FOSSWire
Search/
Decentralized & P2P

Mastodon v4.5.20 fixes ActivityPub identifier verification vulnerability

Brief written by the FOSSWire AI editor from Mastodon How we write

1 min read

Key Takeaway

Mastodon v4.5.20 addresses a security flaw in ActivityPub identifier verification and updates core dependencies.

Summary

The Mastodon project has released version 4.5.20, a maintenance update focused on security and dependency management. This release specifically addresses a vulnerability regarding insufficient ActivityPub identifier verification (GHSA-288h-6j8h-6x5j).

Administrators are encouraged to upgrade promptly, particularly those utilizing OpenStack Swift for object storage, as known security issues exist in certain dependencies. This update also includes a change to the default Ruby version and resolves inefficiencies in hashtag timeline queries.

Security fixes and technical changes in v4.5.20

  • Security Vulnerability: Fixes GHSA-288h-6j8h-6x5j, which involved insufficient verification of ActivityPub identifiers.
  • Dependency Updates: Addresses security advisories within the Ruby, NodeJS, and sanitize libraries.
  • Performance Optimization: Resolves an inefficiency affecting the execution of certain hashtag timeline queries.
  • Runtime Environment: Updates the default Ruby version requirement, necessitating careful environment configuration for non-Docker installations.
  • Development Tooling: Fixes errors within the dev:populate_sample_data task used during development.

Why it matters

This update is critical for Fediverse instance administrators to maintain protocol integrity and protect against identifier-based exploits. The warning regarding OpenStack Swift highlights the importance of monitoring the security posture of the underlying storage infrastructure in decentralized social networking.

What to do

  • Mastodon administrators should upgrade to version 4.5.20.
  • Back up your database before performing the upgrade.
  • For non-Docker installations, ensure you use Ruby 3.2 or newer and install dependencies with 'bundle install' and 'yarn install --immutable'.
  • For Docker installations, restart all Mastodon processes after updating.

Original reference: github.com →