[Freedombox-discuss] FreedomBox Security Issue

[James Valleroy]

A security issue has been discovered in FreedomBox. Any FreedomBox
system that has non-administrator users on it is affected.

All currently supported versions are affected:

26.14 in stable-backports/testing/unstable
25.9.3+deb13u1 in stable
23.6.2+deb12u1 in oldstable

A fix is being prepared at this time. In the mean time, if you have
non-administrator users, here is a mitigation action that you can take:

In System -> Secure Shell Server, disable the option "Allow all users to
login remotely". Then, only users in the "admin" or "freedombox-ssh"
groups (or system "sudo" group) will be able to connect through SSH.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <http://alioth-lists.debian.net/pipermail/freedombox-discuss/attachments/20261101/4ac66728/attachment.sig>