CyberRota Analysis
AI-GeneratedMastodon versions prior to 4.4.19 and from 4.5.0 to 4.5.12 are vulnerable due to a flaw in the LDAP authentication process that disables SSL and TLS certificate verification when using LDAP_TLS_NO_VERIFY=true, potentially exposing sensitive data during web requests. This high-severity vulnerability impacts users relying on secure LDAP connections and should be prioritized by organizations using affected Mastodon versions to ensure the integrity and confidentiality of their communications. Immediate upgrading to versions 4.4.19 or 4.5.12 is recommended to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldap_authenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULT_PARAMS when LDAP authentication uses LDAP_TLS_NO_VERIFY=true, disabling SSL and TLS certificate verification globally for requests made by puma web processes while sidekiq background jobs remain unaffected. This issue is fixed in versions 4.4.19 and 4.5.12.