{"id":52757,"date":"2019-11-16T00:00:00","date_gmt":"2019-11-15T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po"},"modified":"2020-02-18T14:00:33","modified_gmt":"2020-02-18T11:00:33","slug":"github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po","status":"publish","type":"post","link":"https:\/\/prohoster.info\/az\/blog\/news\/github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po","title":{"rendered":"GitHub, a\u00e7\u0131k kaynakl\u0131 yaz\u0131l\u0131mlardaki g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 tespit etmek i\u00e7in ortak bir proje ba\u015flatt\u0131","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitHub \u00e7\u0131xd\u0131<\/a><\/noindex> t\u0259klifl\u0259 GitHub T\u0259hl\u00fck\u0259sizlik M\u0259rk\u0259zi<\/a><\/noindex>, m\u00fcxt\u0259lif \u015firk\u0259t v\u0259 t\u0259\u015fkilatlar\u0131n t\u0259hl\u00fck\u0259sizlik m\u00fct\u0259x\u0259ssisl\u0259rinin birg\u0259 \u00e7al\u0131\u015fmas\u0131n\u0131 t\u0259\u015fkil etm\u0259y\u0259 h\u0259sr olunub, a\u00e7\u0131q layih\u0259l\u0259rin kodundak\u0131 z\u0259iflikl\u0259ri a\u015fkarlay\u0131b aradan qald\u0131rma\u011fa k\u00f6m\u0259k edir. <\/p>\n

T\u0259klif\u0259 qo\u015fulmaq \u00fc\u00e7\u00fcn b\u00fct\u00fcn maraql\u0131 \u015firk\u0259tl\u0259r v\u0259 komp\u00fcter t\u0259hl\u00fck\u0259sizliyi \u00fczr\u0259 m\u00fct\u0259x\u0259ssisl\u0259r d\u0259v\u0259t olunur. Z\u0259iflik a\u015fkarlayan m\u00fckafat<\/a><\/noindex> 3000 AB\u015e dollar\u0131na q\u0259d\u0259r \u00f6d\u0259nil\u0259c\u0259k, problemin t\u0259hl\u00fck\u0259lilik d\u0259r\u0259c\u0259sind\u0259n v\u0259 hesabat\u0131n haz\u0131rlanma keyfiyy\u0259tind\u0259n as\u0131l\u0131 olaraq. Probleml\u0259r haqq\u0131nda m\u0259lumat g\u00f6nd\u0259rm\u0259k \u00fc\u00e7\u00fcn CodeQL<\/a><\/noindex>al\u0259tind\u0259n istifad\u0259 etm\u0259k t\u00f6vsiy\u0259 olunur, bu al\u0259t m\u00fcmk\u00fcn z\u0259if kod n\u00fcmun\u0259l\u0259ri t\u0259rtib etm\u0259y\u0259 imkan verir ki, bu da dig\u0259r layih\u0259l\u0259rin kodlar\u0131nda eyni z\u0259ifliyin olub-olmad\u0131\u011f\u0131n\u0131 ara\u015fd\u0131rma\u011fa k\u00f6m\u0259k edir (CodeQL kodun semantik analizini aparma\u011fa v\u0259 m\u00fc\u0259yy\u0259n strukturlar\u0131n axtar\u0131\u015f\u0131 \u00fc\u00e7\u00fcn sor\u011fular t\u0259rtib etm\u0259y\u0259 imkan tan\u0131y\u0131r).<\/p>\n

GitHub T\u0259hl\u00fck\u0259sizlik M\u0259rk\u0259zin\u0259 art\u0131q F5, Google, HackerOne, Intel, IOActive, J.P. Morgan, LinkedIn, Microsoft, Mozilla, NCC Group, Oracle, Trail of Bits, Uber v\u0259
\nVMWare \u015firk\u0259tl\u0259rinin t\u0259hl\u00fck\u0259sizlik t\u0259dqiqat\u00e7\u0131lar\u0131 qo\u015fulmu\u015fdur, bunlar son iki ild\u0259 a\u015fkar etdil\u0259r<\/a><\/noindex> v\u0259 105 z\u0259ifliyin aradan qald\u0131r\u0131lmas\u0131na k\u00f6m\u0259k edib<\/a><\/noindex> Chromium, libssh2, Linux n\u00fcv\u0259si, Memcached, UBoot, VLC, Apport, HHVM, Exiv2, FFmpeg, Fizz, libav, Ansible, npm, XNU, Ghostscript, Icecast, Apache Struts, strongSwan, Apache Ignite, rsyslog, Apache Geode v\u0259 Hadoop kimi layih\u0259l\u0259rd\u0259. <\/p>\n

GitHub-da olan kodun t\u0259hl\u00fck\u0259sizliyini t\u0259min etm\u0259y\u0259 dair \u00f6nd\u0259 g\u00f6st\u0259ril\u0259n d\u00f6vr, GitHub T\u0259hl\u00fck\u0259sizlik M\u0259rk\u0259zinin i\u015ftirak\u00e7\u0131lar\u0131n\u0131n z\u0259iflikl\u0259ri a\u015fkarlayaca\u011f\u0131n\u0131 n\u0259z\u0259rd\u0259 tutur, daha sonra problem haqq\u0131nda m\u0259lumat mantiya menecerl\u0259r\u0259 v\u0259 inki\u015faf etdiricil\u0259r\u0259 \u00e7atd\u0131r\u0131lacaq, onlar h\u0259ll\u0259r i\u015fl\u0259yib haz\u0131rlayacaq, problemin if\u015fas\u0131 zaman\u0131n\u0131 raz\u0131la\u015fd\u0131racaq v\u0259 as\u0131l\u0131 layih\u0259l\u0259ri z\u0259ifliyi aradan qald\u0131r\u0131lm\u0131\u015f versiyan\u0131 qura\u015fd\u0131rma\u011fa x\u0259b\u0259rdar ed\u0259c\u0259kl\u0259r. Veril\u0259nl\u0259r bazas\u0131nda problem yenid\u0259n yaranmamas\u0131 \u00fc\u00e7\u00fcn CodeQL \u015fablonlar\u0131 yerl\u0259\u015fdiril\u0259c\u0259k.
\n

\"GitHub,<\/a><\/noindex><\/center><\/p>\n

Art\u0131q GitHub interfeysind\u0259n m\u00fcmk\u00fcn olan \u0259ld\u0259 ed\u0259 bil\u0259r<\/a><\/noindex> CVE identifikatoru tap\u0131lm\u0131\u015f problem \u00fc\u00e7\u00fcn haz\u0131rlanacaq v\u0259 GitHub laz\u0131m olan bildiri\u015fl\u0259ri g\u00f6nd\u0259r\u0259c\u0259k v\u0259 koordinator d\u00fcz\u0259li\u015f t\u0259\u015fkil ed\u0259c\u0259k. \u00dcst\u0259lik, problem aradan qald\u0131r\u0131ld\u0131qdan sonra GitHub avtomatik olaraq z\u0259if layih\u0259 il\u0259 ba\u011fl\u0131 as\u0131l\u0131l\u0131qlar\u0131n yenil\u0259nm\u0259si \u00fc\u00e7\u00fcn pull request-l\u0259r g\u00f6nd\u0259r\u0259c\u0259k.<\/p>\n

GitHub h\u0259m\u00e7inin z\u0259iflikl\u0259r kataloqunu t\u0259tbiq edib GitHub Advisory Database<\/a><\/noindex>, burada GitHub-dak\u0131 layih\u0259l\u0259ri t\u0259sir ed\u0259n z\u0259iflikl\u0259r haqq\u0131nda m\u0259lumatlar d\u0259rc edilir v\u0259 z\u0259ifliy\u0259 m\u0259ruz qalm\u0131\u015f paket v\u0259 repozitoriyalar\u0131n izl\u0259nm\u0259si \u00fc\u00e7\u00fcn m\u0259lumat verilir. GitHub-da \u015f\u0259rhl\u0259rd\u0259 qeyd olunan CVE identifikatorlar\u0131 avtomatik olaraq t\u0259qdim olunan veril\u0259nl\u0259r bazas\u0131ndak\u0131 z\u0259iflik haqq\u0131nda \u0259trafl\u0131 m\u0259lumata istinad edir. Veril\u0259nl\u0259r bazas\u0131 il\u0259 i\u015fin avtomatla\u015fd\u0131r\u0131lmas\u0131 \u00fc\u00e7\u00fcn ayr\u0131ca API<\/a><\/noindex>.<\/p>\n

H\u0259m\u00e7inin, xidm\u0259ti<\/a><\/noindex> \u015fikay\u0259tl\u0259rin qar\u015f\u0131s\u0131n\u0131 almaq \u00fc\u00e7\u00fcn ictimai s\u0259hif\u0259l\u0259r\u0259 daxil olma\u011f\u0131n<\/a><\/noindex> qorunmas\u0131 \u00fc\u00e7\u00fcn
\nm\u0259lumatlar\u0131n gizliliyi, m\u0259s\u0259l\u0259n, do\u011frulama tokenl\u0259ri v\u0259 giri\u015f a\u00e7arlar\u0131. \u0130cmal zaman\u0131 skaner a\u00e7arlar\u0131n v\u0259 tokenl\u0259rin istifad\u0259 olunan standart formatlar\u0131n\u0131 yoxlay\u0131r 20 bulud t\u0259minat\u00e7\u0131s\u0131 v\u0259 xidm\u0259tl\u0259ri<\/a><\/noindex>, bunlara Alibaba Cloud, Amazon Web Services (AWS), Azure, Google Cloud, Slack v\u0259 Stripe daxildir. Token a\u015fkar edildikd\u0259, xidm\u0259t t\u0259minat\u00e7\u0131s\u0131na tokenl\u0259rin s\u0131zd\u0131r\u0131lmas\u0131 v\u0259 pozulmu\u015f tokenl\u0259rin l\u0259\u011fv edilm\u0259si \u00fc\u00e7\u00fcn t\u0259sdiq sor\u011fusu g\u00f6nd\u0259rilir. Ke\u00e7\u0259n g\u00fcnd\u0259n etibar\u0259n \u0259vv\u0259lki d\u0259st\u0259kl\u0259n\u0259n formatlara \u0259lav\u0259 olaraq, GoCardless, HashiCorp, Postman v\u0259 Tencent tokenl\u0259rinin m\u00fc\u0259yy\u0259n edilm\u0259si d\u0259st\u0259yi \u0259lav\u0259 edilib.<\/p>\n

<\/a><\/noindex><\/p>\n

M\u0259nb\u0259: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

GitHub \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b \u0441 \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u043e\u0439 GitHub Security Lab, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044e \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u043e\u0432 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u0441\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044e \u043f\u043e \u0438\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e \u0432 \u043a\u043e\u0434\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432. \u0414\u043b\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u0435 \u043f\u0440\u0438\u0433\u043b\u0430\u0448\u0430\u044e\u0442\u0441\u044f \u0432\u0441\u0435 \u0437\u0430\u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0438 \u0438\u043d\u0434\u0438\u0432\u0438\u0434\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043f\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0417\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0435\u0434\u0443\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u0430 \u0432\u044b\u043f\u043b\u0430\u0442\u0430 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c \u0434\u043e 3000 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":52758,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-52757","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47GitHub a\u00e7\u0131q m\u0259nb\u0259 kodlar\u0131nda z\u0259iflikl\u0259rin m\u00fc\u0259yy\u0259n edilm\u0259sin\u0259 y\u00f6n\u0259lmi\u015f birg\u0259 layih\u0259y\u0259 start verdi | ProHoster","description":"GitHub t\u0259\u015f\u0259bb\u00fcs ir\u0259lil\u0259yib","canonical_url":"https:\/\/prohoster.info\/az\/blog\/news\/github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"az_AZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47GitHub \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u044b\u0439 \u043f\u0440\u043e\u0435\u043a\u0442 \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u041f\u041e | ProHoster","og:description":"GitHub \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b \u0441 \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u043e\u0439","og:url":"https:\/\/prohoster.info\/az\/blog\/news\/github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-15T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52757","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 04:44:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:18:18","updated":"2026-01-24 04:44:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/52757","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/comments?post=52757"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/52757\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/media\/52758"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/media?parent=52757"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/categories?post=52757"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/tags?post=52757"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}