Я около месяца содержал собственный однопользовательский сервер Mastodon на AWS. В этой статье я расскажу, во сколько мне это обошлось. Предисловие: Для начала нужно сказать пару слов. Во-первых, я работаю на AWS в должности Solutions Architect. Однако поскольку это мой личный проект, я запустил…
Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 3.5.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, attackers using carefully crafted media files can cause Mastodon's media processing code to create arbitrary files at any location. This allows attackers to create and overwrite any file Mastodon has access to, allowing Denial of Service and arbitrary Remote Code Execution. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.
Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout on individual read operations. Prior to versions 3.5.9, 4.0.5, and 4.1.3, a malicious server can indefinitely extend the duration of the response through slowloris-type attacks. This vulnerability can be used to keep all Mastodon workers busy for an extended duration of time, leading to the server becoming unresponsive. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch…
A cleartext-credential issue was discovered in the Amazon AWS SDK 2.8.5 for Android. This SDK uses Android SharedPreferences to store AWS STS Temporary Credentials retrieved by AWS Cognito Identity Provider. If a Mobile Application (MA) uses AWS Cognito in the authentication or authorization process, the AWS SDK will store these credentials in cleartext inside the "com.amazonaws.android.auth" SharedPref. An attacker can use these credentials to create and sign valid AWS Signature v4 requests, and