CVE-2023-42451: Mastodon Invalid Domain Name Normalization vulnerability

Q: What is Mastodon?

Mastodon is a free open-source social network server based on ActivityPub.

Q: What is the severity of CVE-2023-42451?

The severity of CVE-2023-42451 is high with a CVSS score of 7.4.

Q: How can an attacker exploit CVE-2023-42451?

Under certain circumstances, attackers can exploit a flaw in domain name normalization to spoof domains they do not own.

Q: Which versions of Mastodon are affected by CVE-2023-42451?

Versions 3.5.14, 4.0.0 to 4.0.10, 4.1.0 to 4.1.8, and 4.2.0-rc2 are affected by CVE-2023-42451.

Q: How do I fix CVE-2023-42451?

To fix CVE-2023-42451, update your Mastodon server to versions 3.5.14, 4.0.10, 4.1.8, or 4.2.0-rc2.

Published Sep 19, 2023

Updated

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, under certain circumstances, attackers can exploit a flaw in domain name normalization to spoof domains they do not own. Versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2 contain a patch for this issue.

Affected Software

7 affected components

Joinmastodon Mastodon<3.5.14

Joinmastodon Mastodon>=4.0.0<4.0.10

Joinmastodon Mastodon>=4.1.0<4.1.8

Joinmastodon Mastodon=4.2.0-beta1

Joinmastodon Mastodon=4.2.0-beta2

Joinmastodon Mastodon=4.2.0-beta3

Joinmastodon Mastodon=4.2.0-rc1

Remediation

Patch Available

https://github.com/mastodon/mastodon/commit/eeab3560fc0516070b3fb97e089b15ecab1938c8

Event History

Sep 19, 2023

CVE Published

via MITRE·03:56 PM

Data Sourced

via MITRE·03:56 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is Mastodon?

Mastodon is a free open-source social network server based on ActivityPub.

What is the severity of CVE-2023-42451?

The severity of CVE-2023-42451 is high with a CVSS score of 7.4.

How can an attacker exploit CVE-2023-42451?