Also it was reported by nostr:npub1j3pf2vg36vgxtmxjxuxcu5ynh5krrvl55qmy9rfx98d8pp4cawcsvzm7q2 so thanks a lot!
Thank you for finding this Mae
every little fix makes us closer to being impenetrable 😇
what does "feature complete" mean to you? because it does everything I need day to day
#Pleroma Security Release 2.5.4
Fix XML External Entity (XXE) loading vulnerability allowing to fetch arbitrary files from the server's filesystem.
https://pleroma.social/announcements/2023/08/05/pleroma-security-release-2.5.4/
At least we are now in the same company as Postgres who also has this vulnerability in 2012 🥲
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3489
If someone made one maybe it would be more obvious when researching which libraries to use...
It's hilarious how stupid it is they left this enabled by default. Afraid of breaking backwards compatibility or something?
Probably worth our time to see if we can stir up some discussion on this upstream
XML designers should be ashamed lol
#Pleroma Security Release 2.5.4
Fix XML External Entity (XXE) loading vulnerability allowing to fetch arbitrary files from the server's filesystem.
https://pleroma.social/announcements/2023/08/05/pleroma-security-release-2.5.4/
Hello friends, I invite you to check this blog post that I found after receiving the report:
https://vuln.be/post/xxe-in-erlang-and-elixir/
Apparently the bundled Erlang XML library xmerl along with a few other Erlang/Elixir XML parsers are vulnerable by default and we had no clue.
Search engine is crawling our IPFS proxy at work because there's a whole copy of wikipedia on there 💀 💀 💀
Thinking about getting a neck tattoo that says "no soliciting"
:eyepop:
sounds french in my head
based on the rapid absorption of co2 into the oceans I'd say it's becoming carbonated :)
how am I supposed to c*m to this?
