{"id":100611,"date":"2021-06-27T10:23:04","date_gmt":"2021-06-27T08:23:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/79-vstroennyh-v-kod-storonnih-bibliotek-nikogda-ne-obnovlyayutsya"},"modified":"2021-06-27T10:23:04","modified_gmt":"2021-06-27T08:23:04","slug":"79-vstroennyh-v-kod-storonnih-bibliotek-nikogda-ne-obnovlyayutsya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/79-vstroennyh-v-kod-storonnih-bibliotek-nikogda-ne-obnovlyayutsya","title":{"rendered":"79 % knihoven t\u0159et\u00edch stran integrovan\u00fdch do k\u00f3du nikdy neaktualizuje","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Spole\u010dnost Veracode zve\u0159ejnila v\u00fdsledky v\u00fdzkumu bezpe\u010dnostn\u00edch probl\u00e9m\u016f zp\u016fsoben\u00fdch integrac\u00ed open-source knihoven do aplikac\u00ed (nam\u00edsto dynamick\u00e9ho linkov\u00e1n\u00ed mnoh\u00e9 firmy jednodu\u0161e kop\u00edruj\u00ed pot\u0159ebn\u00e9 knihovny do sv\u00fdch projekt\u016f). V d\u016fsledku skenov\u00e1n\u00ed 86 tis\u00edc repozit\u00e1\u0159\u016f a dotazov\u00e1n\u00ed p\u0159ibli\u017en\u011b dvou tis\u00edc v\u00fdvoj\u00e1\u0159\u016f bylo zji\u0161t\u011bno, \u017ee 79 % integrovan\u00fdch knihoven t\u0159et\u00edch stran v k\u00f3du projekt\u016f se nikdy neaktualizuje. <\/p>\n
Zastaral\u00fd k\u00f3d knihoven p\u0159itom zp\u016fsobuje bezpe\u010dnostn\u00ed probl\u00e9my, kter\u00fdch je v 92 % p\u0159\u00edpad\u016f mo\u017en\u00e9 se vyhnout prostou aktualizac\u00ed k\u00f3du knihovny. V\u00fdmluvy, \u017ee k aktualizaci knihoven nedoch\u00e1z\u00ed kv\u016fli mo\u017en\u00e9mu naru\u0161en\u00ed kompatibility, jsou v drtiv\u00e9 v\u011bt\u0161in\u011b p\u0159\u00edpad\u016f bezp\u0159edm\u011btn\u00e9, nebo\u0165 ve 69 % p\u0159\u00edpad\u016f byly zranitelnosti odstran\u011bny v oprav\u00e1ch, kter\u00e9 nebyly spojeny se zm\u011bnami ve funk\u010dnosti. <\/p>\n
Informov\u00e1n\u00ed v\u00fdvoj\u00e1\u0159\u016f o v\u00fdskytu zranitelnost\u00ed tak\u00e9 hraje roli \u2013 v p\u0159\u00edpad\u011b, \u017ee byli v\u00fdvoj\u00e1\u0159i o probl\u00e9mu v knihovn\u011b informov\u00e1ni, bylo v 17 % p\u0159\u00edpad\u016f probl\u00e9m vy\u0159e\u0161en b\u011bhem jedn\u00e9 hodiny, a v 25 % b\u011bhem jednoho t\u00fddne. Pokud byly k dispozici informace o tom, jak m\u016f\u017ee zranitelnost v knihovn\u011b v\u00e9st k ohro\u017een\u00ed aplikace, bylo v 50 % p\u0159\u00edpad\u016f oprava vyd\u00e1na b\u011bhem t\u0159\u00ed t\u00fddn\u016f, zat\u00edmco bez poskytnut\u00ed informac\u00ed \u010dek\u00e1n\u00ed na odstran\u011bn\u00ed zranitelnosti trvalo 7 a v\u00edce m\u011bs\u00edc\u016f. \u010ctvrtina dot\u00e1zan\u00fdch v\u00fdvoj\u00e1\u0159\u016f uvedla, \u017ee p\u0159i v\u00fdb\u011bru knihovny pro integraci up\u0159ednost\u0148uje funk\u010dnost a licenci na k\u00f3d, a teprve pot\u00e9 se zohled\u0148uje bezpe\u010dnost. <\/p>\n
Pozoruhodn\u00e9 je, \u017ee ani situace s kontrolou licenc\u00ed na k\u00f3d nen\u00ed lep\u0161\u00ed \u2013 54 % dot\u00e1zan\u00fdch p\u0159iznalo, \u017ee p\u0159ed integrac\u00ed knihovny do sv\u00e9ho produktu licenci na k\u00f3d v\u017edy nekontroluj\u00ed. Povinnou kontrolu licen\u010dn\u00ed kompatibility prov\u00e1d\u00ed pouze 27 % dot\u00e1zan\u00fdch. \n Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"