{"id":32870,"date":"2019-10-31T21:49:24","date_gmt":"2019-10-31T18:49:24","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kriticheskaya-uyazvimost-v-servise-librem-one-vyyavlennaya-v-den-ego-zapuska\/"},"modified":"2019-10-31T21:49:24","modified_gmt":"2019-10-31T18:49:24","slug":"kriticheskaya-uyazvimost-v-servise-librem-one-vyyavlennaya-v-den-ego-zapuska","status":"publish","type":"post","link":"https:\/\/prohoster.info\/es\/blog\/news\/kriticheskaya-uyazvimost-v-servise-librem-one-vyyavlennaya-v-den-ego-zapuska","title":{"rendered":"Vulnerabilidad cr\u00edtica en el servicio Librem One, detectada el d\u00eda de su lanzamiento","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

En el servicio Librem One, dirigido a su uso en smartphones Librem 5<\/a><\/noindex>, inmediatamente despu\u00e9s de su lanzamiento<\/a><\/noindex> en los archivos de construcci\u00f3n de la rama experimental, y luego se traslad\u00f3 a las construcciones estables. se encontr\u00f3 un problema cr\u00edtico<\/a><\/noindex> de seguridad que deslegitima el proyecto, presentado como una plataforma segura para garantizar la privacidad. La vulnerabilidad encontrada en el servicio Librem Chat permit\u00eda acceder al chat como cualquier usuario, sin conocer los par\u00e1metros de autenticaci\u00f3n.<\/p>\n

En el c\u00f3digo utilizado del backend de autorizaci\u00f3n a trav\u00e9s de LDAP (matrix-appservice-ldap3) para la red Matrix se cometi\u00f3 un error error<\/a><\/noindex>, que se traslad\u00f3 tambi\u00e9n al c\u00f3digo del servicio funcional Librem One. En lugar de la l\u00ednea «result, _ = yield self._ldap_simple_bind» se indic\u00f3 «result = yield self._ldap_simple_bind», lo que permit\u00eda a cualquier usuario sin autorizaci\u00f3n entrar en el chat bajo cualquier identificador. Los desarrolladores del proyecto Matrix que cometieron este error afirma<\/a><\/noindex>, que el problema solo se manifestaba en la rama master «matrix-appservice-ldap3», y no en los lanzamientos, pero en el repositorio estaba la l\u00ednea problem\u00e1tica hay<\/a><\/noindex> existe desde 2016 (posiblemente las condiciones para explotar el problema solo surgieron despu\u00e9s de algunos cambios recientes).<\/p>\n

El conjunto de servicios Librem One en funcionamiento implica una suscripci\u00f3n paga ($7.99 al mes o $71.91 al a\u00f1o), pero se basa en proyectos abiertos existentes que fueron renombrados<\/a><\/noindex> para su distribuci\u00f3n bajo la marca Librem. Por ejemplo, Librem Chat es un cliente de Matrix renombrado Riot<\/a><\/noindex>, Librem Social se basa en Tusky<\/a><\/noindex>, Librem Mail se renombr\u00f3 a partir de K-9<\/a><\/noindex>, Librem Tunnel se obtuvo de Ics-openvpn<\/a><\/noindex>. Los componentes del servidor se basan en
\n Postfix y Dovecot para Librem Mail, Matrix<\/a><\/noindex> para Librem Chat y Mastodon<\/a><\/noindex> para Librem Social. La raz\u00f3n dada para suministrar aplicaciones bajo otros nombres es el deseo de agrupar diversos servicios descentralizados basados en est\u00e1ndares abiertos (Matrix, ActivityPub, IMAP) bajo una \u00fanica marca reconocible. <\/p>\n

<\/a><\/noindex><\/p>\n

Fuente: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 Librem One, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u043c \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 \u0441\u043c\u0430\u0440\u0442\u0444\u043e\u043d\u0435 Librem 5, \u0441\u0440\u0430\u0437\u0443 \u043f\u043e\u0441\u043b\u0435 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0432\u0441\u043f\u043b\u044b\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u0438\u0441\u043a\u0440\u0435\u0434\u0438\u0442\u0438\u0440\u0443\u0435\u0442 \u043f\u0440\u043e\u0435\u043a\u0442, \u043f\u0440\u0435\u043f\u043e\u0434\u043d\u043e\u0441\u0438\u043c\u044b\u0439 \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u0430\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 \u0434\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u043e\u0441\u0442\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0430\u0439\u0434\u0435\u043d\u0430 \u0432 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 Librem Chat \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u0437\u0430\u0439\u0442\u0438 \u0432 \u0447\u0430\u0442 \u043f\u043e\u0434 \u043b\u044e\u0431\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c, \u0431\u0435\u0437 \u0437\u043d\u0430\u043d\u0438\u044f \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432 \u0430\u0443\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0412 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043a\u043e\u0434\u0435 \u0431\u044d\u043a\u0435\u043d\u0434\u0430 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 LDAP (matrix-appservice-ldap3) […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-32870","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilidad cr\u00edtica en el servicio Librem One, identificada el d\u00eda de su lanzamiento | ProHoster","description":"En el servicio Librem One, dirigido a su uso en smartphones Librem 5, inmediatamente despu\u00e9s de","canonical_url":"https:\/\/prohoster.info\/es\/blog\/news\/kriticheskaya-uyazvimost-v-servise-librem-one-vyyavlennaya-v-den-ego-zapuska","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"es_ES","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 Librem One, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0432 \u0434\u0435\u043d\u044c \u0435\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430 | ProHoster","og:description":"\u0412 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 Librem One, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u043c \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 \u0441\u043c\u0430\u0440\u0442\u0444\u043e\u043d\u0435 Librem 5, \u0441\u0440\u0430\u0437\u0443 \u043f\u043e\u0441\u043b\u0435","og:url":"https:\/\/prohoster.info\/es\/blog\/news\/kriticheskaya-uyazvimost-v-servise-librem-one-vyyavlennaya-v-den-ego-zapuska","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:49:24+00:00","article:modified_time":"2019-10-31T18:49:24+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"32870","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 12:56:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:51:26","updated":"2026-01-21 12:56:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/32870","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/comments?post=32870"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/32870\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/media?parent=32870"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/categories?post=32870"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/tags?post=32870"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}