{"id":32870,"date":"2019-10-31T21:49:24","date_gmt":"2019-10-31T18:49:24","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kriticheskaya-uyazvimost-v-servise-librem-one-vyyavlennaya-v-den-ego-zapuska\/"},"modified":"2019-10-31T21:49:24","modified_gmt":"2019-10-31T18:49:24","slug":"kriticheskaya-uyazvimost-v-servise-librem-one-vyyavlennaya-v-den-ego-zapuska","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/kriticheskaya-uyazvimost-v-servise-librem-one-vyyavlennaya-v-den-ego-zapuska","title":{"rendered":"Kritisk s\u00e5rbarhed i Librem One-tjenesten, identificeret p\u00e5 dagen for lanceringen","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I Librem One-tjenesten, der er m\u00e5lrettet brug i smartphone Librem 5<\/a><\/noindex>, straks efter lanceringen<\/a><\/noindex> opstod en kritisk problem<\/a><\/noindex> med sikkerheden, som diskrediterer projektet, der pr\u00e6senteres som en beskyttet platform til at sikre privatliv. S\u00e5rbarheden blev fundet i Librem Chat-tjenesten og tillod at tilg\u00e5 chatten som enhver bruger uden kendskab til godkendelsesparametre.<\/p>\n

I den anvendte backend-kode til godkendelse via LDAP (matrix-appservice-ldap3) til Matrix-netv\u00e6rket blev der beg\u00e5et fejl<\/a><\/noindex>, som blev overf\u00f8rt til koden for den funktionelle tjeneste Librem One. I stedet for linjen «result, _ = yield self._ldap_simple_bind» var der angivet «result = yield self._ldap_simple_bind», hvilket tillod enhver bruger uden autentifikation at logge ind i chatten med enhver identifikator. De udviklere, der begik feilen, kom fra projektet Matrix h\u00e6vder<\/a><\/noindex>, at problemet kun opstod i master-grenen «matrix-appservice-ldap3», og ikke i udgivelserne, men i repository'et var den problematiske linje til stede<\/a><\/noindex> siden 2016 (muligvis opstod betingelserne for udnyttelse af problemet f\u00f8rst efter nogle andre nylige \u00e6ndringer).<\/p>\n

Det indf\u00f8rte s\u00e6t af Librem One-tjenester indeb\u00e6rer et betalt abonnement ($7,99 m\u00e5nedligt eller $71,91 \u00e5rligt), men samtidig er de mobile klienter og serverbehandlere baseret p\u00e5 eksisterende \u00e5bne projekter, som blev omd\u00f8bt<\/a><\/noindex> til distribution under Librem-m\u00e6rket. For eksempel er Librem Chat en omd\u00f8bt Matrix-klient Riot<\/a><\/noindex>, Librem Social er baseret p\u00e5 Tusky<\/a><\/noindex>, Librem Mail er omd\u00f8bt fra K-9<\/a><\/noindex>, Librem Tunnel er l\u00e5nt fra Ics-openvpn<\/a><\/noindex>. Serverkomponenterne er baseret p\u00e5
\n Postfix og Dovecot for Librem Mail, Matrix<\/a><\/noindex> for Librem Chat og Mastodon<\/a><\/noindex> for Librem Social. \u00c5rsagen til at levere applikationer under andre navne er \u00f8nsket om at samle forskellige decentrale tjenester p\u00e5 baggrund af \u00e5bne standarder (Matrix, ActivityPub, IMAP) under \u00e9n genkendelig m\u00e6rke. <\/p>\n

<\/a><\/noindex><\/p>\n

Kilde: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 Librem One, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u043c \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 \u0441\u043c\u0430\u0440\u0442\u0444\u043e\u043d\u0435 Librem 5, \u0441\u0440\u0430\u0437\u0443 \u043f\u043e\u0441\u043b\u0435 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0432\u0441\u043f\u043b\u044b\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u0438\u0441\u043a\u0440\u0435\u0434\u0438\u0442\u0438\u0440\u0443\u0435\u0442 \u043f\u0440\u043e\u0435\u043a\u0442, \u043f\u0440\u0435\u043f\u043e\u0434\u043d\u043e\u0441\u0438\u043c\u044b\u0439 \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u0430\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 \u0434\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u043e\u0441\u0442\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0430\u0439\u0434\u0435\u043d\u0430 \u0432 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 Librem Chat \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u0437\u0430\u0439\u0442\u0438 \u0432 \u0447\u0430\u0442 \u043f\u043e\u0434 \u043b\u044e\u0431\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c, \u0431\u0435\u0437 \u0437\u043d\u0430\u043d\u0438\u044f \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432 \u0430\u0443\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0412 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043a\u043e\u0434\u0435 \u0431\u044d\u043a\u0435\u043d\u0434\u0430 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 LDAP (matrix-appservice-ldap3) […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-32870","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kritisk s\u00e5rbarhed i Librem One-tjenesten, identificeret p\u00e5 dagen for lanceringen | ProHoster","description":"I Librem One-tjenesten, der er m\u00e5lrettet brug i smartphone Librem 5, straks efter","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/kriticheskaya-uyazvimost-v-servise-librem-one-vyyavlennaya-v-den-ego-zapuska","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 Librem One, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0432 \u0434\u0435\u043d\u044c \u0435\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430 | ProHoster","og:description":"\u0412 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 Librem One, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u043c \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 \u0441\u043c\u0430\u0440\u0442\u0444\u043e\u043d\u0435 Librem 5, \u0441\u0440\u0430\u0437\u0443 \u043f\u043e\u0441\u043b\u0435","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/kriticheskaya-uyazvimost-v-servise-librem-one-vyyavlennaya-v-den-ego-zapuska","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:49:24+00:00","article:modified_time":"2019-10-31T18:49:24+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"32870","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 12:56:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:51:26","updated":"2026-01-21 12:56:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/32870","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=32870"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/32870\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=32870"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=32870"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=32870"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}