Mastodon: Unwanted deactivation of SSL/TLS certificate verification
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldap_authenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULT_PARAMS when LDAP authentication uses LDAP_TLS_NO_VERIFY=true, disabling SSL and TLS certificate verification globally for requests made by puma web processes while sidekiq background jobs remain unaffected. This issue is fixed in versions 4.4.19 and 4.5.12.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-59825US | — | — | ||
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldap_authenticable.rb m… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/mastodon/mastodon/commit/2ccb6ef277e725d1932295690cf8ab9d3dc03149WEB
- https://github.com/mastodon/mastodon/commit/5748d0b16ea09001e0933f76c7afe814e09652efWEB
- https://github.com/mastodon/mastodon/commit/761c61b42590a2fd91442fc15a0a7583e48bbea4WEB
- https://github.com/mastodon/mastodon/pull/39571WEB
- https://github.com/mastodon/mastodon/releases/tag/v4.4.19WEB
- https://github.com/mastodon/mastodon/releases/tag/v4.5.12WEB
- https://github.com/mastodon/mastodon/security/advisories/GHSA-3rhr-8phh-jm86WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-59825WEB
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan