{"id":53561,"date":"2019-12-04T00:00:00","date_gmt":"2019-12-03T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/v-kataloge-python-paketov-pypi-vyyavleny-dve-vredonosnye-biblioteki"},"modified":"2020-02-18T14:01:28","modified_gmt":"2020-02-18T11:01:28","slug":"v-kataloge-python-paketov-pypi-vyyavleny-dve-vredonosnye-biblioteki","status":"publish","type":"post","link":"https:\/\/prohoster.info\/az\/blog\/news\/v-kataloge-python-paketov-pypi-vyyavleny-dve-vredonosnye-biblioteki","title":{"rendered":"Python paketl\u0259ri PyPI kataloqunda iki z\u0259r\u0259rli kitabxana a\u015fkar edilib","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Python paketl\u0259ri kataloqu PyPI (Python Package Index) tap\u0131ld\u0131<\/a><\/noindex> z\u0259r\u0259rverici paketl\u0259r «python3-dateutil<\/a><\/noindex>» v\u0259 «jeIlyfish<\/a><\/noindex>« bir m\u00fc\u0259llif olgired2017 t\u0259r\u0259find\u0259n y\u00fckl\u0259nmi\u015f v\u0259 m\u0259\u015fhur paketl\u0259r « il\u0259 maskalanm\u0131\u015fd\u0131r.dateutil<\/a><\/noindex>» v\u0259 «jellyfish<\/a><\/noindex>» (ad\u0131 i\u00e7ind\u0259 «I» (i) yerin\u0259 «l» (L) simvolunun istifad\u0259si il\u0259 f\u0259rql\u0259nir). G\u00f6r\u00fcnd\u00fcy\u00fc kimi, bu paketl\u0259rin qura\u015fd\u0131r\u0131lmas\u0131 il\u0259, hakerin serverin\u0259 sistemd\u0259ki \u015fifre a\u00e7arlar\u0131 v\u0259 istifad\u0259\u00e7i m\u0259lumatlar\u0131 g\u00f6nd\u0259rildi. Hal-haz\u0131rda problemli paketl\u0259r art\u0131q PyPI kataloqundan silinmi\u015fdir.<\/p>\n

Birba\u015fa z\u0259r\u0259rverici kod «jeIlyfish» paketind\u0259 m\u00f6vcud idi, bu paket is\u0259 «python3-dateutil» layih\u0259si il\u0259 as\u0131l\u0131l\u0131q olaraq istifad\u0259 olunurdu.
\nAdlar diqq\u0259tsiz istifad\u0259\u00e7il\u0259ri h\u0259d\u0259f alaraq, axtar\u0131\u015f zaman\u0131 yaz\u0131 s\u0259hvl\u0259ri etm\u0259l\u0259rini g\u00f6zl\u0259y\u0259r\u0259k se\u00e7ilmi\u015fdir (type-squatting<\/a><\/noindex>). Z\u0259r\u0259rverici paket «jeIlyfish» t\u0259xmin\u0259n bir il \u0259vv\u0259l \u2014 11 dekabr 2018-ci ild\u0259 y\u00fckl\u0259nmi\u015fdir v\u0259 gizli qalm\u0131\u015fd\u0131r. Paket «python3-dateutil» 29 noyabr 2019-cu ild\u0259 y\u00fckl\u0259nmi\u015f v\u0259 bir ne\u00e7\u0259 g\u00fcnd\u0259n sonra bir inki\u015faf\u00e7\u0131n\u0131n diqq\u0259tini \u00e7\u0259kmi\u015fdir. Z\u0259r\u0259rverici paketl\u0259rin qura\u015fd\u0131r\u0131lma say\u0131 bar\u0259d\u0259 m\u0259lumat verilmir.<\/p>\n

Paket jellyfish xarici GitLab bazas\u0131ndan «hash» siyah\u0131s\u0131n\u0131 y\u00fckl\u0259y\u0259n kodu \u0259hat\u0259 edirdi. Bu «hash»larla i\u015fl\u0259m\u0259nin loqikas\u0131n\u0131n ara\u015fd\u0131r\u0131lmas\u0131, onlar\u0131n base64 funksiyas\u0131 il\u0259 kodla\u015fd\u0131r\u0131lm\u0131\u015f bir skript oldu\u011funu v\u0259 de\u015fifr\u0259 edildikd\u0259n sonra i\u015f\u0259 sal\u0131nd\u0131\u011f\u0131n\u0131 g\u00f6st\u0259rdi. Skript sistemd\u0259 SSH v\u0259 GPG \u015fifre a\u00e7arlar\u0131n\u0131, h\u0259m\u00e7inin ev qovlu\u011fundan m\u00fcvafiq fayl tipl\u0259rini v\u0259 PyCharm layih\u0259l\u0259ri \u00fc\u00e7\u00fcn istifad\u0259\u00e7i hesablar\u0131n\u0131 taparaq, onlar\u0131 DigitalOcean bulud infrastrukturu il\u0259 i\u015fl\u0259y\u0259n xarici server\u0259 g\u00f6nd\u0259rirdi.<\/p>\n

<\/a><\/noindex><\/p>\n

M\u0259nb\u0259: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b «python3-dateutil» \u0438 «jeIlyfish«, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u044b\u043b\u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u044b \u043e\u0434\u043d\u0438\u043c \u0430\u0432\u0442\u043e\u0440\u043e\u043c olgired2017 \u0438 \u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u043f\u043e\u0434 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b «dateutil» \u0438 «jellyfish» (\u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0441\u0438\u043c\u0432\u043e\u043b\u0430 «I» (i) \u0432\u043c\u0435\u0441\u0442\u043e «l» (L) \u0432 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0438). \u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u043b\u0438\u0441\u044c \u043d\u0430\u0439\u0434\u0435\u043d\u043d\u044b\u0435 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043a\u043b\u044e\u0447\u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0412 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53561","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Python paketl\u0259ri kataloqu PyPI-d\u0259 iki z\u0259r\u0259rli kitabxana a\u015fkar edilib | ProHoster","description":"Python paketl\u0259ri kataloqu PyPI (Python Package Index) z\u0259r\u0259rli paketl\u0259r \"","canonical_url":"https:\/\/prohoster.info\/az\/blog\/news\/v-kataloge-python-paketov-pypi-vyyavleny-dve-vredonosnye-biblioteki","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"az_AZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 | ProHoster","og:description":"\u0412 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b "","og:url":"https:\/\/prohoster.info\/az\/blog\/news\/v-kataloge-python-paketov-pypi-vyyavleny-dve-vredonosnye-biblioteki","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-03T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:28+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53561","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 07:52:15","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:22:51","updated":"2026-01-24 07:52:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/53561","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/comments?post=53561"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/53561\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/media?parent=53561"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/categories?post=53561"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/tags?post=53561"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}