastodon

Cure53 · Published 2023-07-06 · Updated 2024-03-06 · CVE-2023-36461

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 3.5.9 Mastodon versions prior to 4.0.5 Mastodon versions prior to 4.1.3

Description The issue is related to Mastodon's handling of outgoing HTTP queries, where a timeout is set on individual read operations. A malicious server can extend the response duration indefinitely through slowloris-type attacks, keeping all Mastodon workers busy and leading to the server becoming unresponsive.

Recommendations For versions prior to 3.5.9, update to version 3.5.9 or later. For versions prior to 4.0.5, update to version 4.0.5 or later. For versions prior to 4.1.3, update to version 4.1.3 or later.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2023-08393

BIT-MASTODON-2023-36461

CVE-2023-36461

GHSA-9PXV-6QVF-PJWC

Affected Products

Mastodon

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36461.json · Exploit
• https://github.com/mastodon/mastodon/commit/c5929798bf7e56cc2c79b15bed0c4692ded3dcb6 · Patch
• https://osv.dev/vulnerability/CVE-2023-36461 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mastodon-2023-36461 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-36461 · Security Note
• https://bdu.fstec.ru/vul/2023-08393 · Security Note
• https://github.com/mastodon/mastodon/releases/tag/v4.1.3 · Note
• https://github.com/mastodon/mastodon/security/advisories/GHSA-9pxv-6qvf-pjwc · Note
• https://github.com/mastodon/mastodon/releases/tag/v4.0.5 · Note
• https://github.com/mastodon/mastodon/releases/tag/v3.5.9 · Note
• https://t.me/true_secator/4597 · Telegram Post
• https://t.me/cibsecurity/66153 · Telegram Post
• http://openwall.com/lists/oss-security/2023/07/06/7 · Note
• https://t.me/cvenotify/53823 · Telegram Post