 58.5% of @pixelfed servers still have a critical vulnerability left unpatched. I'll just highlight something: the vulnerability allows a third-party to gain administrative control over your instance if you don't update. You really want to update as soon as possible, there's a reason this is a 9.9/10 vulnerability score. 16 comments
 @thisismissem @pixelfed Consider reporting it to @certbund & @cert_eu ... Maybe once it's acknowledged then hosters will intervene because they don't want shit to get abused for malware... @kkarhan please just wait for the full disclosure on the 25th; I know you're trying to be helpful but you're misunderstanding the type of vulnerability. @thisismissem okay... I do accept amd understand #ResponsibleDisclosure and why people should first fix it... Needless to say said CERTs should be made aware as their publications & feeds are also being read by Hosters who may also have the ability to scan their customers' systems and notify them as well or if necessary forcibly shut down vulnerable instances before they get hacked... @kkarhan there's already a CVE and a security advisory on github. For now it's not necessary as far as I know for CERT to be involved @thisismissem @pixelfed hmmm... maybe I can white knight this shit and be the hacker that breaks in, upgrades their instance and leaves lol. Like jailbreakme back in the day. Lol @matrix9180 @pixelfed lucky not a vulnerability that gives you shell access as far as I know. @thisismissem @pixelfed that's good at least. Still enough access to set a global notice to everyone that their instance hasn't been upgraded and has been compromised and is still vulnerable. And urge them to pester their admins until it happens... @thisismissem @matrix9180 @pixelfed I'm curious how the CVE score is so high without RCE possibilities? escalation of privileges is usually in the 5-6ish range @nil @thisismissem @pixelfed yeah, something is fishy... Critical is usually reserved for "oops all root access on the host" vulns... @matrix9180 @nil @pixelfed that's how it was scored by GitHub score calculator. https://github.com/pixelfed/pixelfed/security/advisories/GHSA-gccq-h3xj-jgvf @thisismissem @matrix9180 @pixelfed huh. TIL what's in the CVE score: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator At least the base score. @nil @thisismissem @pixelfed yep, but I suppose it could be that high because it maybe exposes everyone's info. Going to get some rest but I'll probably see what they fixed and go from there lol @nil @matrix9180 @pixelfed so yeah, base score is 9.9 β though nist's calculator is more explanatory than GitHubs, overall score ended up being 8.4 with all the other factors |
Gregory's Server
To the 208 @pixelfed servers that have upgraded so far, thank you!