{"id":99606,"date":"2021-03-29T22:22:34","date_gmt":"2021-03-29T20:22:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-git-repozitorii-proekta-php-vyyavleny-vredonosnye-izmeneniya"},"modified":"2021-03-29T22:22:34","modified_gmt":"2021-03-29T20:22:34","slug":"v-git-repozitorii-proekta-php-vyyavleny-vredonosnye-izmeneniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/v-git-repozitorii-proekta-php-vyyavleny-vredonosnye-izmeneniya","title":{"rendered":"V Gitov\u00e9m repozit\u00e1\u0159i projektu PHP byly zji\u0161t\u011bny \u0161kodliv\u00e9 zm\u011bny","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdvoj\u00e1\u0159i projektu PHP varovali p\u0159ed kompromitac\u00ed Gitov\u00e9ho repozit\u00e1\u0159e projektu a objevili dv\u011b \u0161kodliv\u00e9 commity, kter\u00e9 byly p\u0159id\u00e1ny 28. b\u0159ezna do repozit\u00e1\u0159e php-src jm\u00e9nem Rasmuse Lerdorfa, zakladatele PHP, a Nikity Popova, jednoho z kl\u00ed\u010dov\u00fdch v\u00fdvoj\u00e1\u0159\u016f PHP. <\/p>\n

Jeliko\u017e nen\u00ed jistota v d\u016fv\u011bryhodnosti serveru, na kter\u00e9m byl Gitov\u00fd repozit\u00e1\u0159 um\u00edst\u011bn, rozhodli se v\u00fdvoj\u00e1\u0159i, \u017ee udr\u017eov\u00e1n\u00ed Gitov\u00e9 infrastruktury sv\u00e9pomoc\u00ed p\u0159edstavuje dal\u0161\u00ed bezpe\u010dnostn\u00ed rizika, a p\u0159enesli referen\u010dn\u00ed repozit\u00e1\u0159 na platformu GitHub, kterou se doporu\u010duje pou\u017e\u00edvat jako prim\u00e1rn\u00ed. V\u0161echny zm\u011bny by nyn\u00ed m\u011bly b\u00fdt odes\u00edl\u00e1ny na GitHub, nikoli na git.php.net, v\u010detn\u011b vyu\u017eit\u00ed webov\u00e9ho rozhran\u00ed GitHub p\u0159i v\u00fdvoji. <\/p>\n

V prvn\u00edm \u0161kodliv\u00e9m commitu pod z\u00e1minkou opravy p\u0159eklepu v souboru ext\/zlib\/zlib.c byla provedena zm\u011bna, kter\u00e1 spou\u0161t\u00ed PHP k\u00f3d zaslan\u00fd v HTTP hlavi\u010dce User Agent, pokud obsah za\u010d\u00edn\u00e1 slovem \u201ezerodium\u201c. Pot\u00e9, co v\u00fdvoj\u00e1\u0159i zaznamenali \u0161kodlivou zm\u011bnu a zru\u0161ili ji, se v repozit\u00e1\u0159i objevil druh\u00fd commit, kter\u00fd zru\u0161il akci v\u00fdvoj\u00e1\u0159\u016f PHP a vr\u00e1til \u0161kodlivou zm\u011bnu. <\/p>\n

V p\u0159idan\u00e9m k\u00f3du se nach\u00e1z\u00ed \u0159\u00e1dek \u201eREMOVETHIS: sold to zerodium, mid 2017\u201c, kter\u00fd m\u016f\u017ee nazna\u010dovat, \u017ee od roku 2017 se v k\u00f3du nach\u00e1z\u00ed jin\u00e1, kvalitativn\u011b zakamuflovan\u00e1, \u0161kodliv\u00e1 zm\u011bna nebo neopraviteln\u00e1 zranitelnost, prodan\u00e1 spole\u010dnosti Zerodium, kter\u00e1 se zab\u00fdv\u00e1 n\u00e1kupem 0-day zranitelnost\u00ed (spole\u010dnost Zerodium uvedla, \u017ee nekoupila informace o zranitelnosti v PHP). <\/p>\n

V sou\u010dasn\u00e9 dob\u011b st\u00e1le nejsou k dispozici podrobn\u00e9 informace o incidentu, p\u0159edpokl\u00e1d\u00e1 se pouze, \u017ee zm\u011bny byly p\u0159id\u00e1ny v d\u016fsledku hacknut\u00ed git.php.net, nikoli kompromitace jednotliv\u00fdch \u00fa\u010dt\u016f v\u00fdvoj\u00e1\u0159\u016f. Anal\u00fdza repozit\u00e1\u0159e na p\u0159\u00edtomnost dal\u0161\u00edch \u0161kodliv\u00fdch zm\u011bn krom\u011b zji\u0161t\u011bn\u00fdch probl\u00e9m\u016f ji\u017e za\u010dala. K recenzov\u00e1n\u00ed jsou zv\u00e1ni v\u0161ichni z\u00e1jemci, p\u0159i nalezen\u00ed podez\u0159el\u00fdch zm\u011bn je nutn\u00e9 zaslat informace na security@php.net. serveru<\/a> git.php.net, a nikoli k kompromitaci jednotliv\u00fdch \u00fa\u010dt\u016f v\u00fdvoj\u00e1\u0159\u016f. Byla zah\u00e1jena anal\u00fdza repozit\u00e1\u0159e na p\u0159\u00edtomnost dal\u0161\u00edch \u0161kodliv\u00fdch zm\u011bn vedle zji\u0161t\u011bn\u00fdch probl\u00e9m\u016f. K recenzov\u00e1n\u00ed jsou zv\u00e1ni v\u0161ichni, p\u0159i zji\u0161t\u011bn\u00ed podez\u0159el\u00fdch zm\u011bn je t\u0159eba zaslat informace na security@php.net. <\/p>\n

Pokud jde o p\u0159echod na GitHub, pro z\u00edsk\u00e1n\u00ed pr\u00e1v pro z\u00e1pis do nov\u00e9ho repozit\u00e1\u0159e mus\u00ed \u010dlenov\u00e9 v\u00fdvoje vstoupit do organizace PHP. Ti, kte\u0159\u00ed nejsou zahrnuti mezi v\u00fdvoj\u00e1\u0159e PHP na GitHubu, by se m\u011bli obr\u00e1tit na Nikitu Popova na email nikic@php.net. Pro p\u0159id\u00e1n\u00ed je nezbytn\u00e9 povolen\u00ed dvoufaktorov\u00e9 autentizace. Po z\u00edsk\u00e1n\u00ed p\u0159\u00edslu\u0161n\u00fdch pr\u00e1v je t\u0159eba prov\u00e9st p\u0159\u00edkaz \u201egit remote set-url origin git@github.com:php\/php-src.git\u201c. D\u00e1le se zva\u017euje p\u0159echod k povinn\u00e9mu podepisov\u00e1n\u00ed commit\u016f digit\u00e1ln\u00edm podpisem v\u00fdvoj\u00e1\u0159e. Tak\u00e9 se navrhuje zak\u00e1zat p\u0159\u00edm\u00e9 p\u0159id\u00e1v\u00e1n\u00ed zm\u011bn, kter\u00e9 nepro\u0161ly p\u0159edchoz\u00edm p\u0159ezkoum\u00e1n\u00edm.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0434\u0432\u0443\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 28 \u043c\u0430\u0440\u0442\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 php-src \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0420\u0430\u0441\u043c\u0443\u0441\u0430 \u041b\u0435\u0440\u0434\u043e\u0440\u0444\u0430, \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044f PHP, \u0438 \u041d\u0438\u043a\u0438\u0442\u044b \u041f\u043e\u043f\u043e\u0432\u0430, \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043a\u043b\u044e\u0447\u0435\u0432\u044b\u0445 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 PHP. \u0422\u0430\u043a \u043a\u0430\u043a \u043d\u0435\u0442 \u0443\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0432 \u043d\u0430\u0434\u0451\u0436\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0431\u044b\u043b \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0440\u0435\u0448\u0438\u043b\u0438, \u0447\u0442\u043e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0441\u0432\u043e\u0438\u043c\u0438 \u0441\u0438\u043b\u0430\u043c\u0438 Git-\u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0441\u043e\u0437\u0434\u0430\u0451\u0442 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0440\u0438\u0441\u043a\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99606","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47V Git repozit\u00e1\u0159i projektu PHP byly odhaleny \u0161kodliv\u00e9 zm\u011bny | ProHoster","description":"V\u00fdvoj\u00e1\u0159i projektu PHP varovali p\u0159ed kompromitac\u00ed Git repozit\u00e1\u0159e projektu a objevem dvou \u0161kodliv\u00fdch commit\u016f, kter\u00e9 byly 28. b\u0159ezna p\u0159id\u00e1ny do repozit\u00e1\u0159e php-src jm\u00e9nem Rasmuse Lerdorfa, zakladatele PHP, a Nikity.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/v-git-repozitorii-proekta-php-vyyavleny-vredonosnye-izmeneniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0434\u0432\u0443\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 28 \u043c\u0430\u0440\u0442\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 php-src \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0420\u0430\u0441\u043c\u0443\u0441\u0430 \u041b\u0435\u0440\u0434\u043e\u0440\u0444\u0430, \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044f PHP, \u0438 \u041d\u0438\u043a\u0438\u0442\u044b.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/v-git-repozitorii-proekta-php-vyyavleny-vredonosnye-izmeneniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-03-29T20:22:34+00:00","article:modified_time":"2021-03-29T20:22:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99606","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-29 20:30:58","updated":"2026-02-22 15:29:48","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/99606","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=99606"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/99606\/revisions"}],"predecessor-version":[{"id":162210,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/99606\/revisions\/162210"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=99606"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=99606"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=99606"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}