The update got released over 2 months ago. So sensible admins should not be getting hit by this.

Also I use Jellyfin btw.

top 50 comments

sorted by: hot top controversial new old
[–] 2 points 13 hours ago (2 children)

Jellyfin has plenty of issues with public instances too. It's just the reality of exposing to the public internet, unless it's something that has a lot of dedicated work going into security it's going to have problems.

  • source
  • hideshow 2 child comments
  • [–] 4 points 12 hours ago (1 child)

    Could you specify any of those issues? I ask because the only one I'm tracking allows unauthenticated playback, but only if they know the path to the file on the machine which is very easy to change from default.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 6 points 1 day ago (2 children)

    My Plex is updated, and hiding behind a random-long-text-string wildcarded subdomain that (so far) has not been discovered.

    My Crowdsec intercepted 5X the normal number of hacking attempts & port scans on October 17th... no doubt from dirtbags trying to exploit this.

  • source
  • hideshow 2 child comments
  • [–] 136 points 2 days ago (36 children)

    Also I use Jellyfin btw.

    Oh god, its the new Arch isn't it...

  • source
  • hideshow 36 child comments
  • [–] 10 points 1 day ago (2 children)

    I'm waiting to see the elusive Arch, Jellyfin Vegan stack in the wild. We know they exist and they are fucking telling everyone

  • source
  • parent
  • hideshow 2 child comments
  • load more comments (30 replies)
    [–] 42 points 2 days ago (2 children)

    Sure explains why Plex was so cagey and uninformative when they emailed everyone to update their servers a couple months back. Not so much as a CVE report or change set.

    A vulnerability? No…. 4 of them. And they stack.

  • source
  • hideshow 2 child comments
  • load more comments
    view more: next ›