{"id":122827,"date":"2025-03-25T04:22:52","date_gmt":"2025-03-25T02:22:52","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse"},"modified":"2025-03-25T04:22:52","modified_gmt":"2025-03-25T02:22:52","slug":"uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse","title":{"rendered":"S\u00e5rbarheder i Pagure og OBS, der tillod kompromittering af pakker i Fedora- og openSUSE-repositorier","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Sikkerhedsforskere fra firmaet Fenrisk har afsl\u00f8ret oplysninger om s\u00e5rbarheder i v\u00e6rkt\u00f8jerne Pagure og OBS (Open Build Service), som gjorde det muligt at kompromittere infrastrukturerne til pakkeopbygning for Fedora- og openSUSE-distributionerne. Forskere har vist muligheden for at udf\u00f8re angreb for at eksekvere vilk\u00e5rlig kode p\u00e5 servere med Pagure og OBS, hvilket kunne bruges til at inds\u00e6tte \u00e6ndringer i pakkerne i Fedora- og openSUSE-repositorierne.     <\/p>\n<p>Der er identificeret 4 s\u00e5rbarheder p\u00e5 Pagure-platformen, der anvendes i Fedora til samarbejde om kode og pakke-metadata. For at udnytte de identificerede problemer kr\u00e6ves der en konto i Pagure, som enhver kan opn\u00e5 (der er i \u00f8jeblikket registreret 24899 brugere p\u00e5 Pagure.io). Tre problemer muligg\u00f8r l\u00e6sning af filer p\u00e5 systemet, og et problem tillader eksekvering af egen kode p\u00e5 <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/da\/server\/dts-newyork\/\"   title=\"serveren\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2806\">serveren<\/a>. Problemerne blev opdaget den 1. januar 2024, rapporteret via bugzilla.redhat.com den 25. april 2024 og rettet i Pagure p\u00e5 3 timer.    <\/p>\n<ul>\n<li class=\"l\"> S\u00e5rbarhederne CVE-2024-4981 og CVE-2024-47515 skyldes forkert h\u00e5ndtering af symbolske links i filopdaterings- og arkiveringsfunktioner. S\u00e5rbarhederne g\u00f8r det muligt at l\u00e6se indholdet af lokale filer p\u00e5 serveren, for eksempel kan man f\u00e5 indsigt i indholdet af filen med administrator-sessionens parametre i Pagure og f\u00e5 adgang med hans rettigheder. Udnyttelsen af s\u00e5rbarheden i funktionen _update_file_in_git() indeb\u00e6rer at oprette et repository i Pagure; tilf\u00f8je en commit med en ny fil, der er oprettet som et symbolsk link til den \u00f8nskede systemfil; \u00e5bne denne fil til redigering i webgr\u00e6nsefladen.\n<li class=\"l\"> S\u00e5rbarhed (CVE-2024-4982) i funktionen view_issue_raw_file() g\u00f8r det muligt at g\u00e5 uden for grundmappen ved at angive tegnene \u00ab\/..\u00bb i parametrene for den anmodede Issue. Problemet muligg\u00f8r l\u00e6sning af filer i systemet, alt afh\u00e6ngig af de adgangsrettigheder, som processen, hvorunder webgr\u00e6nsefladen k\u00f8rer, har. For eksempel kan man for at se filen \/etc\/passwd \u00e5bne siden \u00abhttp:\/\/pagure.local:5000\/your-repository\/issue\/raw\/....\/....\/....\/....\/....\/....\/....\/etc\/passwd\u00bb.\n<li class=\"l\"> S\u00e5rbarhed (CVE-2024-47516) i funktionen PagureRepo.log() muligg\u00f8r, at angriberen kan inds\u00e6tte egne kommandoer og udf\u00f8re kode p\u00e5 serveren. Problemet opst\u00e5r, fordi kommandolinjen ved visningen af filhistorikken via webgr\u00e6nsefladen kalder kommandoen \u00abgit\u00bb med overf\u00f8rsel af grenens ID til kommandolinjen (for eksempel \u00ab\/usr\/bin\/git \u2014pretty=oneline \u2014abbrev-commit  \u2014 README.md\u00bb). Gyldigheden af ID'et kontrolleres ikke, s\u00e5 man kan i stedet overf\u00f8re enhver kommandolinjeoption, for eksempel \u00ab\u2014output=\/tmp\/foo.bar\u00bb for at omdirigere output til en fil. Angriberen kan overskrive en fil i systemet ved at sende en anmodning af f\u00f8lgende art: http:\/\/pagure.local:5000\/test\/history\/README.md?identifier=\u2014output=\/tmp\/foo.bar.\n<p>Pagure k\u00f8rer som brugeren git, derfor kan man kun overskrive filer, som tilh\u00f8rer denne bruger. For at udf\u00f8re sin egen kode p\u00e5 serveren kan man bruge en tjeneste til adgang til repository via SSH, hvilket tilg\u00e5r kommandoen \u00abbash -c \/usr\/libexec\/pagure\/aclchecker.py\u00bb. Angriberen kan udnytte s\u00e5rbarheden til at overskrive filen \u00ab\/srv\/git\/.bashrc\u00bb, og denne fil vil blive k\u00f8rt af bash-shell'et, n\u00e5r man tilg\u00e5r repository via SSH.      <\/p>\n<p>Angrebet involverer at registrere sig i systemet Pagure, oprette et repository, tilf\u00f8je en README.md-fil til repositoryet med en commit-beskrivelse, der ser s\u00e5dan ud: \u00ab|| \/bin\/bash\u00bb, og sende en anmodning \u00abhttp:\/\/pagure.local:5000\/test\/history\/README.md?identifier=\u2014output=\/srv\/git\/.bashrc\u00bb. I l\u00f8bet af disse trin vil linjen \u00ab34\u04305\u044143 || \/bin\/bash\u00bb blive skrevet til filen \u00ab\/srv\/git\/.bashrc\u00bb. For at k\u00f8re den oprettede fil \u00ab\/srv\/git\/.bashrc\u00bb er det nok at oprette forbindelse til repositoryet via SSH med ens egen konto. Udf\u00f8relsen af kode med brugerrettigheder som git-bruger p\u00e5 Pagure-serveren muligg\u00f8r kontrol over alt indhold i repositories med pakker.    <\/ul>\n<p>    <center><iframe title=\"Pagure\" src=\"https:\/\/player.vimeo.com\/video\/1066145210?h=0716980f9b\" width=\"640\" height=\"360\" frameborder=\"0\" allowfullscreen style =\"max-width: 100%;\" loading=\"lazy\"><\/iframe><\/center>        <\/p>\n<p>I platformen OBS (Open Build Service), der anvendes i openSUSE og nogle andre distributioner til pakkeh\u00e5ndtering, er der identificeret en s\u00e5rbarhed (CVE-2024-22033), der muligg\u00f8r udf\u00f8relse af egen kode p\u00e5 serveren. S\u00e5rbarheden blev identificeret den 27. juni 2024, rapporteret til openSUSE-projektet den 29. juni og rettet den 10. juli.    <\/p>\n<p>S\u00e5rbarheden findes i tjenesten &#171;obs-service-download_url&#187;, hvor der ikke var tilstr\u00e6kkelig kontrol af URL'en, der anvendes ved k\u00f8rsel af wget-v\u00e6rkt\u00f8jet fra et script, der downloader kildekoden til OBS. Angriberen kan angive en konfiguration i OBS, hvor URL'en til download af koden erstattes med en kommandolinjeparameter til wget, for eksempel:       &lt;services&gt;     &lt;service name=&#187;download_url&#187;&gt;     &lt;param name=&#187;url&#187;&gt;&#8212;output-document=\\\/tmp\\\/test&lt;\\\/param&gt;     &lt;param name=&#187;download-manifest&#187;&gt;tempfile&lt;\\\/param&gt;     &lt;\\\/service&gt;     &lt;\\\/services&gt;      <\/p>\n<p> For at omg\u00e5 fejlen ved at fors\u00f8ge at k\u00f8re wget uden URL, viser eksemplet muligheden &#171;download-manifest&#187;, som tillader angiver en liste af URL'er i en separat fil. Det ovenfor n\u00e6vnte eksempel vil f\u00f8re til k\u00f8rsel af kommandoen:       \\\/usr\\\/bin\\\/wget -i \\\/srv\\\/obs\\\/service\\\/XXXXX\\\/src\\\/tempfile -4 &#8212;output-document=\\\/tmp\\\/test    <\/p>\n<p>som tillader at skrive indholdet, der hentes fra linket angivet i filen \\\/srv\\\/obs\\\/service\\\/XXXXX\\\/src\\\/tempfile, til filen \\\/tmp\\\/test fra koden, der blev hentet af angriberen i OBS via interface build.opensuse.org, som tillader fri registrering. Udover at overskrive filen p\u00e5 serveren, kan angriberen ogs\u00e5 sende sig selv enhver fil ved at angive muligheden &#171;&#8212;output-document&#187; som &#171;&#8212;post-file&#187;, for eksempel &#171;&#8212;post-file=\\\/etc\\\/passwd&#187;. Dermed kan angriberen l\u00e6se og skrive filer p\u00e5 serveren, s\u00e5 l\u00e6nge adgangsrettighederne tillader det under den bruger, der k\u00f8rer OBS-tjenesten.    <\/p>\n<p>For at omdanne muligheden for skrivning til en fil til udf\u00f8relse af kode p\u00e5 serveren, foreslog forskerne en metode, der best\u00e5r af to trin. De to trin er n\u00f8dvendige, s\u00e5 angriberen kan oprette en fil &#171;.wgetrc&#187; med indstillinger til wget, men det er ikke tilstr\u00e6kkeligt til at udf\u00f8re kommandoer. Men gennem &#171;.wgetrc&#187; kan der skabes betingelser for at udf\u00f8re ethvert program i systemet, men uden at videregive argumenter til det. For at k\u00f8re vilk\u00e5rlig kode foresl\u00e5s det at k\u00f8re programmet &#171;prove&#187;, som behandler konfigurationsfilen &#171;.proverc&#187;, der tillader angivelse af muligheden &#171;&#8212;exec&#187; for at udf\u00f8re enhver kode.     <\/p>\n<p>I det f\u00f8rste trin oprettes der en fil ved navn \".proverc\" i brugerens hjemmekatalog \".obsservicerun\", via de ovenfor n\u00e6vnte manipulationer med \"download-manifest\". Denne fil indeholder kommandoer, der vil blive udf\u00f8rt ved opstart af processen \"prove\". I det andet trin oprettes en fil ved navn \".wgetrc\" med parameteren \"use-askpass=\/usr\/bin\/prove\", som f\u00f8rer til kald af \"prove\". N\u00e5r disse filer er blevet oprettet, er det tilstr\u00e6kkeligt at skabe betingelser for at hente eventuelle data ved hj\u00e6lp af wget, hvilket vil medf\u00f8re, at angriberens kode k\u00f8res p\u00e5 serveren med brugeren \"obsservicerun\"'s rettigheder. Brugeren \"obsservicerun\"'s rettigheder er tilstr\u00e6kkelige til at udtr\u00e6kke n\u00f8gler fra de repositorier, der anvendes af OBS-brugere til at bekr\u00e6fte pakker.     <center>  <iframe title=\"Open Build Service\" src=\"https:\/\/player.vimeo.com\/video\/1066093605?h=d7a210d719\" width=\"640\" height=\"360\" frameborder=\"0\" allowfullscreen style =\"max-width: 100%;\" loading=\"lazy\"><\/iframe><\/center>    <\/p>\n<p>Till\u00e6g: SUSE Product Security-teamet mener, at faren ved s\u00e5rbarheden i OBS er overvurderet, og at forskernes p\u00e5stand om, at problemet giver mulighed for kompromittering af alle pakker i openSUSE-distributionen, ikke er korrekt. Det bem\u00e6rkes, at tjenesterne i infrastrukturen build.opensuse.org k\u00f8rer i isolerede containere, der genskabes og ikke indeholder kritisk information. Den identificerede s\u00e5rbarhed vurderes som farlig, men ikke tilstr\u00e6kkelig til at kompromittere openSUSE's bygning infrastruktur og de genererede pakker. Derudover n\u00e6vnes det, at handlinger i OBS-gr\u00e6nsefladen, som beskrevet i angrebseksemplet, kun kunne udf\u00f8res p\u00e5 en lokalt installeret version af OBS p\u00e5 udviklerens arbejdsstation.<br \/>\n<br \/>Kilde: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=62928\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Fenrisk \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 Pagure \u0438 OBS (Open Build Service), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0445 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 Fedora \u0438 openSUSE. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0441 Pagure \u0438 OBS, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 Fedora \u0438 openSUSE. [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-122827","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Fenrisk \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 Pagure \u0438 OBS (Open Build Service), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0445 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"da_DK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Pagure \u0438 OBS, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u0432\u0448\u0438\u0435 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 Fedora \u0438 openSUSE | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Fenrisk \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 Pagure \u0438 OBS (Open Build Service), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0445 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-03-25T02:22:52+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2025-03-25T02:22:52+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarheder i Pagure og OBS, der tillod kompromittering af pakker i Fedora og openSUSE repositories | ProHoster","description":"Sikkerhedsforskere fra Fenrisk har afsl\u00f8ret oplysninger om s\u00e5rbarheder i v\u00e6rkt\u00f8jer fra Pagure og OBS (Open Build Service), som tillod kompromittering af pakkeopbygningsinfrastrukturer.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Pagure \u0438 OBS, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u0432\u0448\u0438\u0435 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 Fedora \u0438 openSUSE | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Fenrisk \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 Pagure \u0438 OBS (Open Build Service), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0445 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-03-25T02:22:52+00:00","article:modified_time":"2025-03-25T02:22:52+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"122827","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:07:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 11:32:22","updated":"2026-02-09 22:07:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/122827","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=122827"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/122827\/revisions"}],"predecessor-version":[{"id":160086,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/122827\/revisions\/160086"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=122827"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=122827"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=122827"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}