Qhov teeb meem tseem ceeb (CVE-2023-27482) tau raug txheeb xyuas nyob rau hauv qhov qhib lub tsev automation platform Home Assistant, uas tso cai rau koj hla kev lees paub thiab tau txais kev nkag mus rau tag nrho cov cai tswj hwm API, uas koj tuaj yeem hloov chaw, nruab / hloov kho software, tswj add-ons thiab backups.
Qhov teeb meem cuam tshuam rau kev teeb tsa uas siv Tus Thawj Saib Xyuas Kev Tiv Thaiv thiab tau tshwm sim txij li nws thawj zaug tso tawm (txij li xyoo 2017). Piv txwv li, qhov muaj qhov tsis zoo nyob hauv Tsev Pabcuam OS thiab Tsev Pabcuam Saib Xyuas Tsev, tab sis tsis cuam tshuam rau Home Assistant Container (Docker) thiab manually tsim Python ib puag ncig raws li Home Assistant Core.
Qhov tsis zoo yog kho nyob rau hauv Tsev Pabcuam Tus Saib Xyuas Tsev version 2023.01.1. Ib qho kev daws teeb meem ntxiv tau suav nrog hauv Tsev Pabcuam 2023.3.0 tso tawm. Ntawm cov tshuab uas nws tsis tuaj yeem nruab qhov hloov tshiab los thaiv qhov tsis muaj qhov tsis zoo, koj tuaj yeem txwv kev nkag mus rau lub network chaw nres nkoj ntawm Home Assistant qhov kev pabcuam web los ntawm lwm lub network.
Cov txheej txheem ntawm kev siv qhov tsis zoo tseem tsis tau piav qhia (raws li cov neeg tsim khoom, kwv yees li 1/3 ntawm cov neeg siv tau teeb tsa qhov hloov tshiab thiab ntau lub tshuab tseem muaj qhov tsis zoo). Hauv kev kho kom raug, raws li kev ua kom zoo, kev hloov pauv tau ua rau kev ua cov tokens thiab cov lus nug proxied, thiab cov ntxaij lim dej tau ntxiv los thaiv qhov hloov pauv ntawm SQL queries thiab ntxig rau " Β» ΠΈ ΠΈΡΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°Π½ΠΈΡ ΠΏΡΡΠ΅ΠΉ Ρ Β«../Β» ΠΈ Β«/./Β».
Tau qhov twg los: opennet.ru