{"id":101282,"date":"2021-09-17T04:22:36","date_gmt":"2021-09-17T02:22:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-travis-ci-privodyashhaya-k-utechke-klyuchej-publichnyh-repozitoriev"},"modified":"2021-09-17T04:22:36","modified_gmt":"2021-09-17T02:22:36","slug":"uyazvimost-v-travis-ci-privodyashhaya-k-utechke-klyuchej-publichnyh-repozitoriev","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-travis-ci-privodyashhaya-k-utechke-klyuchej-publichnyh-repozitoriev","title":{"rendered":"The release of Apache HTTP Server 2.4.49 has been published, featuring 27 changes and addressing 5 vulnerabilities: CVE-2021-33193 - vulnerability of mod_http2 to a new variant of the 'HTTP Request Smuggling' attack.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A security issue (CVE-2021-41077) has been discovered in the Travis CI continuous integration service, designed for testing and building projects developed on GitHub and Bitbucket. This flaw allows the contents of confidential environment variables in public repositories using Travis CI to be exposed. The vulnerability also reveals keys used in Travis CI for generating digital signatures, access keys, and tokens for API calls. <\/p>\n
The issue was present in Travis CI from September 3 to 10. Notably, information about the vulnerability was communicated to developers on September 7, but the only response received was a generic suggestion to implement key rotation. After not receiving adequate feedback, researchers reached out to GitHub and suggested blacklisting Travis. The problem was addressed only on September 10, following numerous complaints from various projects. After the incident, an odd report regarding the issue was published on the Travis CI website, which contained only a context-free recommendation to cyclically change access keys instead of informing users about the vulnerability fix. <\/p>\n
After the outcry over information being concealed, several major projects published a more detailed report in the Travis CI support forum, warning that the owner of a fork of any public repository could initiate the build process by submitting a pull request and gain unauthorized access to confidential environment variables of the original repository, which are set during the build based on fields from the '.travis.yml' file or defined through the Travis CI web interface. Such variables are stored in an encrypted form and decrypted only during the build. The issue was limited to publicly available repositories that have forks (private repositories are not vulnerable to this attack). \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"