Skip to content

Piero Bosio Social Web Site Personale Logo Fediverso

Social Forum federato con il resto del mondo. Non contano le istanze, contano le persone
  1. Home
  2. Categories
  3. Fediverso
  4. ### Security Update: Hollo 0.6.19 Released

### Security Update: Hollo 0.6.19 Released

Fediverso
3 1 1
  • hollo@hollo.socialundefined

    Security Update: Hollo 0.6.19 Released

    We have released Hollo 0.6.19 to address a security vulnerability in Fedify's HTML parsing code.

    This vulnerability (CVE-2025-68475) is a ReDoS (Regular Expression Denial of Service) issue that could allow an attacker to cause service unavailability by sending specially crafted HTML responses during federation operations. The malicious payload is small (approximately 170 bytes) but can block the Node.js event loop for extended periods.

    We strongly recommend all Hollo operators upgrade to version 0.6.19 immediately.

    Field Details
    CVE CVE-2025-68475
    Severity High (CVSS 7.5)
    Action Upgrade to Hollo 0.6.19

    #Hollo #Security #Fediverse #ActivityPub

    1
    0
  • hollo@hollo.socialundefined

    보안 업데이트: Hollo 0.6.19 릴리스

    Fedify의 HTML 파싱 코드에서 발견된 보안 취약점을 수정한 Hollo 0.6.19를 릴리스했습니다.

    이 취약점(CVE-2025-68475)은 ReDoS(정규 표현식 서비스 거부) 문제로, 공격자가 연합 작업 중 특수하게 조작된 HTML 응답을 보내 서비스 장애를 유발할 수 있습니다. 악성 페이로드는 작지만(약 170바이트), Node.js 이벤트 루프를 장시간 차단할 수 있습니다.

    모든 Hollo 운영자분들께 즉시 버전 0.6.19로 업그레이드하실 것을 강력히 권고드립니다.

    항목 상세
    CVE CVE-2025-68475
    심각도 높음 (CVSS 7.5)
    조치 Hollo 0.6.19로 업그레이드

    #Hollo #보안 #페디버스 #연합우주 #ActivityPub

    1
    0
  • hollo@hollo.socialundefined hollo@hollo.social

    보안 업데이트: Hollo 0.6.19 릴리스

    Fedify의 HTML 파싱 코드에서 발견된 보안 취약점을 수정한 Hollo 0.6.19를 릴리스했습니다.

    이 취약점(CVE-2025-68475)은 ReDoS(정규 표현식 서비스 거부) 문제로, 공격자가 연합 작업 중 특수하게 조작된 HTML 응답을 보내 서비스 장애를 유발할 수 있습니다. 악성 페이로드는 작지만(약 170바이트), Node.js 이벤트 루프를 장시간 차단할 수 있습니다.

    모든 Hollo 운영자분들께 즉시 버전 0.6.19로 업그레이드하실 것을 강력히 권고드립니다.

    항목 상세
    CVE CVE-2025-68475
    심각도 높음 (CVSS 7.5)
    조치 Hollo 0.6.19로 업그레이드

    #Hollo #보안 #페디버스 #연합우주 #ActivityPub

    hollo@hollo.socialundefined

    セキュリティアップデート: Hollo 0.6.19 リリース

    FedifyのHTMLパースコードにおけるセキュリティ脆弱性に対応したHollo 0.6.19をリリースしました。

    この脆弱性 (CVE-2025-68475) は ReDoS (正規表現によるサービス拒否) の問題であり、攻撃者がフェデレーション操作中に特別に細工されたHTMLレスポンスを送信することで、サービス停止を引き起こす可能性があります。悪意のあるペイロードは小さい (約170バイト) ですが、Node.jsのイベントループを長時間ブロックする可能性があります。

    すべてのHollo運営者の皆様には、直ちにバージョン 0.6.19 へのアップグレードを強くお勧めします。

    項目 詳細
    CVE CVE-2025-68475
    深刻度 高 (CVSS 7.5)
    対応 Hollo 0.6.19 にアップグレード

    #Hollo #セキュリティ #fediverse #ActivityPub

    1
    0
  • hongminhee@hollo.socialundefined hongminhee@hollo.social shared this topic
Log in to reply

Feed RSS
### Security Update: Hollo 0.6.19 Released

Gli ultimi otto messaggi ricevuti dalla Federazione
@pierobosio@soc.bosio.info
Post suggeriti
  • mobileatom@flipboard.comundefined

    Is Pixelfed sawing off the branch that the Fediverse is sitting on?

    General Discussion activitypub pixelfed
    2
    0 Votes
    2 Posts
    11 Views
    informapirata@activitypub.spaceundefined
    mobileatom@flipboard.com You've touched on a very interesting point. By the way, I've never figured out whether your Flipboard account will ever be able to see my reply, and to be honest, I'd be very curious to know what a Flipboard user sees when they receive a reply from the free Fediverse... Returning to your observation, I see the Fediverse as an integrated ecosystem, but integration doesn't always have to be symmetrical. [image: 1764879043010-31741512-04f3-4c0f-99f0-8314a4498402-image.png] To put it simply, Bookwyrm users and Peertube users aren't interested in viewing content from other social networks! In the Fediverse, there are programs that focus on one of the three areas in the image above, and programs that occupy two or more reference areas. For example, I find the fact that Mobilizon users can't see Friendica events much more problematic than the shortcoming you noted on Pixelfed... Pixelfed certainly "looks" like a social network, but it's primarily a place where users share their "personal art galleries." While I'm not a fan of dansup@mastodon.social, I recognize that he's making great strides to increase the interoperability of his creation, and Pixelfed has grown better than any other software in the Fediverse on three key levels: improving interoperability creating a beautiful and ergonomic app brand identity I'm sure he'll find a way to make text content visible in the future, but honestly, right now, it doesn't seem like a priority for Pixelfed's development and success. That said, your observations are a very interesting starting point for the development of software and interfaces in the Fediverse.
  • privacydigest@mas.toundefined

    We’re Doubling Down on #DigitalRights.

    Uncategorized security privacy donation rights surveillance encryption freedom authoritarian
    1
    0 Votes
    1 Posts
    5 Views
    privacydigest@mas.toundefined
    We’re Doubling Down on #DigitalRights. You Can, Too.Technology can uplift #democracy , or it can be an #authoritarian weapon. @eff is making sure it stays on the side of #freedom. We’re defending #encryption , exposing abusive #surveillance tech, fighting government overreach, and standing up for free expression. But we need your help to protect digital #rights —and right now, your #donation will be matched dollar-for-dollar.#privacy #securityhttps://www.eff.org/deeplinks/2025/11/power-your-donation-week
  • evanprodromou@socialwebfoundation.orgundefined

    Interview with John O’Nolan about Ghost 6

    Social Web Foundation activitypub ghost ghostorg ghost6 implementer johnonolan longformtext release
    1
    1
    0 Votes
    1 Posts
    15 Views
    evanprodromou@socialwebfoundation.orgundefined
    We were excited to see the recent release of Ghost 6 with ActivityPub features. The Ghost team have been an active participant in our Long-form Text project. John O’Nolan, founder and CEO of Ghost.org, was kind enough to answer our questions about the software and its community.SWF: For our readers who don’t know Ghost, how would you describe the platform?JO: Ghost is an independent publishing platform for people who take writing seriously. We’re open source, non-profit, and built to give creators complete ownership of their content and their audience. We’ve helped indie publishers generate over $100 million in revenue from sustainable modern media businesses like 404Media, Platformer and Tangle News.SWF: Tell us about your user community. Can you paint a picture of them with a broad brush? What kind of people choose Ghost?JO: Ghost attracts people who care about owning their home on the internet, rather than having another profile on a social media platform. Our publishers range from solo journalists and creators, to established news outlets and large businesses. They value independence, and they’re willing to do the work to maintain control of their brand, distribution, data, and relationship with readers.SWF: What is it like to be a Ghost user in 2025? What kind of problems are your users facing today?JO: The big challenge today is the same one that’s haunted independent publishers for two decades: discovery. You can own your platform and serve your audience beautifully, but if people can’t find you, none of it matters. Email newsletters have been a solid answer, but they’re still dependent on deliverability and inbox placement. Algorithms on social platforms actively suppress links now, so sharing your work there is like shouting into a hurricane.SWF: Tell us about your experience with ActivityPub. Why did you decide to add ActivityPub support to your software?JO: Ghost has had support for delivering content by email newsletters for a number of years, and email has remained an unassailable distribution platform for publishers because it’s an open protocol. No company controls your email list except you, so it’s one of the best investments you can make. ActivityPub is now doing the same thing for social technology. It allows publishers to own and control a distribution channel that allows their work to spread and be discovered by others. For the first time, you can publish independently and grow faster than ever before.SWF: What stack is Ghost built on? What development tools does your team use?JO: Ghost is all built in modern JavaScript; mainly Node and React. Our ActivityPub service is built on Fedify, and everything we build is released under an open source MIT license. Our development tools are constantly evolving, and now more quickly than ever before with the advent of AI tools, which seem to change on a near weekly basis.SWF: What was the development process like?JO: Challenging, honestly. ActivityPub is beautifully designed but the spec leaves room for interpretation, and when you’re building something new, there’s no roadmap. Building interoperability between other platforms, who’ve all interpreted the spec in their own unique ways, has been a real challenge. The approach we took was to ship early versions as quickly as possible to beta testers so we could learn as we go, using real-world data and issues to guide our process. We’re in a good spot, now, but there’s still a lot to do!SWF: Ghost produces long-form blog posts, articles and newsletters. How was the experience adapting Ghost articles to the microblogging interfaces of Mastodon and Threads?JO: In some ways really easy, and in other ways quite tricky. We’re at a pretty early stage for long-form content on ActivityPub, and the majority of other products out there don’t necessarily have interfaces for supporting it yet. The easy part is that we can provide fallbacks, so if you’re scrolling on Mastodon you might see an article title and excerpt, with a link to read the full post – and that works pretty well! The dream, though, is to make it so you can just consume the full article within whatever app you happen to be using, and doing that requires more collaboration between different platforms to agree on how to make that possible.SWF: You’ve been an active participant in the ActivityPub community since you decided to implement the standard. Why?JO: ActivityPub is a movement as much as a technology protocol, and behind it is a group of people who all believe in making the web a weird, wonderful open place for collaboration. Getting to know those humans and being a part of that movement has been every bit as important to the success of our work as writing the code that powers our software. We’ve received incredible support from the Mastodon team, AP spec authors, and other platforms who are building ActivityPub support. Without actively participating in the community, I don’t know if we would’ve gotten as far as we have already. SWF: Ghost has implemented not only a publishing interface, but also a reading experience. Why?JO: The big difference between ActivityPub and email is that it’s a 2-way protocol. When you send an email newsletter, that’s it. You’re done. But with ActivityPub, it’s possible to achieve what – in the olden days – we fondly referred to as ‘the blogosphere’. People all over the world writing and reading each other’s work. If an email newsletter is like standing on a stage giving a keynote to an audience, participating in a network is more like mingling at the afterparty. You can’t just talk the whole time, you have to listen, too. Being successful within the context of a network has always involved following and engaging with others, as peers, so it felt really important to make sure that we brought that aspect into the product.SWF: Your reader is, frankly, one of the most interesting UIs for ActivityPub we’ve seen. Tell us about why you put the time and effort into making a beautiful reading experience for Ghost.JO: We didn’t want to just tick the “ActivityPub support” checkbox – we wanted to create something that actually feels great to use every day. The idea was to bring some of the product ideas over from RSS readers and kindles, where people currently consume long-form content, and use them as the basis for an ActivityPub-native reading experience. We experimented with multiple different approaches to try and create an experience with a mix of familiarity and novelty. People intuitively understand a list of articles and a view for opening and reading them, but then when you start to see inline replies and live notifications happening around those stories – suddenly it feels like something new and different. SWF: If people want to get a taste of the kind of content Ghost publishers produce, what are some good examples to follow?JO: Tough question! There are so many out there, and it really depends on what you’re into. The best place to start would be on ghost.org/explore – when you can browse through all sorts of different categories of creators and content, and explore the things that interest you the most. SWF: If I’m a Fediverse enthusiast, what can I do to help make Ghost 6 a success?JO: Follow Ghost publishers and engage with their content – likes, replies, reposts all help! Most importantly, help us spread the word about what’s possible when platforms collaborate rather than compete. And if you’re technical, our ActivityPub implementation is entirely open source on GitHub – contributions, bug reports, and feedback make the whole ecosystem stronger.
  • nekoprogram@tkz.oneundefined

    Uy... 👀 Interesante...'n> Change the identifiers used in ActivityPub to numeric IDs (instead of their username) for new users.

    Fediverso mastodon activitypub fediverso fedi fediverse
    1
    1 Votes
    1 Posts
    18 Views
    nekoprogram@tkz.oneundefined
    RE: https://mastodon.social/@MastodonEngineering/115337952873418574Uy... 👀 Interesante...> Change the identifiers used in ActivityPub to numeric IDs (instead of their username) for new users. This is a first step towards allowing account renaming. — Github PR #32724 (by ClearlyClaire)#mastodon #activitypub #fediverso #fedi #fediverse