Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, under certain circumstances, attackers can exploit a flaw in domain name normalization to spoof domains they do not own. Versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2 contain a patch for this issue.
The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mastodon | Joinmastodon | * | 3.5.14 (excluding) |
| Mastodon | Joinmastodon | 4.0.0 (including) | 4.0.10 (excluding) |
| Mastodon | Joinmastodon | 4.1.0 (including) | 4.1.8 (excluding) |
| Mastodon | Joinmastodon | 4.2.0-beta1 (including) | 4.2.0-beta1 (including) |
| Mastodon | Joinmastodon | 4.2.0-beta2 (including) | 4.2.0-beta2 (including) |
| Mastodon | Joinmastodon | 4.2.0-beta3 (including) | 4.2.0-beta3 (including) |
| Mastodon | Joinmastodon | 4.2.0-rc1 (including) | 4.2.0-rc1 (including) |