{"id":101282,"date":"2021-09-17T04:22:36","date_gmt":"2021-09-17T02:22:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-travis-ci-privodyashhaya-k-utechke-klyuchej-publichnyh-repozitoriev"},"modified":"2021-09-17T04:22:36","modified_gmt":"2021-09-17T02:22:36","slug":"uyazvimost-v-travis-ci-privodyashhaya-k-utechke-klyuchej-publichnyh-repozitoriev","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-travis-ci-privodyashhaya-k-utechke-klyuchej-publichnyh-repozitoriev","title":{"rendered":"Zranitelnost v Travis CI, kter\u00e1 vede k \u00faniku kl\u00ed\u010d\u016f ve\u0159ejn\u00fdch repozit\u00e1\u0159\u016f","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V syst\u00e9mu kontinu\u00e1ln\u00ed integrace Travis CI, ur\u010den\u00e9m pro testov\u00e1n\u00ed a sestavov\u00e1n\u00ed projekt\u016f vyv\u00edjen\u00fdch na GitHubu a Bitbucketu, byla odhalena bezpe\u010dnostn\u00ed chyba (CVE-2021-41077), kter\u00e1 umo\u017e\u0148uje z\u00edsk\u00e1n\u00ed obsahu d\u016fv\u011brn\u00fdch prom\u011bnn\u00fdch prost\u0159ed\u00ed ve\u0159ejn\u00fdch repozit\u00e1\u0159\u016f vyu\u017e\u00edvaj\u00edc\u00edch Travis CI. Mezi jin\u00fdm tato zranitelnost umo\u017e\u0148uje zjistit kl\u00ed\u010de pou\u017e\u00edvan\u00e9 v Travis CI pro generov\u00e1n\u00ed digit\u00e1ln\u00edch podpis\u016f, p\u0159\u00edstupov\u00e9 kl\u00ed\u010de a tokeny pro vol\u00e1n\u00ed API. <\/p>\n

Probl\u00e9m byl v Travis CI p\u0159\u00edtomen od 3. do 10. z\u00e1\u0159\u00ed. Zaj\u00edmav\u00e9 je, \u017ee informace o zranitelnosti byly p\u0159ed\u00e1ny v\u00fdvoj\u00e1\u0159\u016fm 7. z\u00e1\u0159\u00ed, ale v odpov\u011bdi p\u0159i\u0161la pouze obvykl\u00e1 doporu\u010den\u00ed ke zm\u011bn\u011b kl\u00ed\u010d\u016f. Bez pat\u0159i\u010dn\u00e9 zp\u011btn\u00e9 vazby se v\u00fdzkumn\u00edci obr\u00e1tili na GitHub a navrhli za\u0159adit Travis na \u010dernou listinu. Probl\u00e9m byl vy\u0159e\u0161en a\u017e 10. z\u00e1\u0159\u00ed po velk\u00e9m po\u010dtu st\u00ed\u017enost\u00ed z r\u016fzn\u00fdch projekt\u016f. Po incidentu byl na str\u00e1nk\u00e1ch spole\u010dnosti Travis CI publikov\u00e1n v\u00edce ne\u017e podivn\u00fd zpr\u00e1va o probl\u00e9mu, ve kter\u00e9 m\u00edsto informov\u00e1n\u00ed o oprav\u011b zranitelnosti existovalo pouze doporu\u010den\u00ed m\u011bnit p\u0159\u00edstupov\u00e9 kl\u00ed\u010de bez dal\u0161\u00edho kontextu. <\/p>\n

Po vzru\u0161en\u00ed vyvolan\u00e9m skryt\u00edm informac\u00ed, je\u017e vyj\u00e1d\u0159ily n\u011bkter\u00e9 v\u00fdznamn\u00e9 projekty, byl na f\u00f3r\u00e1ch podpory Travis CI publikov\u00e1n podrobn\u011bj\u0161\u00ed report, ve kter\u00e9m byla upozorn\u011bna na skute\u010dnost, \u017ee vlastn\u00edk fork\u016f jak\u00e9hokoli ve\u0159ejn\u00e9ho repozit\u00e1\u0159e mohl zasl\u00e1n\u00edm pull requestu iniciovat proces sestaven\u00ed a z\u00edskat neopr\u00e1vn\u011bn\u00fd p\u0159\u00edstup k d\u016fv\u011brn\u00fdm prom\u011bnn\u00fdm prost\u0159ed\u00ed p\u016fvodn\u00edho repozit\u00e1\u0159e, kter\u00e9 se b\u011bhem sestaven\u00ed vystavovaly na z\u00e1klad\u011b pol\u00ed z souboru «.travis.yml» nebo definovan\u00fdch prost\u0159ednictv\u00edm webov\u00e9ho rozhran\u00ed Travis CI. Tyto prom\u011bnn\u00e9 jsou uchov\u00e1v\u00e1ny v za\u0161ifrovan\u00e9 podob\u011b a de\u0161ifrov\u00e1ny pouze b\u011bhem sestaven\u00ed. Probl\u00e9m se t\u00fdkal pouze ve\u0159ejn\u011b dostupn\u00fdch repozit\u00e1\u0159\u016f, kter\u00e9 maj\u00ed forky (priv\u00e1tn\u00ed repozit\u00e1\u0159e nejsou ohro\u017eeny).
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 \u043d\u0435\u043f\u0440\u0435\u0440\u044b\u0432\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 Travis CI, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u043c \u0434\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0440\u0430\u0437\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u043c\u044b\u0445 \u043d\u0430 GitHub \u0438 Bitbucket, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e (CVE-2021-41077), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0437\u043d\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 Travis CI. \u0412 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0437\u043d\u0430\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0435 \u0432 Travis CI \u043a\u043b\u044e\u0447\u0438 \u0434\u043b\u044f \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439, \u043a\u043b\u044e\u0447\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u0442\u043e\u043a\u0435\u043d\u044b \u0434\u043b\u044f \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101282","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnost v Travis CI, kter\u00e1 vede k \u00faniku kl\u00ed\u010d\u016f ve\u0159ejn\u00fdch repozit\u00e1\u0159\u016f | ProHoster","description":"V syst\u00e9mu kontinu\u00e1ln\u00ed integrace Travis CI, ur\u010den\u00e9m pro testov\u00e1n\u00ed a sestavov\u00e1n\u00ed projekt\u016f vyv\u00edjen\u00fdch na GitHubu a Bitbucketu, byla odhalena bezpe\u010dnostn\u00ed chyba (CVE-2021-41077), kter\u00e1 umo\u017e\u0148uje zjistit obsah.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-travis-ci-privodyashhaya-k-utechke-klyuchej-publichnyh-repozitoriev","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Travis CI, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u043a\u043b\u044e\u0447\u0435\u0439 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 | ProHoster","og:description":"\u0412 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 \u043d\u0435\u043f\u0440\u0435\u0440\u044b\u0432\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 Travis CI, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u043c \u0434\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0440\u0430\u0437\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u043c\u044b\u0445 \u043d\u0430 GitHub \u0438 Bitbucket, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e (CVE-2021-41077), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0437\u043d\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-travis-ci-privodyashhaya-k-utechke-klyuchej-publichnyh-repozitoriev","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-17T02:22:36+00:00","article:modified_time":"2021-09-17T02:22:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101282","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-17 02:23:32","updated":"2022-09-29 06:14:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/101282","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=101282"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/101282\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=101282"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=101282"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=101282"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}