FreedomBox Security Issue

Announcements
1

A security issue has been discovered in FreedomBox. Any FreedomBox system that has non-administrator users on it is affected.

All currently supported versions are affected:

  • 26.14 in stable-backports/testing/unstable
  • 25.9.3+deb13u1 in stable
  • 23.6.2+deb12u1 in oldstable

A fix is being prepared at this time. In the mean time, if you have non-administrator users, here is a mitigation action that you can take:

In System → Secure Shell Server, disable the option “Allow all users to login remotely”. Then, only users in the “admin” or “freedombox-ssh” groups (or system “sudo” group) will be able to connect through SSH.

3 Likes
2

Thanks for sharing that. Here’s a screen shot of the configuration page in https://myfreedombox/freedombox/sys/ssh

image
image1320×421 39.3 KB