CVE-2023-28756

Advisory

Mastodon.py 1.8.1 and prior supports 'mastodon' v3.5.5, which is affected by known vulnerabilities: ReDoS vulnerabilities in Ruby before 3.2.2.
https://github.com/mastodon/mastodon/pull/24320

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Fixed

- Fix crash in `tootctl` commands making use of parallelization when Elasticsearch is enabled ([ClearlyClaire](https://github.com/mastodon/mastodon/pull/24182), [ClearlyClaire](https://github.com/mastodon/mastodon/pull/24377))
- Fix crash in `db:setup` when Elasticsearch is enabled ([rrgeorge](https://github.com/mastodon/mastodon/pull/24302))
- Fix user archive takeout when using OpenStack Swift or S3 providers with no ACL support ([ClearlyClaire](https://github.com/mastodon/mastodon/pull/24200))
- Fix invalid/expired invites being processed on sign-up ([ClearlyClaire](https://github.com/mastodon/mastodon/pull/24337))

Security

- Update Ruby to 3.0.6 due to ReDoS vulnerabilities ([saizai](https://github.com/mastodon/mastodon/pull/24334))
- Fix unescaped user input in LDAP query ([ClearlyClaire](https://github.com/mastodon/mastodon/pull/24379))

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28756