Lemmy Release v0.19.20 - Reduced Memory Usage

What is Lemmy?

Lemmy is a self-hosted social link aggregation and discussion platform. It is completely free and open, and not controlled by any company. This means that there is no advertising, tracking, or secret algorithms. Content is organized into communities, so it is easy to subscribe to topics that you are interested in, and ignore others. Voting is used to bring the most interesting items to the top.

Changes

This release again includes numerous security fixes. Some of them are severe so admins should update as soon as possible. There are no database migrations, which means you can easily revert the upgrade if needed. In the frontend a long-standing bug with wrong link previews is fixed, plus Youtube links and .avif image embeds work now.

The most severe problem is a wrong permission check in the federation code, which allowed write actions from any instance (details will be provided later). It also fixes the emudhra CA failure by relying on sytem ca-certificates instead of builtin ones. To make this work it was necessary to remove the unmaintained webmention crate. And when connecting to the PostgreSQL database over TLS, Lemmy didn’t actually verify the certificate.

There are various problems related to IP validation, allowing an attacker to access internal services through Lemmy. One of these used NAT64/6to4/Teredo IPv6 transition to bypass the checks. For markdown image links the IP check was missing. And there was another problem: an attacker-controlled domain could resolve to an external IP at first, then resolve to an internal IP later (Time-of-check Time-of-use (TOCTOU) Race Condition). If these new checks cause problems for your setup, you can disable them with DANGER_FEDERATION_ALLOW_LOCAL_IP=1.

The markdown-it library had various problems with quadratic complexity that could lead to Denial of Service.

Finally there is some missing validation added, like when importing user settings. The nodeinfo endpoint was missing a rate limit. And junior community moderator could seize top-mod rank by re-adding a senior mod.

Full changelog:

Backend:

• Add check for federation undo_delete
• Use system ca-certificates to mitigate emudhra CA failure
• Improve IP validation
• Fix verification for delete user over federation
• Prevent caching of private RSS feeds
• Higher mod / admin check
• Use root certs for tls DB connections
• Validate IPs of markdown image links before inserting
• Adding rate_limit to feeds route.
• Add missing validations for settings import
• Upgrade dependencies

Frontend:

• Update markdown-it
• Fixing avif support.
• Add referrerpolicy to video iframe
• Fix for wrong link previews
• Upgrade dependencies
• Update dependency markdown-it to v14.2.0

Upgrade instructions

There are no breaking changes with this release.

Follow the upgrade instructions for ansible or docker.

If you need help with the upgrade, you can ask in our support forum or on the Matrix Chat.

Thanks to everyone

We’d like to thank our many contributors and users of Lemmy for coding, translating, testing, and helping find and fix bugs. We’re glad many people find it useful and enjoyable enough to contribute.

Support development

We (@dessalines and @nutomic) have been working full-time on Lemmy for over five years. This is largely thanks to support from NLnet foundation, as well as donations from individual users.

If you like using Lemmy, and want to make sure that we will always be available to work full time building it, consider donating to support its development. A recurring donation is the best way to ensure that open-source software like Lemmy can stay independent and alive, and helps us grow our little developer co-op to support more full-time developers.

• Liberapay (preferred option)
• Open Collective
• Patreon
• Cryptocurrency