{"id":86563,"date":"2020-06-27T01:42:01","date_gmt":"2020-06-26T23:42:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-curl-7-71-0-s-ustraneniem-dvuh-uyazvimostej"},"modified":"2020-06-27T01:42:01","modified_gmt":"2020-06-26T23:42:01","slug":"vypusk-curl-7-71-0-s-ustraneniem-dvuh-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/de\/blog\/news\/vypusk-curl-7-71-0-s-ustraneniem-dvuh-uyazvimostej","title":{"rendered":"Ver\u00f6ffentlichung von curl 7.71.0 mit der Behebung von zwei Sicherheitsanf\u00e4lligkeiten","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/curl.haxx.se\/mail\/archive-2020-06\/0055.html\">Verf\u00fcgbar<\/a><\/noindex> neue Version des Dienstprogramms zum Senden und Empfangen von Daten \u00fcber das Netzwerk \u2014 <noindex><a rel=\"nofollow\" href=\"https:\/\/curl.haxx.se\/\">curl 7.71.0<\/a><\/noindex>, das die flexible Erstellung von Anfragen erm\u00f6glicht, einschlie\u00dflich der Angabe von Parametern wie Cookie, User-Agent, Referer und anderen Headern. cURL unterst\u00fctzt HTTP, HTTPS, HTTP\/2.0, HTTP\/3, SMTP, IMAP, POP3, Telnet, FTP, LDAP, RTSP, RTMP und andere Netzwerkprotokolle. Gleichzeitig wurde ein Update der parallel entwickelten Bibliothek libcurl ver\u00f6ffentlicht, die eine API bereitstellt, um alle Funktionen von curl in Programmen in Sprachen wie C, Perl, PHP, Python zu nutzen. <\/p>\n<p>In der neuen Version wurde die Option \u201e\u2014retry-all-errors\u201c hinzugef\u00fcgt, um Wiederholungsversuche bei Auftreten von Fehlern durchzuf\u00fchren, und es wurden zwei Sicherheitsanf\u00e4lligkeiten behoben:<\/p>\n<ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openwall.com\/lists\/oss-security\/2020\/06\/24\/2\">Sicherheitsanf\u00e4lligkeit<\/a><\/noindex> <noindex><a rel=\"nofollow\" href=\"https:\/\/curl.haxx.se\/docs\/CVE-2020-8177.html)\">CVE-2020-8177<\/a><\/noindex> sie erm\u00f6glicht das \u00dcberschreiben einer lokalen Datei im System, wenn auf einen vom Angreifer kontrollierten Server zugegriffen wird. Das Problem tritt nur beim gleichzeitigen Gebrauch der Optionen \u201e-J\u201c (\u201e\u2014remote-header-name\u201c) und \u201e-i\u201c (\u201e\u2014head\u201c) auf. Die Option \u201e-J\u201c erlaubt es, die Datei unter dem im Header angegebenen Namen zu speichern.<br \/>\n\u201eContent-Disposition\u201c. Wenn eine Datei mit diesem Namen bereits existiert, verweigert das Programm curl normalerweise das \u00dcberschreiben. Bei Verwendung der Option \u201e-i\u201c wird jedoch die Logik der \u00dcberpr\u00fcfung verletzt und die Datei wird \u00fcberschrieben (die \u00dcberpr\u00fcfung erfolgt beim Empfangen des Antwortk\u00f6rpers, aber bei der Option \u201e-i\u201c werden zuerst die HTTP-Header ausgegeben, und diese werden gespeichert, bevor der Antwortk\u00f6rper bearbeitet wird). In die Datei werden nur HTTP-Header geschrieben, aber der Server kann anstelle der Header beliebige Daten zur\u00fcckgeben, und diese werden ebenfalls gespeichert.<\/p>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openwall.com\/lists\/oss-security\/2020\/06\/24\/1\">Sicherheitsanf\u00e4lligkeit<\/a><\/noindex> <noindex><a rel=\"nofollow\" href=\"https:\/\/curl.haxx.se\/docs\/CVE-2020-8169.html\">CVE-2020-8169<\/a><\/noindex>  \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440 DNS \u0447\u0430\u0441\u0442\u0438 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0430\u0439\u0442\u0443 (Basic, Digest, NTLM \u0438 \u0442.\u043f.). \u041f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u0430 &#171;@&#187; \u0432 \u043f\u0430\u0440\u043e\u043b\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0440\u0430\u0437\u0434\u0435\u043b\u0438\u0442\u0435\u043b\u044f \u043f\u0430\u0440\u043e\u043b\u044f \u0432 URL, \u043f\u0440\u0438 \u0441\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u043d\u0438\u0438 HTTP-\u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f curl \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442 \u0447\u0430\u0441\u0442\u044c \u043f\u0430\u0440\u043e\u043b\u044f \u043f\u043e\u0441\u043b\u0435 \u0441\u0438\u043c\u0432\u043e\u043b\u0430 &#171;@&#187; \u0432\u043c\u0435\u0441\u0442\u0435 \u0441 \u0434\u043e\u043c\u0435\u043d\u043e\u043c \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0438\u043c\u0435\u043d\u0438. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u0438 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u0438 \u043f\u0430\u0440\u043e\u043b\u044f &#171;passw@rd123&#187; \u0438 \u0438\u043c\u0435\u043d\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f &#171;dan&#187;,  curl \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u0443\u0435\u0442 URL &#171;https:\/\/dan:passw@rd123@example.com\/path&#187; \u0432\u043c\u0435\u0441\u0442\u043e &#171;https:\/\/dan:passw%40rd123@example.com\/path&#187; \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442 \u0437\u0430\u043f\u0440\u043e\u0441 \u043d\u0430 \u0440\u0435\u0437\u043e\u043b\u0432\u0438\u043d\u0433 \u0445\u043e\u0441\u0442\u0430 &#171;rd123@example.com&#187; \u0432\u043c\u0435\u0441\u0442\u043e  &#171;example.com&#187;.\n<p>Das Problem tritt auf, wenn die Unterst\u00fctzung f\u00fcr relative HTTP-Redirects aktiviert ist (deaktiviert \u00fcber CURLOPT_FOLLOWLOCATION). Bei Verwendung traditioneller DNS kann der DNS-Anbieter und ein Angreifer, der in der Lage ist, den transitiven Netzwerkverkehr abzufangen, Informationen \u00fcber einen Teil des Passworts erhalten (selbst wenn die urspr\u00fcngliche Anfrage \u00fcber HTTPS war, da DNS-Verkehr nicht verschl\u00fcsselt wird). Bei der Anwendung von DNS-over-HTTPS (DoH) wird das Risiko auf den DoH-Anbieter beschr\u00e4nkt.<\/p>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Quelle: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53239\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e \u0441\u0435\u0442\u0438 &#8212; curl 7.71.0, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0433\u0438\u0431\u043a\u043e\u0433\u043e \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0441 \u0437\u0430\u0434\u0430\u043d\u0438\u0435\u043c \u0442\u0430\u043a\u0438\u0445 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432, \u043a\u0430\u043a cookie, user_agent, referer \u0438 \u043b\u044e\u0431\u044b\u0445 \u0434\u0440\u0443\u0433\u0438\u0445 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432. cURL \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 HTTP, HTTPS, HTTP\/2.0, HTTP\/3, SMTP, IMAP, POP3, Telnet, FTP, LDAP, RTSP, RTMP \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u044b. \u041e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0432\u044b\u0448\u043b\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-86563","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e \u0441\u0435\u0442\u0438 -\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/de\/blog\/news\/vypusk-curl-7-71-0-s-ustraneniem-dvuh-uyazvimostej\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"de_DE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a curl 7.71.0 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e \u0441\u0435\u0442\u0438 -\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/de\/blog\/news\/vypusk-curl-7-71-0-s-ustraneniem-dvuh-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-06-26T23:42:01+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-06-26T23:42:01+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ver\u00f6ffentlichung von curl 7.71.0 mit der Behebung von zwei Sicherheitsanf\u00e4lligkeiten | ProHoster","description":"Eine neue Version des Dienstprogramms zum Empfangen und Senden von Daten \u00fcber das Netzwerk ist verf\u00fcgbar -","canonical_url":"https:\/\/prohoster.info\/de\/blog\/news\/vypusk-curl-7-71-0-s-ustraneniem-dvuh-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"de_DE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a curl 7.71.0 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e \u0441\u0435\u0442\u0438 -","og:url":"https:\/\/prohoster.info\/de\/blog\/news\/vypusk-curl-7-71-0-s-ustraneniem-dvuh-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-26T23:42:01+00:00","article:modified_time":"2020-06-26T23:42:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"86563","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:13:22","updated":"2022-09-28 00:04:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts\/86563","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/comments?post=86563"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts\/86563\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/media?parent=86563"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/categories?post=86563"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/tags?post=86563"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}