@galaxis@mastodon.infra.de cover
@galaxis@mastodon.infra.de avatar

galaxis

@galaxis@mastodon.infra.de

generic computer and internetworking geek

network and systems administration, infosec, retrocomputing

#nobot #noindex #nobridge #noai

This profile is from a federated server and may be incomplete. For a complete list of posts, browse on the original instance.

GossiTheDog , to random
@GossiTheDog@cyberplace.social avatar

I think CVE-2024-29510 (Ghostscript vuln) may apply to Mastodon, as Mastodon sends images to ImageMagick, which can call Ghostscript. But I might be wrong.

galaxis ,
@galaxis@mastodon.infra.de avatar

@GossiTheDog Hrm. While the imagemagick-6.q16 package (on Debian) recommends ghostscript (and it is installed on my Mastodon instance), there's no hard dependency. I don't think Mastodon deals with any file formats that require ghostscript processing? Certainly not pdf or ps...

Should be safe to uninstall when it's considered a possible attack vector...

galaxis ,
@galaxis@mastodon.infra.de avatar

@h3artbl33d Yeah, in the worst case, reprocessing some media would fail, so I took the opportunity to nuke it from this install.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • random
  • test
  • worldmews
  • mews
  • All magazines
    •