GOSSIP USERS: SECURITY ALERT
There is an UNPATCHED vulnerability in libwebp that allows a malicious image to infect your computer. This affects gossip, as well as countless other programs.
Normally we wouldn't announce an active vulnerability until it is patched and there is a solution, but this news is already widespread.
Please go to your settings and uncheck "Render all media inline automatically". Only click to view media from people you trust.
We are working towards a better understanding of this, and a fix.
Please coorespond with M. Dilger (npub1acg…p35c) as this account is only used for announcements and is not watched.
Related security alerts:
https://nvd.nist.gov/vuln/detail/CVE-2023-4863
More info
https://www.tenable.com/blog/cve-2023-41064-cve-2023-4863-cve-2023-5129-faq-imageio-webp-zero-days
https://arstechnica.com/security/2023/09/incomplete-disclosures-by-apple-and-google-create-huge-blindspot-for-0-day-hunters/
Gossip Client /
npub189…r3tg8
2023-09-28 21:04:13
Author Public Key
npub189j8y280mhezlp98ecmdzydn0r8970g4hpqpx3u9tcztynywfczqqr3tg8Published at
2023-09-28 21:04:13Event JSON
{
"id": "46dded0af83b7be680c7691c2b74ffb9b702ff4b628cbe4fa001a96d85f9dffe",
"pubkey": "39647228efddf22f84a7ce36d111b378ce5f3d15b8401347855e04b24c8e4e04",
"created_at": 1695935053,
"kind": 1,
"tags": [
[
"p",
"ee11a5dff40c19a555f41fe42b48f00e618c91225622ae37b6c2bb67b76c4e49"
]
],
"content": "GOSSIP USERS: SECURITY ALERT\n\nThere is an UNPATCHED vulnerability in libwebp that allows a malicious image to infect your computer. This affects gossip, as well as countless other programs.\nNormally we wouldn't announce an active vulnerability until it is patched and there is a solution, but this news is already widespread.\n\nPlease go to your settings and uncheck \"Render all media inline automatically\". Only click to view media from people you trust.\n\nWe are working towards a better understanding of this, and a fix.\n\nPlease coorespond with nostr:npub1acg6thl5psv62405rljzkj8spesceyfz2c32udakc2ak0dmvfeyse9p35c as this account is only used for announcements and is not watched.\n\nRelated security alerts:\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-4863\n\nMore info\nhttps://www.tenable.com/blog/cve-2023-41064-cve-2023-4863-cve-2023-5129-faq-imageio-webp-zero-days\nhttps://arstechnica.com/security/2023/09/incomplete-disclosures-by-apple-and-google-create-huge-blindspot-for-0-day-hunters/ \n\n",
"sig": "da4d9d46632943a10491989f99e850e2d282eaae9e6927e6155e8be202a11d16e16436b64fb22d0deb679142f0d1a31d647b695b73fccb42caf7a89b35f50369"
}