Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
An improper uploaded media ownership check can result in inadvertent deletion of media when a user is banned with content removal or purged. This can lead to deletion of media that was not uploaded by the banned/purged user. This also applies to purged communities, in which case all media posted in that community will get deleted without proper ownership check. This is limited to media with an image/ content-type returned by pict-rs. Details Lemmy did not associate users with media uploads until version 0.19.0 (#3927). Back when the first parts of content purging were implemented for 0.17.0 (#1809), it was therefore not possible to properly identify media belonging to a specific user for situations in which this data should get erased from pict-rs, Lemmy's media storage backend. Pict-rs deduplicates uploaded files transparently. As a result, it has two types of media deletion. A regular deletion will only remove the referenced alias, and if there are not other aliases…
Recommended action: Upgrade to 0.19.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Users can report private messages, even when they're neither sender nor recipient of the message. The API response to creating a private message report contains the private message itself, which means any user can just iterate over message ids to (loudly) obtain all private messages of an instance. A user with instance admin privileges can also abuse this if the private message is removed from the response, as they're able to see the resulting reports. Details Creating a private message report by POSTing to /api/v3/privatemessage/report does not validate whether the reporter is the recipient of the message. At least lemmy-ui does not allow the sender to report the message; the API method should likely be restricted to accessible to recipients only. The API response when creating a report contains the privatemessagereportview with all the details of the report, including the private message that has been reported: <details <summaryExample response</summary In the report below,…
Recommended action: Upgrade to 0.19.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.