GitHub odhalil podrobnosti o zranitelnosti, kter\u00e1 umo\u017e\u0148uje p\u0159\u00edstup k obsahu prom\u011bnn\u00fdch prost\u0159ed\u00ed vystaven\u00fdch v kontejnerech pou\u017e\u00edvan\u00fdch v pracovn\u00ed infrastruktu\u0159e. Zranitelnost byla odhalena \u00fa\u010dastn\u00edkem programu Bug Bounty, kter\u00fd se uch\u00e1z\u00ed o odm\u011bnu za nalezen\u00ed bezpe\u010dnostn\u00edch probl\u00e9m\u016f. Probl\u00e9m se t\u00fdk\u00e1 jak slu\u017eby GitHub.com, tak konfigurac\u00ed GitHub Enterprise Server (GHES) b\u011b\u017e\u00edc\u00edch na u\u017eivatelsk\u00fdch syst\u00e9mech. <\/p>\n
Anal\u00fdza log\u016f a audit infrastruktury neodhalily stopy po vyu\u017e\u00edv\u00e1n\u00ed zranitelnosti v minulosti krom\u011b aktivity v\u00fdzkumn\u00edka, kter\u00fd na probl\u00e9m upozornil. Nicm\u00e9n\u011b byla v infrastruktu\u0159e zah\u00e1jena v\u00fdm\u011bna v\u0161ech \u0161ifrovac\u00edch kl\u00ed\u010d\u016f a p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f, kter\u00e9 mohly b\u00fdt potenci\u00e1ln\u011b kompromitov\u00e1ny v p\u0159\u00edpad\u011b zneu\u017eit\u00ed zranitelnosti \u00fato\u010dn\u00edkem. V\u00fdm\u011bna intern\u00edch kl\u00ed\u010d\u016f vedla k naru\u0161en\u00ed chodu n\u011bkter\u00fdch slu\u017eeb od 27. do 29. prosince. Spr\u00e1vci GitHub se pokusili vz\u00edt v \u00favahu chyby, kter\u00e9 vznikly p\u0159i v\u010derej\u0161\u00ed aktualizaci kl\u00ed\u010d\u016f, ovliv\u0148uj\u00edc\u00ed z\u00e1kazn\u00edky. <\/p>\n
Mezi jin\u00fdmi byl aktualizov\u00e1n GPG kl\u00ed\u010d pou\u017e\u00edvan\u00fd pro podepisov\u00e1n\u00ed digit\u00e1ln\u00edch podpis\u016f commit\u016f vytv\u00e1\u0159en\u00fdch prost\u0159ednictv\u00edm webov\u00e9ho editoru GitHub p\u0159i p\u0159ij\u00edm\u00e1n\u00ed pull request\u016f na webu \u010di prost\u0159ednictv\u00edm n\u00e1stroje Codespace. Star\u00fd kl\u00ed\u010d p\u0159estal platit 16. ledna ve 23 hodin moskevsk\u00e9ho \u010dasu, a od v\u010derej\u0161\u00edho dne je pou\u017e\u00edv\u00e1n nov\u00fd kl\u00ed\u010d. Od 23. ledna nebudou v\u0161echny nov\u00e9 commity podepsan\u00e9 star\u00fdm kl\u00ed\u010dem na webu GitHub ozna\u010deny jako ov\u011b\u0159en\u00e9. <\/p>\n
16. ledna byly tak\u00e9 aktualizov\u00e1ny ve\u0159ejn\u00e9 kl\u00ed\u010de pou\u017e\u00edvan\u00e9 k \u0161ifrov\u00e1n\u00ed dat u\u017eivatel\u016f zas\u00edlan\u00fdch prost\u0159ednictv\u00edm API v GitHub Actions, GitHub Codespaces a Dependabot. U\u017eivatel\u016fm, kte\u0159\u00ed pou\u017e\u00edvaj\u00ed pro m\u00edstn\u00ed kontrolu commit\u016f a \u0161ifrov\u00e1n\u00ed p\u0159en\u00e1\u0161en\u00fdch dat ve\u0159ejn\u00e9 kl\u00ed\u010de pat\u0159\u00edc\u00ed GitHubu, se doporu\u010duje ujistit se, \u017ee aktualizovali GPG kl\u00ed\u010de GitHubu, a \u017ee jejich syst\u00e9my pokra\u010duj\u00ed v \u010dinnosti po proveden\u00e9 v\u00fdm\u011bn\u011b kl\u00ed\u010d\u016f. <\/p>\n
Spole\u010dnost GitHub ji\u017e odstranila zranitelnost na webu GitHub.com a vydala aktualizaci produktu GHES 3.8.13, 3.9.8, 3.10.5 a 3.11.3, v n\u00ed\u017e je uvedeno opraveno CVE-2024-0200 (nebezpe\u010dn\u00e9 vyu\u017eit\u00ed reflex\u00ed vedouc\u00ed k prov\u00e1d\u011bn\u00ed k\u00f3du nebo u\u017eivatelsky \u0159\u00edzen\u00fdch metod na stran\u011b serveru) serveru<\/a>). \u00datok na m\u00edstn\u00ed instalace GHES mohl b\u00fdt proveden, pokud by \u00fato\u010dn\u00edk m\u011bl \u00fa\u010det s opr\u00e1vn\u011bn\u00edmi spr\u00e1vce organizace (organizace vlastn\u00edka). GitHub \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u043c\u0443 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0439, \u0432\u044b\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\u0445, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0432 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u043e\u043c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b Bug Bounty, \u043f\u0440\u0435\u0442\u0435\u043d\u0434\u0443\u044e\u0449\u0438\u043c \u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f \u0437\u0430 \u043f\u043e\u0438\u0441\u043a \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043a\u0430\u043a \u0441\u0435\u0440\u0432\u0438\u0441 GitHub.com, \u0442\u0430\u043a \u0438 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 GitHub Enterprise Server (GHES), \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0435 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u0410\u043d\u0430\u043b\u0438\u0437 \u043b\u043e\u0433\u043e\u0432 \u0438 \u0430\u0443\u0434\u0438\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112958","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47GitHub aktualizoval GPG kl\u00ed\u010de kv\u016fli zranitelnosti vedouc\u00ed k \u00faniku prom\u011bnn\u00fdch prost\u0159ed\u00ed | ProHoster","description":"GitHub odhalil informace o zranitelnosti, kter\u00e1 umo\u017e\u0148uje p\u0159\u00edstup k obsahu prom\u011bnn\u00fdch prost\u0159ed\u00ed nastaven\u00fdch v kontejnerech pou\u017e\u00edvan\u00fdch v pracovn\u00ed infrastruktu\u0159e.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/github-obnovil-gpg-klyuchi-iz-za-uyazvimosti-privodyashhej-k-utechke-peremennyh-okruzheniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47GitHub \u043e\u0431\u043d\u043e\u0432\u0438\u043b GPG-\u043a\u043b\u044e\u0447\u0438 \u0438\u0437-\u0437\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0435\u0439 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f | ProHoster","og:description":"GitHub \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u043c\u0443 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0439, \u0432\u044b\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\u0445, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0432 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/github-obnovil-gpg-klyuchi-iz-za-uyazvimosti-privodyashhej-k-utechke-peremennyh-okruzheniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-01-17T15:28:02+00:00","article:modified_time":"2024-01-17T15:28:02+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"112958","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-22 15:29:48","updated":"2026-02-22 15:29:48","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/112958","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=112958"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/112958\/revisions"}],"predecessor-version":[{"id":162209,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/112958\/revisions\/162209"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=112958"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=112958"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=112958"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"