Skip to content

Piero Bosio Social Web Site Personale Logo Fediverso

Social Forum federato con il resto del mondo. Non contano le istanze, contano le persone
  1. Home
  2. Categories
  3. Fediverso
  4. ### Security Update: Hollo 0.6.19 Released

### Security Update: Hollo 0.6.19 Released

Fediverso
3 1 1
  • hollo@hollo.socialundefined

    Security Update: Hollo 0.6.19 Released

    We have released Hollo 0.6.19 to address a security vulnerability in Fedify's HTML parsing code.

    This vulnerability (CVE-2025-68475) is a ReDoS (Regular Expression Denial of Service) issue that could allow an attacker to cause service unavailability by sending specially crafted HTML responses during federation operations. The malicious payload is small (approximately 170 bytes) but can block the Node.js event loop for extended periods.

    We strongly recommend all Hollo operators upgrade to version 0.6.19 immediately.

    Field Details
    CVE CVE-2025-68475
    Severity High (CVSS 7.5)
    Action Upgrade to Hollo 0.6.19

    #Hollo #Security #Fediverse #ActivityPub

    1
    0
  • hollo@hollo.socialundefined

    보안 업데이트: Hollo 0.6.19 릴리스

    Fedify의 HTML 파싱 코드에서 발견된 보안 취약점을 수정한 Hollo 0.6.19를 릴리스했습니다.

    이 취약점(CVE-2025-68475)은 ReDoS(정규 표현식 서비스 거부) 문제로, 공격자가 연합 작업 중 특수하게 조작된 HTML 응답을 보내 서비스 장애를 유발할 수 있습니다. 악성 페이로드는 작지만(약 170바이트), Node.js 이벤트 루프를 장시간 차단할 수 있습니다.

    모든 Hollo 운영자분들께 즉시 버전 0.6.19로 업그레이드하실 것을 강력히 권고드립니다.

    항목 상세
    CVE CVE-2025-68475
    심각도 높음 (CVSS 7.5)
    조치 Hollo 0.6.19로 업그레이드

    #Hollo #보안 #페디버스 #연합우주 #ActivityPub

    1
    0
  • hollo@hollo.socialundefined hollo@hollo.social

    보안 업데이트: Hollo 0.6.19 릴리스

    Fedify의 HTML 파싱 코드에서 발견된 보안 취약점을 수정한 Hollo 0.6.19를 릴리스했습니다.

    이 취약점(CVE-2025-68475)은 ReDoS(정규 표현식 서비스 거부) 문제로, 공격자가 연합 작업 중 특수하게 조작된 HTML 응답을 보내 서비스 장애를 유발할 수 있습니다. 악성 페이로드는 작지만(약 170바이트), Node.js 이벤트 루프를 장시간 차단할 수 있습니다.

    모든 Hollo 운영자분들께 즉시 버전 0.6.19로 업그레이드하실 것을 강력히 권고드립니다.

    항목 상세
    CVE CVE-2025-68475
    심각도 높음 (CVSS 7.5)
    조치 Hollo 0.6.19로 업그레이드

    #Hollo #보안 #페디버스 #연합우주 #ActivityPub

    hollo@hollo.socialundefined

    セキュリティアップデート: Hollo 0.6.19 リリース

    FedifyのHTMLパースコードにおけるセキュリティ脆弱性に対応したHollo 0.6.19をリリースしました。

    この脆弱性 (CVE-2025-68475) は ReDoS (正規表現によるサービス拒否) の問題であり、攻撃者がフェデレーション操作中に特別に細工されたHTMLレスポンスを送信することで、サービス停止を引き起こす可能性があります。悪意のあるペイロードは小さい (約170バイト) ですが、Node.jsのイベントループを長時間ブロックする可能性があります。

    すべてのHollo運営者の皆様には、直ちにバージョン 0.6.19 へのアップグレードを強くお勧めします。

    項目 詳細
    CVE CVE-2025-68475
    深刻度 高 (CVSS 7.5)
    対応 Hollo 0.6.19 にアップグレード

    #Hollo #セキュリティ #fediverse #ActivityPub

    1
    0
  • hongminhee@hollo.socialundefined hongminhee@hollo.social shared this topic
Log in to reply

Feed RSS
### Security Update: Hollo 0.6.19 Released

Gli ultimi otto messaggi ricevuti dalla Federazione
@pierobosio@soc.bosio.info
Post suggeriti
  • juliesbits@c.imundefined

    Here's my first post ftom My #WordPress blog via the #ActivityPub plugin

    Moved Uncategorized wordpress activitypub
    1
    0 Votes
    1 Posts
    10 Views
    juliesbits@c.imundefined
    RE: https://funfoodlife.com/testing-activitypub/Here's my first post ftom My #WordPress blog via the #ActivityPub plugin
  • pepijn@mastodon.onlineundefined

    Hi #fediverse.

    Fediverso fediverse
    7
    0 Votes
    7 Posts
    12 Views
    pepijn@mastodon.onlineundefined
    Thanks for the comments! It's interesting to see people's experiences and how there seem to be regional and cultural differences in what people think of this.Here's a video of a chicken cosplaying as a duck. Full disclosure: no cows were hurt in the making of this video. No-one sat on the chicken.https://mastodon.online/@Pepijn/115054684910511303
  • toddsundsted@epiktistes.comundefined

    Release v2.4.15 of Ktistec

    Fediverso ktistec fediverse activitypub crystallang
    1
    0 Votes
    1 Posts
    12 Views
    toddsundsted@epiktistes.comundefined
    Experimental support for multiple users landed with Ktistec release v2.4.15. "Experimental" means that it works for me, but hasn't seen enough testing for me to call it "ready for production". With that said, it's unlikely you'll lose your data.There are lots of intentional design decisions that fit my vision for Ktistec but may surprise you. Here they are:Every user is an administrator. That doesn't mean users have access to each other's posts and data, but it does mean all users have access to the shared parts of the site—they can change the site description, for example—and they can add new users. So only add people you trust.If you want to add another user, create an account for them and give them their username and password.  There is no self-registration. There are no invitations.Beyond adding a user, there is no support for user management. You can't even boot a user from your site. Users can delete themselves, however.There is no support for content moderation. Only add people you trust.TL;DR Multi-user support in Ktistec is suitable for small teams, families (biological or chosen), and your personal avatars. There are better tools for online communities.Here's the full set of changes:AddedAdd support for multiple user accounts.FixedHide attachments behind the summary. (fixes #125)Mark actors as up after refreshing their profile.#ktistec #fediverse #activitypub #crystallang
  • qualifiedkitten@discuss.onlineundefined

    Fediverse blogging?

    Fediverso fediverse
    4
    0 Votes
    4 Posts
    27 Views
    julian@activitypub.spaceundefined
    Your blogging options with federation are: WordPress, Ghost, and WriteFreely