In the Librem One service, intended for use on the smartphone , immediately after surfaced with security, which undermines the project presented as a secure platform for ensuring privacy. The vulnerability was found in the Librem Chat service and allowed access to chat as any user, without knowledge of authentication parameters.
In the backend code of authorization via LDAP (matrix-appservice-ldap3) for the Matrix network, there was a , which was transferred to the code of the operational Librem One service. Instead of the line "result, _ = yield self._ldap_simple_bind," it was written as "result = yield self._ldap_simple_bind," which allowed any user without authorization to enter the chat under any identifier. The developers who made the mistake in the Matrix project , stated that the issue only manifested in the master branch of "matrix-appservice-ldap3," and not in the releases, but in the repository the problematic line since 2016 (it is possible that the conditions for exploiting the issue only arose after some recent changes).
The set of Librem One services put into operation implies a paid subscription ($7.99 per month or $71.91 per year), but at the same time, the existing open projects were taken as the basis for mobile clients and server handlers, which were to be distributed under the Librem brand. For example, Librem Chat is a renamed Matrix client , Librem Social is based on , Librem Mail was renamed from , Librem Tunnel was borrowed from . The server components are based on
Postfix and Dovecot for Librem Mail, for Librem Chat and for Librem Social. The reason for delivering applications under different names is stated as the desire to assemble various decentralized services based on open standards (Matrix, ActivityPub, IMAP) under one recognizable brand.
Source: opennet.ru
