Create accountLogin

Recent searches

No recent searches

Search options

Not available on rss-mstdn.studiofreesia.com.
rss-mstdn.studiofreesia.com is part of the decentralized social network powered by Mastodon.
RSSフィードの内容を投稿するbotアカウント用のサーバーです。 アカウント登録はできませんが、リモートフォローはウェルカム🤗🤗🤗

Administered by:

Server stats:

443
active users
Learn more

rss-mstdn.studiofreesia.com: AboutProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.2.17

#Vulnerability

0 posts0 participants0 posts today
anchore

Tomorrow! Are you maximizing your Harbor registry for container security? Many enterprises trust #Harbor for artifact management, but pairing it with Anchore Enterprise unlocks deeper #vulnerability detection, #policy enforcement, & #SBOM-driven transparency.
Join Dan Perry & Josh Sopuru for a hands-on show & tell on:
🔹 Automating scans & continuous monitoring
🔹 Preventing vulnerable image deployments
🔹 Optimizing Harbor for max security
Secure your spot today! get.anchore.com/anchore-and-ha

anchore

#Harbor seamlessly integrates with #Anchore Enterprise for added transparency and security in the supply chain. In a show and well on Feb 19 our customer success engineers are demoing:
- comprehensive #vulnerability scanning and #policy enforcement for #containers
- automation of scans for continuous #monitoring
- tips for maximizing registry config security and efficiency
Register Now get.anchore.com/anchore-and-ha

Fedify: an ActivityPub server framework

We have released #security updates (1.0.14, 1.1.11, 1.2.11, 1.3.4) to address CVE-2025-23221, a #vulnerability in #Fedify's #WebFinger implementation. We recommend all users update to the latest version of their respective release series immediately.

The Vulnerability

A security researcher identified multiple security issues in Fedify's lookupWebFinger() function that could be exploited to:

  • Perform denial of service attacks through infinite redirect loops
  • Execute server-side request forgery (#SSRF) attacks via redirects to private network addresses
  • Access unintended URL schemes through redirect manipulation

Fixed Versions

  • 1.3.x series: Update to 1.3.4
  • 1.2.x series: Update to 1.2.11
  • 1.1.x series: Update to 1.1.11
  • 1.0.x series: Update to 1.0.14

Changes

The security updates implement the following fixes:

  1. Added a maximum redirect limit (5) to prevent infinite redirect loops
  2. Restricted redirects to only follow the same scheme as the original request (HTTP/HTTPS)
  3. Blocked redirects to private network addresses to prevent SSRF attacks

How to Update

To update to the latest secure version:

# For npm users
npm update @fedify/fedify

# For Deno users
deno add jsr:@fedify/fedify

We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly.

For more details about this vulnerability, please refer to our security advisory.

If you have any questions or concerns, please don't hesitate to reach out through our GitHub Discussions, join our Matrix chat space, or our Discord server.

GitHubRelease Fedify 1.0.14 · dahlia/fedifyReleased on January 21, 2025. Fixed several security vulnerabilities of the lookupWebFinger() function. [CVE-2025-23221] Fixed a security vulnerability where the lookupWebFinger() function had ...
ExploreLive feeds
About