{"id":32870,"date":"2019-10-31T21:49:24","date_gmt":"2019-10-31T18:49:24","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kriticheskaya-uyazvimost-v-servise-librem-one-vyyavlennaya-v-den-ego-zapuska\/"},"modified":"2019-10-31T21:49:24","modified_gmt":"2019-10-31T18:49:24","slug":"kriticheskaya-uyazvimost-v-servise-librem-one-vyyavlennaya-v-den-ego-zapuska","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/kriticheskaya-uyazvimost-v-servise-librem-one-vyyavlennaya-v-den-ego-zapuska","title":{"rendered":"A critical vulnerability in the Librem One service, discovered on the day of its launch","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

In the Librem One service, intended for use on the smartphone Librem 5<\/a><\/noindex>, immediately after launch<\/a><\/noindex> surfaced a critical issue<\/a><\/noindex> with security, which undermines the project presented as a secure platform for ensuring privacy. The vulnerability was found in the Librem Chat service and allowed access to chat as any user, without knowledge of authentication parameters.<\/p>\n

In the backend code of authorization via LDAP (matrix-appservice-ldap3) for the Matrix network, there was a error<\/a><\/noindex>, which was also transferred to the code of the Librem One service. Instead of the line «result, _ = yield self._ldap_simple_bind», it was indicated as «result = yield self._ldap_simple_bind», allowing any user without authorization to enter the chat under any identifier. The developers of the Matrix project who made the error claim<\/a><\/noindex>, the issue only occurred in the master branch «matrix-appservice-ldap3», and not in the releases, but the problematic line remained in the repository has been present<\/a><\/noindex> since 2016 (it is possible that the conditions for exploiting the issue only arose after some recent changes).<\/p>\n

The set of Librem One services put into operation implies a paid subscription ($7.99 per month or $71.91 per year), but at the same time, the existing open projects were taken as the basis for mobile clients and server handlers, which were renamed<\/a><\/noindex> to be distributed under the Librem brand. For example, Librem Chat is a renamed Matrix client Riot<\/a><\/noindex>, Librem Social is based on Tusky<\/a><\/noindex>, Librem Mail was renamed from K-9<\/a><\/noindex>, Librem Tunnel was borrowed from Ics-openvpn<\/a><\/noindex>. The server components are based on
\n Postfix and Dovecot for Librem Mail, Matrix<\/a><\/noindex> for Librem Chat and Mastodon<\/a><\/noindex> for Librem Social. The reason for delivering applications under different names is stated as the desire to assemble various decentralized services based on open standards (Matrix, ActivityPub, IMAP) under one recognizable brand. <\/p>\n

<\/a><\/noindex><\/p>\n

Source: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 Librem One, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u043c \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 \u0441\u043c\u0430\u0440\u0442\u0444\u043e\u043d\u0435 Librem 5, \u0441\u0440\u0430\u0437\u0443 \u043f\u043e\u0441\u043b\u0435 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0432\u0441\u043f\u043b\u044b\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u0438\u0441\u043a\u0440\u0435\u0434\u0438\u0442\u0438\u0440\u0443\u0435\u0442 \u043f\u0440\u043e\u0435\u043a\u0442, \u043f\u0440\u0435\u043f\u043e\u0434\u043d\u043e\u0441\u0438\u043c\u044b\u0439 \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u0430\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 \u0434\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u043e\u0441\u0442\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0430\u0439\u0434\u0435\u043d\u0430 \u0432 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 Librem Chat \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u0437\u0430\u0439\u0442\u0438 \u0432 \u0447\u0430\u0442 \u043f\u043e\u0434 \u043b\u044e\u0431\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c, \u0431\u0435\u0437 \u0437\u043d\u0430\u043d\u0438\u044f \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432 \u0430\u0443\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0412 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043a\u043e\u0434\u0435 \u0431\u044d\u043a\u0435\u043d\u0434\u0430 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 LDAP (matrix-appservice-ldap3) […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-32870","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A critical vulnerability in the Librem One service, discovered on the day of its launch | ProHoster","description":"In the Librem One service, intended for use on the Librem 5 smartphone, immediately after","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/kriticheskaya-uyazvimost-v-servise-librem-one-vyyavlennaya-v-den-ego-zapuska","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 Librem One, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0432 \u0434\u0435\u043d\u044c \u0435\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430 | ProHoster","og:description":"\u0412 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 Librem One, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u043c \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 \u0441\u043c\u0430\u0440\u0442\u0444\u043e\u043d\u0435 Librem 5, \u0441\u0440\u0430\u0437\u0443 \u043f\u043e\u0441\u043b\u0435","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/kriticheskaya-uyazvimost-v-servise-librem-one-vyyavlennaya-v-den-ego-zapuska","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:49:24+00:00","article:modified_time":"2019-10-31T18:49:24+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"32870","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 12:56:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:51:26","updated":"2026-01-21 12:56:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/32870","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=32870"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/32870\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=32870"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=32870"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=32870"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}