paarth, 3 months ago

@thisismissem @pixelfed that's kinda a horrifying vulnerability level

thisismissem, 3 months ago

@paarth @pixelfed indeed, it was very almost a 10/10 but required some minimal user interaction.

There'll be more information on the 25th when I make the full disclosure at 8pm-ish CEST.

paarth, 3 months ago

@thisismissem @pixelfed I'm curious how it got caught/why it wasn't caught earlier, and whether older versions in the wild may still be affected. Though I imagine that may all have to wait until after 2/25?

thisismissem, 3 months ago

@paarth @pixelfed it got caught by me looking into the code whilst working on software for @iftas

Does it affect older versions? See the disclosure of the vulnerability.

devnull, 3 months ago

@thisismissem @paarth @pixelfed @iftas It's important to give leeway to project maintainers here. In all cases, there is no malicious intent, just ignorance over esoteric aspects of the chosen language. #nodebb itself contained a 10/10 0-day, and we were very thankful that it was reported and fixed quickly.

thisismissem, 3 months ago

@devnull @paarth @pixelfed it's not just that but sometimes in the thick of it working long hours solo on a project it can be possible to miss things.

This was very almost a 10/10, but required a little bit of user interaction in the past year to exercise.

thisismissem, 3 months ago

Have submitted confidentially pull requests that fix both their main branch and currently released version.

(yes, I manually backported the fix from main branch to their last release because the vulnerability is that critical to fix)

Awaiting response from the project maintainers now.

thisismissem, 3 months ago

Update: working with the maintainers to release a fix ASAP, but details of the vulnerability will be embargoed until admins have had a chance to upgrade.

thisismissem, 3 months ago

CVE number assigned! More news soon.

(It's my first numbered CVE 🥲)

janl, 3 months ago

@thisismissem mazel tov

thisismissem, 3 months ago

And here's the published security advisory: https://github.com/pixelfed/pixelfed/security/advisories/GHSA-gccq-h3xj-jgvf

The vulnerability I found was indeed in @pixelfed, and I cannot understate how important it is for people to upgrade. Details will be embargoed until 25th February 2024.

devnull, 3 months ago

@thisismissem congratulations may feel out of place, but it's a remarkable achievement to get your first numbered CVE 😄

thisismissem, 3 months ago

@devnull yeah, it's something I'm both proud of and happy that I fixed.