Dear :

This is an important message about a critical information disclosure bug in Mastodon.

tl;dr: Followers-only posts may be disclosed to unintended parties, and there is no fix yet.

Long version:
The "Relationships" page (vulpine.club/relationships) allows members to remove followers, and it does this by sending a Reject Follow message to the remote instance. The remote instance is supposed to remove the follower when it receives this message.

Since October 2019, Mastodon instances have not properly handled this Reject Follow message. The upshot of this is that if you used /relationships to remove a follower on a Mastodon instance, the unfollow didn't actually happen. This means that followers-only posts may be disclosed to unintended parties.

Furthermore, this fix has to be applied to every Mastodon instance on the Fediverse before this problem stops getting worse. Also, there is currently no known way to fix this problem, because no record is kept of Reject Follow messages.

The investigation into this is still in its early stages. We will be keeping an eye on the issue (github.com/tootsuite/mastodon/) to determine the best way to clean this up.

Follow

note: we've applied the fix on our end, so we will (... should??) properly handle received Reject Follow messages henceforth

@rey Question: Is the fix related to a specific version update? Or is there a discrete patch that needs to be applied?

@chirrveon i cherry-picked bfd5aea20686559f030ca0f2538bebc1943b398b ... it's not yet in a tagged Mastodon release or in the glitch-soc tree, since it's just a few hours old

Sign in to participate in the conversation
The Vulpine Club

The Vulpine Club is a friendly and welcoming community of foxes and their associates, friends, and fans! =^^=