223 - Usurping Mastodon and Broken Signature Schemes

Just a few issues this week, a Mastodon normalization issue leading to the potential to impersonate another account. Then we have a more complex chain starting again with a normalization leading to a fairly interesting request smuggling (CL.0 via malformed content-type header) and cache poisoning to leak credentials. Finally a crypto issue with a signature not actually being a signature.

account bounty-podcast cache cache poisoning credentials crypto header issue leak malformed mastodon normalization podcast poisoning request request smuggling signature smuggling week