jeans/home-assistant.io
jeans/home-assistant.io
1
0
Fork 0
mirror of https://github.com/home-assistant/home-assistant.io.git synced 2025-07-08 01:46:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add link to Brady

Browse Source
This commit is contained in:
Paulus Schoutsen 2021-01-24 16:00:47 +01:00 committed by GitHub
parent 7b5a4a0227
commit b5dd2a9d67
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
source/_posts/2021-01-23-security-disclosure2.markdown
View File

@ -26,7 +26,7 @@ TL;DR:
- Upgrade the custom integrations to a fixed version or remove them from your installation.
- If you have used any of the custom integrations with a known vulnerability, we recommend that you update your credentials.
On the morning of Saturday, January 23 2021, the Home Assistant project was informed by security researcher Nathan Brady about a security vulnerability. It provided more insight on the implementation of the fixes done for the [previous security vulnerability](/blog/2021/01/22/security-disclosure/). We learned that not all custom integrations that implement security patches are sufficient to deflect the problem.
On the morning of Saturday, January 23 2021, the Home Assistant project was informed by [security researcher Nathan Brady](https://twitter.com/NateBrady23) about a security vulnerability. It provided more insight on the implementation of the fixes done for the [previous security vulnerability](/blog/2021/01/22/security-disclosure/). We learned that not all custom integrations that implement security patches are sufficient to deflect the problem.
We verified all fixes made to custom integrations that were found to be vulnerable in the previous security disclosure. The conclusion is that some custom integrations are still vulnerable to a directory traversal attack while not being authenticated with Home Assistant. It allows an attacker to access any file without having to log in. This access includes any credentials that you might have stored to allow Home Assistant to access other services.