{"id":109367,"date":"2023-07-12T21:10:19","date_gmt":"2023-07-12T19:10:19","guid":{"rendered":"https:\/\/prohoster.info\/?p=109367"},"modified":"2023-07-13T09:57:04","modified_gmt":"2023-07-13T07:57:04","slug":"uyazvimosti-v-redis-ghostscript-asterisk-i-parse-server","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-redis-ghostscript-asterisk-i-parse-server","title":{"rendered":"Zranitelnosti v Redis, Ghostscript, Asterisk a Parse Server","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>N\u011bkolik ned\u00e1vno odhalen\u00fdch nebezpe\u010dn\u00fdch zranitelnost\u00ed:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2022-24834 \u2014 zranitelnost v datab\u00e1zov\u00e9m syst\u00e9mu Redis, kter\u00e1 umo\u017e\u0148uje zp\u016fsobit p\u0159ete\u010den\u00ed z\u00e1sobn\u00edku v knihovn\u00e1ch cjson a cmsgpack p\u0159i prov\u00e1d\u011bn\u00ed speci\u00e1ln\u011b vytvo\u0159en\u00e9ho skriptu v jazyce Lua. Potenci\u00e1ln\u011b m\u016f\u017ee tato zranitelnost v\u00e9st k vzd\u00e1len\u00e9mu spu\u0161t\u011bn\u00ed k\u00f3du na <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/cs\/server\/dts-newyork\/\"   title=\"serveru\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2763\">serveru<\/a>. Probl\u00e9m se objevuje od verze Redis 2.6 a byl opraven ve verz\u00edch 7.0.12, 6.2.13 a 6.0.20. Jako obranou mo\u017enost\u00ed lze p\u0159es ACL zak\u00e1zat u\u017eivatel\u016fm Redis vykon\u00e1vat p\u0159\u00edkazy EVAL a EVALSHA.\n<li class=\"l\"> CVE-2023-36824 \u2014 zranitelnost v datab\u00e1zov\u00e9m syst\u00e9mu Redis, vedouc\u00ed k p\u0159ekro\u010den\u00ed z\u00e1sobn\u00edku p\u0159i zpracov\u00e1n\u00ed n\u00e1zv\u016f kl\u00ed\u010d\u016f p\u0159edan\u00fdch prost\u0159ednictv\u00edm p\u0159\u00edkazu COMMAND GETKEYS nebo COMMAND GETKEYSANDFLAGS, stejn\u011b jako seznam\u016f kl\u00ed\u010d\u016f v pravidlech ACL. Potenci\u00e1ln\u011b m\u016f\u017ee zranitelnost v\u00e9st k vzd\u00e1len\u00e9mu spu\u0161t\u011bn\u00ed k\u00f3du na serveru. Probl\u00e9m se projevuje pouze ve v\u011btvi 7.0.x a byl opraven ve verzi 7.0.12.\n<li class=\"l\"> CVE-2022-23537 \u2014 zranitelnost v komunika\u010dn\u00ed platform\u011b Asterisk, kter\u00e1 vede k p\u0159ete\u010den\u00ed z\u00e1sobn\u00edku p\u0159i anal\u00fdze <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/cs\/server\/dts-prohoster\/\"   title=\"serverem\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"3076\">serverem<\/a> speci\u00e1ln\u011b upraven\u00fdch zpr\u00e1v STUN, v nich\u017e je uveden nezn\u00e1m\u00fd atribut. Probl\u00e9m se projevuje p\u0159i pou\u017e\u00edv\u00e1n\u00ed v Asterisk protokol\u016f ICE nebo WebRTC. Zranitelnost byla opravena ve verz\u00edch 16.30.1, 18.18.1, 19.8.1 a 20.3.1.\n<li class=\"l\"> CVE-2023-36664 \u2014 zranitelnost v Ghostscript, sad\u011b n\u00e1stroj\u016f pro zpracov\u00e1n\u00ed, p\u0159evod a generaci dokument\u016f ve form\u00e1tech PostScript a PDF, kter\u00e1 umo\u017e\u0148uje prov\u00e9st libovoln\u00fd k\u00f3d p\u0159i otev\u0159en\u00ed speci\u00e1ln\u011b vytvo\u0159en\u00fdch dokument\u016f ve form\u00e1tu PostScript. Probl\u00e9m je zp\u016fsoben nespr\u00e1vn\u00fdm zpracov\u00e1n\u00edm n\u00e1zv\u016f soubor\u016f, kter\u00e9 za\u010d\u00ednaj\u00ed znakem \u201e|\u201c nebo prefixem %pipe%. Zranitelnost byla odstran\u011bna ve verzi Ghostscript 10.01.2.\n<p>V mnoha prost\u0159ed\u00edch je Ghostscript vol\u00e1n p\u0159i vytv\u00e1\u0159en\u00ed miniatur na plo\u0161e nebo p\u0159i pozadov\u00e9 indexaci dat, proto pro \u00fatok m\u016f\u017ee b\u00fdt n\u011bkdy dostate\u010dn\u00e9 jednodu\u0161e nahr\u00e1t soubor s exploitou nebo prohl\u00ed\u017eet katalog s n\u00edm v Nautilus. \u00datok na serverov\u00e9 syst\u00e9my m\u016f\u017ee b\u00fdt organizov\u00e1n prost\u0159ednictv\u00edm zpracovatel\u016f obr\u00e1zk\u016f zalo\u017een\u00fdch na bal\u00ed\u010dc\u00edch ImageMagick a GraphicsMagick, kter\u00e9 volaj\u00ed Ghostscript p\u0159i p\u0159ed\u00e1n\u00ed JPEG nebo PNG soubor\u016f, v nich\u017e m\u00edsto obr\u00e1zku je k\u00f3d PostScript (takov\u00fd soubor bude zpracov\u00e1n v Ghostscript, proto\u017ee MIME typ je rozpozn\u00e1v\u00e1n na z\u00e1klad\u011b obsahu, nikoli na z\u00e1klad\u011b p\u0159\u00edpony).    <\/p>\n<li class=\"l\"> CVE-2023-36475 \u2014 zranitelnost v Parse Server, backendu pro Node.js, pracuj\u00edc\u00edm s webov\u00fdm r\u00e1mcem Express, kter\u00e1 umo\u017e\u0148uje vzd\u00e1len\u011b prov\u00e9st sv\u016fj k\u00f3d na serveru. Zranitelnost umo\u017e\u0148uje aplikovat metodu zne\u010di\u0161t\u011bn\u00ed prototypu objekt\u016f JavaScript (\u201eprototype pollution\u201c) pro spu\u0161t\u011bn\u00ed vlastn\u00edho k\u00f3du p\u0159es BSON parser MongoDB. Zranitelnosti byla p\u0159id\u011blena \u00farove\u0148 nebezpe\u010dnosti 9.8 z 10. Probl\u00e9m byl odstran\u011bn v aktualizac\u00edch parse-server 5.5.2 a 6.2.1.      <\/ul>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=59430\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-24834 &#8212; \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0421\u0423\u0411\u0414 Redis, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 cjson \u0438 cmsgpack \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Lua. \u041f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 Redis 2.6 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 7.0.12, 6.2.13 \u0438 6.0.20. \u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0431\u0445\u043e\u0434\u043d\u043e\u0433\u043e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-109367","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-24834 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0421\u0423\u0411\u0414 Redis, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 cjson \u0438 cmsgpack \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-redis-ghostscript-asterisk-i-parse-server\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Redis, Ghostscript, Asterisk \u0438 Parse Server | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-24834 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0421\u0423\u0411\u0414 Redis, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 cjson \u0438 cmsgpack \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-redis-ghostscript-asterisk-i-parse-server\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-07-12T19:10:19+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-07-13T07:57:04+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnosti v Redis, Ghostscript, Asterisk a Parse Server | ProHoster","description":"N\u011bkolik ned\u00e1vno objeven\u00fdch nebezpe\u010dn\u00fdch zranitelnost\u00ed: CVE-2022-24834 - zranitelnost v datab\u00e1zi Redis, kter\u00e1 umo\u017e\u0148uje vyvolat p\u0159ete\u010den\u00ed z\u00e1sobn\u00edku v knihovn\u00e1ch cjson a cmsgpack p\u0159i prov\u00e1d\u011bn\u00ed speci\u00e1ln\u011b p\u0159ipraven\u00fdch dat.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-redis-ghostscript-asterisk-i-parse-server","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Redis, Ghostscript, Asterisk \u0438 Parse Server | ProHoster","og:description":"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-24834 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0421\u0423\u0411\u0414 Redis, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 cjson \u0438 cmsgpack \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-redis-ghostscript-asterisk-i-parse-server","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-07-12T19:10:19+00:00","article:modified_time":"2023-07-13T07:57:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"109367","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:40:03","updated":"2026-02-09 21:46:52","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/109367","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=109367"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/109367\/revisions"}],"predecessor-version":[{"id":160357,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/109367\/revisions\/160357"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=109367"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=109367"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=109367"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}