[<prev] [<thread-prev] [day] [month] [year] [list]
Message-ID: <c64de78736f4c74f1185db288e23fcf716b335a8.camel@sambull.org>
Date: Fri, 27 Sep 2024 16:48:25 +0100
From: Sam Bull <9m199i@...bull.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2024-40761: Apache Answer: Avatar URL leaked
user email addresses
For WordPress websites that I host, I have code which caches the gravatar images on the
server and serves them directly.
My main goal was to disallow Gravatar tracking users across our websites (enforced with a
Content-Security-Policy in addition to rewriting the image URLs). But, it does also
rewrite the hashes used when served to the client. So, this could be used to avoid leaking
user addresses.
Not sure if that can apply to this software as well, but thought it was worth noting.
Sam
Download attachment "signature.asc" of type "application/pgp-signature" (196 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
