Rust dilind\u0259 yaz\u0131lm\u0131\u015f async-tar kitabxanas\u0131nda tar arxivl\u0259rinin oxunmas\u0131 v\u0259 yaz\u0131lmas\u0131 \u00fc\u00e7\u00fcn funksiyalar t\u0259qdim ed\u0259n bir z\u0259iflik a\u015fkar edilib (CVE-2025-62518, kod ad\u0131 TARmageddon). Bu z\u0259iflik, x\u00fcsusi haz\u0131rlanm\u0131\u015f tar arxivini a\u00e7ark\u0259n yaln\u0131z orada olan fayllar\u0131 \u00e7\u0131xarma\u011fa de\u011fil, h\u0259m d\u0259 daxil edilmi\u015f tar arxivind\u0259ki fayllar\u0131 \u00e7\u0131xarma\u011fa imkan verir. Z\u0259iflik, arxivl\u0259rin do\u011frulama sisteml\u0259rini a\u015fmaq v\u0259 yoxlan\u0131lmayan fayllar\u0131 \u00e7\u0131xarmaq \u00fc\u00e7\u00fcn istifad\u0259 oluna bil\u0259r. <\/p>\n
Z\u0259iflik, async-tar kitabxanas\u0131n\u0131n forklarda, m\u0259s\u0259l\u0259n, tokio-tar, krata-tokio-tar v\u0259 astral-tokio-tar-da, el\u0259c\u0259 d\u0259 onlar\u0131n \u0259sas\u0131nda olan utilitl\u0259rd\u0259, m\u0259s\u0259l\u0259n, Python layih\u0259l\u0259ri \u00fc\u00e7\u00fcn 'pip' \u0259v\u0259zind\u0259 y\u00fcks\u0259k performansl\u0131 paket meneceri olan uv-d\u0259 d\u0259 \u00f6z\u00fcn\u00fc g\u00f6st\u0259rir. Z\u0259if kitabxanalardan istifad\u0259 ed\u0259n populyar layih\u0259l\u0259r aras\u0131nda docker konteynerl\u0259rini i\u015f\u0259 salmaq \u00fc\u00e7\u00fcn testcontainers al\u0259tl\u0259ri v\u0259 WebAssembly runtime wasmCloud da qeyd edilir. crates.is depozitind\u0259 son 90 g\u00fcn \u0259rzind\u0259 async-tar kitabxanas\u0131 1.3 milyon y\u00fckl\u0259m\u0259, tokio-tar - 2.2 milyon, testcontainers - 2.9 milyon y\u00fckl\u0259m\u0259 ya\u015fay\u0131b. <\/p>\n
Z\u0259iflik, ustar v\u0259 PAX ba\u015fl\u0131qlar\u0131nda m\u00fcxt\u0259lif \u00f6l\u00e7\u00fc d\u0259y\u0259rl\u0259ri ayr\u0131\u015ft\u0131r\u0131lark\u0259n yanl\u0131\u015f m\u00f6vqe se\u00e7ilm\u0259si il\u0259 ba\u011fl\u0131d\u0131r. PAX format\u0131nda tar arxivl\u0259rind\u0259 h\u0259r bir fayl \u00fc\u00e7\u00fcn iki ba\u015fl\u0131q - klassik ustar v\u0259 geni\u015fl\u0259nmi\u015f PAX - g\u00f6st\u0259rilir. Problem, z\u0259if kitabxanalar\u0131n fayllar\u0131 a\u00e7ark\u0259n, PAX geni\u015fl\u0259ndirilmi\u015f ba\u015fl\u0131\u011f\u0131ndan \u00f6l\u00e7\u00fc \u0259saslanaraq offseti hesablamaq \u0259v\u0259zin\u0259, k\u00f6hn\u0259lmi\u015f ustar ba\u015fl\u0131\u011f\u0131ndan \u00f6l\u00e7\u00fc g\u00f6t\u00fcrm\u0259l\u0259rind\u0259n qaynaqlan\u0131r. Ustar ba\u015fl\u0131\u011f\u0131nda \u00f6l\u00e7\u00fc s\u0131f\u0131r oldu\u011fu zaman, onu izl\u0259y\u0259n fayl\u0131n m\u0259zmunu, n\u00f6vb\u0259ti fayl \u00fc\u00e7\u00fcn d\u00fczg\u00fcn TAR ba\u015fl\u0131q bloku kimi emal edilirdi.
<\/center>
<\/center> <\/p>\n
H\u00fccum etm\u0259k \u00fc\u00e7\u00fcn yaln\u0131z ustar ba\u015fl\u0131\u011f\u0131nda s\u0131f\u0131r \u00f6l\u00e7\u00fc g\u00f6st\u0259ril\u0259n v\u0259 PAX format\u0131 ba\u015fl\u0131\u011f\u0131nda aktual \u00f6l\u00e7\u00fc olan bir TAR arxivi yaratmaq kifay\u0259tdir, bu da ba\u015fqa bir tar arxivinin fayl\u0131n\u0131 \u0259sas arxivin bir hiss\u0259si olaraq i\u015fl\u0259nm\u0259sin\u0259 s\u0259b\u0259b olur. Bu c\u00fcr arxivl\u0259rin yarad\u0131lmas\u0131 \u00fc\u00e7\u00fcn kod n\u00fcmun\u0259si GitHub-da yerl\u0259\u015fdirilib. Z\u0259iflik, tokio-tar 0.5.6 v\u0259 uv 0.9.5 versiyalar\u0131nda aradan qald\u0131r\u0131l\u0131b. Qalan kitabxanalar \u00fc\u00e7\u00fcn h\u0259l\u0259 t\u0259mir yoxdur, lakin astral-tokio-tar, async-tar v\u0259 krata-tokio-tar \u00fc\u00e7\u00fcn ayr\u0131ca d\u00fcz\u0259li\u015fl\u0259r haz\u0131rlan\u0131b. <\/p>\n
Kitabxanalardak\u0131 z\u0259iflikl\u0259r\u0259 10-dan 8.1 t\u0259hl\u00fck\u0259 s\u0259viyy\u0259si verilib, \u00e7\u00fcnki bu problem a\u00e7\u0131lan fayllar\u0131n yenid\u0259n yaz\u0131lmas\u0131na istifad\u0259 oluna bil\u0259r (z\u0259if n\u00fcmun\u0259l\u0259rd\u0259 a\u00e7\u0131lan fayllar arxivd\u0259 g\u00f6r\u00fcn\u0259nl\u0259rd\u0259n f\u0259rqli olacaq). Eyni zamanda, uv paket menecerind\u0259ki z\u0259iflik t\u0259hl\u00fck\u0259siz hesab olunur, \u00e7\u00fcnki \u0259g\u0259r h\u00fccum ed\u0259n orijinal arxivin m\u0259zmununa t\u0259sir ed\u0259 bilirs\u0259, daha m\u00fcr\u0259kk\u0259b bir h\u00fccum t\u0259\u015fkil etm\u0259y\u0259 v\u0259 daxil olan arxiv vasit\u0259sil\u0259 z\u0259iflikd\u0259n istifad\u0259 etm\u0259y\u0259 ehtiyac yoxdur; \u0259sas arxivind\u0259 toplanma s\u0259hn\u0259cikl\u0259ri vasit\u0259sil\u0259 kodun icras\u0131na nail olmaq daha asand\u0131r. <\/p>\n
Z\u0259ifliyi a\u015fkarlayan ara\u015fd\u0131rma\u00e7\u0131lar, t\u0259hl\u00fck\u0259sizlik yoxlamalar\u0131n\u0131 a\u015fmaq v\u0259 konfiqurasiya fayllar\u0131n\u0131 d\u0259yi\u015fdirm\u0259k v\u0259 ya tikinti prosesin\u0259 m\u00fcdaxil\u0259 etm\u0259kl\u0259 kodun icras\u0131n\u0131 \u0259ld\u0259 etm\u0259y\u0259 imkan ver\u0259n bir ne\u00e7\u0259 hipotetik h\u00fccum ssenarisini ir\u0259lil\u0259dibl\u0259r. G\u00f6nd\u0259ril\u0259n arxivin avtomatla\u015fd\u0131r\u0131lm\u0131\u015f t\u0259hl\u00fck\u0259sizlik skaneri t\u0259r\u0259find\u0259n yoxlamaqdan v\u0259 \u0259l auditind\u0259n ke\u00e7m\u0259si g\u00f6zl\u0259nilir, bu zaman yoxlay\u0131c\u0131, dig\u0259r fayllarla birlikd\u0259 q\u0259rib\u0259 i\u00e7 i\u00e7\u0259 arxiv\u0259 diqq\u0259t yetirm\u0259y\u0259c\u0259k, daha sonra is\u0259 Rust kitabxanalar\u0131 vasit\u0259sil\u0259 arxivin a\u00e7\u0131lmas\u0131 zaman\u0131 g\u00f6zl\u0259nil\u0259nd\u0259n ba\u015fqa bir m\u0259zmun al\u0131nacaq. <\/p>\n
M\u0259s\u0259l\u0259n, h\u00fccum\u00e7u, \u0259sas arxivd\u0259ki legitim pyproject.toml fayl\u0131n\u0131 ehtiva ed\u0259n PyPI deposuna d\u0259yi\u015fdirilmi\u015f arxivi y\u00fckl\u0259y\u0259 bil\u0259r. Bu paket uv al\u0259ti vasit\u0259sil\u0259 i\u015fl\u0259n\u0259nd\u0259 legitim pyproject.toml, inki\u015faf etdiricinin komp\u00fcterind\u0259 v\u0259 ya davaml\u0131 inteqrasiya sistemind\u0259 toplanan zaman icra edil\u0259c\u0259k \u0259mrleri ehtiva ed\u0259n ziyanl\u0131 variantla \u0259v\u0259z olunur. Eyni \u015f\u0259kild\u0259, testcontainers al\u0259tind\u0259n istifad\u0259 ed\u0259r\u0259k konteynerin imici \u00e7\u0131xar\u0131ld\u0131qda konteyner fayllar\u0131n\u0131n yeniden yaz\u0131lmas\u0131n\u0131 t\u0259\u015fkild\u0259 etm\u0259k m\u00fcmk\u00fcnd\u00fcr. \n M\u0259nb\u0259: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"TAR](\"\/wp-content\/uploads\/2025\/10\/7de5eeee8420b77faa0bca075f275700.png\")
<\/center> ![\"TAR](\"\/wp-content\/uploads\/2025\/10\/538645342d5a4408b327ffd87c659c4f.png\")
<\/center> <\/p>\n