this post was submitted on 24 Jan 2024
115 points (100.0% liked)

Announcements

23301 readers
30 users here now

Official announcements from the Lemmy project. Subscribe to this community or add it to your RSS reader in order to be notified about new releases and important updates.

You can also find major news on join-lemmy.org

founded 5 years ago
MODERATORS
 

The full description of the bug is in the linked issue above, but the short version is:

Our CreatePrivateMessageReport endpoint had a bug that would allow anyone, not just the recipient, to create a report, and then receive the details about private messages.

This allowed anyone to iterate over ids, creating thousands of reports in order to receive details about private messages.

Since those reports are visible to admins, it would be easy to discover if someone was abusing this, and luckily we haven't heard of anyone doing so on production instances (so far).

If you haven't, please be sure to upgrade to at least 0.19.1 for the fix.

Many thanks to @Nothing4You for finding this one.

you are viewing a single comment's thread
view the rest of the comments
[–] Blaze@discuss.online 26 points 9 months ago* (last edited 9 months ago) (3 children)

Isn't that dangerous to discose the bug while the largest version is still 18.5 ? https://fedidb.org/software/lemmy/versions

[–] dessalines@lemmy.ml 45 points 9 months ago (2 children)

Timing on publishing these is tricky. We let most server runners know about this ~a month ago now, and we're now 2 versions past the bug.

[–] Blaze@discuss.online 14 points 9 months ago

Interesting, thanks, I didn't know you communicated this to the admins before

[–] Zagorath@aussie.zone 10 points 9 months ago (1 children)

As far as I'm aware the most widely-accepted standard for responsible disclosure is 90 days. This is a little different, since that's normally between businesses and includes the time needed to develop a solution; it's not typically aimed at federated or self-hosted applications rolling out an already-created patch. On the one hand, granting them that extra time to upgrade seems reasonable. On the other, wouldn't anyone wanting to exploit a vulnerability be able to reverse-engineer it pretty easily by reading the git history?

I dunno where I land on this, tbh.

[–] example@reddthat.com 10 points 9 months ago

The 90 days disclosure you're referencing, which I believe is primarily popularized by Google's Project Zero process, is the time from when someone discovers and reports a vulnerability to the time it will be published by the reporter if there is no disclosure by the vendor by then.

The disclosure by the vendor to their users (people running Lemmy instances in this case) is a completely separate topic, and, depending on the context, tends to happen quite differently from vendor to vendor.

As an example, GitLab publishes security advisories the day the fixed version is released, e.g. https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/.
Some vendors will choose to release a new version, wait a few weeks or so, then publish a security advisory about issues addressed in the previous release. One company I've frequently seen this with is Atlassian. This is also what happened with Lemmy in this case.

As Lemmy is an open source project, anyone could go and review all commits for potential security impact and to determine whether something may be exploitable. This would similarly apply to any other open source project, regardless of whether the commit is pushed some time between releases or just before a release. If someone is determined enough and spends time on this they'll be able to find vulnerabilities in various projects before an advisory is published.

The "responsible" alternative for this would have been to publish an advisory at the time it was previously privately disclosed to admins of larger instances, which was right around the christmas holidays, when many people would already be preoccupied with other things in their life.

[–] gregorum@lemm.ee 9 points 9 months ago (1 children)

why haven't they upgraded yet?

[–] Blaze@discuss.online 7 points 9 months ago (2 children)

19.0 and 19.1 broke federation.

19.2 restored federation.

19.3, released this week, fixed an authentication issue.

Seems you are either non-functional or insecure

[–] dessalines@lemmy.ml 16 points 9 months ago* (last edited 9 months ago) (1 children)

Those didn't completely break federation, they just had some issues with a few services besides lemmy. They're addressed now, but federation compatibility will always be an ongoing task as new services get added and existing ones change their activitypub responses.

[–] Blaze@discuss.online 5 points 9 months ago

Happy to be past that indeed

[–] gregorum@lemm.ee 1 points 9 months ago
[–] syd@lemy.lol 3 points 9 months ago* (last edited 9 months ago)

0.18.6 would make sense TBH.