Mastodon up to 3.5.13/4.0.9/4.1.7/4.2.0-rc1 Domain Name Normalization name resolution

Summaryinfo

A vulnerability labeled as problematic has been found in Mastodon up to 3.5.13/4.0.9/4.1.7/4.2.0-rc1. This affects an unknown part of the component Domain Name Normalization Handler. Executing a manipulation can lead to name resolution. This vulnerability is handled as CVE-2023-42451. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Mastodon up to 3.5.13/4.0.9/4.1.7/4.2.0-rc1. It has been declared as problematic. This vulnerability affects an unknown part of the component Domain Name Normalization Handler. The manipulation with an unknown input leads to a name resolution vulnerability. The CWE definition for the vulnerability is CWE-706. The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere. As an impact it is known to affect integrity. CVE summarizes:

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, under certain circumstances, attackers can exploit a flaw in domain name normalization to spoof domains they do not own. Versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2 contain a patch for this issue.

The weakness was released 09/19/2023 as GHSA-v3xf-c9qf-j667. The advisory is shared for download at github.com. This vulnerability was named CVE-2023-42451 since 09/08/2023. There are neither technical details nor an exploit publicly available.

Upgrading to version 3.5.14, 4.0.10, 4.1.8 or 4.2.0-rc2 eliminates this vulnerability. Applying the patch eeab3560fc0516070b3fb97e089b15ecab1938c8 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Mastodon

Version

• 3.5.0
• 3.5.1
• 3.5.2
• 3.5.3
• 3.5.4
• 3.5.5
• 3.5.6
• 3.5.7
• 3.5.8
• 3.5.9
• 3.5.10
• 3.5.11
• 3.5.12
• 3.5.13
• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4
• 4.0.5
• 4.0.6
• 4.0.7
• 4.0.8
• 4.0.9
• 4.1.0
• 4.1.1
• 4.1.2
• 4.1.3
• 4.1.4
• 4.1.5
• 4.1.6
• 4.1.7
• 4.2.0-rc1

License

• open-source

Website

• Product: https://github.com/mastodon/mastodon/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion