⚠ The security vulnerability on discovered in rc1 and rc2 have been patched, in verson 2.4.0rc3 ⚠ UPDATE ASAP
⚠ If you've run 2.3.3+master you may be affected too (since the 27th of march)
⭐ 2.3.3 and other previous stable versions are SAFE, and not affected by it.
https://github.com/tootsuite/mastodon/releases/tag/v2.4.0rc3
(updated toot with additional info, read full info inside the release on github)
@l4p1n corrigé depuis hier soir ;)
@self @maloki ⚠ The security vulnerability on discovered in rc1 and rc2 have been patched, in verson 2.4.0rc3 ⚠ UPDATE ASAP
⚠ If you've run 2.3.3+master you may be affected too (since the 27th of march)
⭐ 2.3.3 and other previous stable versions are SAFE, and not affected by it.
https://github.com/tootsuite/mastodon/releases/tag/v2.4.0rc3
(updated toot with additional info, read full info inside the release on github)
but an FYI@snoot ah I see, it's weird that I was unable to view the first toot before you tagged me just now but now I can see the whole conversation. Thanks. :) I'll update our Mastodon instance to the latest version once it's stable. :)
@maloki SO whats this about?
@Dog2puppy I'm pretty sure that you can interpret the release notes with the vulnerability info, just as well as I can.
Feel free to ask questions if you have any still after reading it though.
@maloki @Dog2puppy those release notes seem to say nothing about what the bug actually is that was fixed..?
@slipstream I feel like the fixes show exactly what was wrong.
Anyways, in my case, I don't know more than what's in that release note. So I am not the right person to ask, but if there are actual specific questions after reading it, feel free to ask.
@maloki @Dog2puppy The PR which I assume fixes the bug (7480) doesn't seem to explain *why* it's vulnerable.
@slipstream @maloki @Dog2puppy yeah i'm really perplexed about this
@jk @slipstream @maloki @Dog2puppy It's not by accident that I did not give simple instructions on how to exploit it.
Well, webpack put environment variables (like secrets) into a publicly accessible javascript file.
@Gargron @jk @maloki @Dog2puppy i have no words.
@slipstream @Gargron @jk @maloki I just don't understand what was vulnerable.
@Gargron
12factor: “Store config in the environment”; “A litmus test for whether an app has all config correctly factored out of the code is whether the codebase could be made open source at any moment, without compromising any credentials.”
webpack: “hold my beer”
@flussence The secrets are not in version control, obviously. It was just a mistake with config. Cannot say it's webpack's fault, but a combination of things.
@maloki
@Dryusdan kdo