{"id":100945,"date":"2021-08-08T16:22:46","date_gmt":"2021-08-08T14:22:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-setevyh-bibliotekah-yazykov-rust-i-go-pozvolyayushhaya-obojti-proverku-ip-adresov"},"modified":"2021-08-08T16:22:46","modified_gmt":"2021-08-08T14:22:47","slug":"uyazvimost-v-setevyh-bibliotekah-yazykov-rust-i-go-pozvolyayushhaya-obojti-proverku-ip-adresov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-setevyh-bibliotekah-yazykov-rust-i-go-pozvolyayushhaya-obojti-proverku-ip-adresov","title":{"rendered":"Haavatavus Rusti ja Go keelte v\u00f5rguraamatukogudes, mis v\u00f5imaldab IP-aadresside kontrolli m\u00f6\u00f6da hiilida","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Rusti ja Go standardraamatukogudes on tuvastatud haavatavused, mis on seotud IP-aadresside vale t\u00f6\u00f6tlemisega, kui need sisaldavad kaheksandikke, aadressi parsimise funktsioonides. Need haavatavused v\u00f5imaldavad m\u00f6\u00f6da minna rakendustes kehtestatud lubatud aadresside kontrollidest, n\u00e4iteks suunates p\u00e4ringud loopback-liidesete (127.x.x.x) v\u00f5i intraneti alamv\u00f5rkude poole SSRF (Server-side request forgery) r\u00fcnnakute k\u00e4igus. Need haavatavused j\u00e4tkavad probleeme, mida on varem tuvastatud node-netmask (JavaScript, CVE-2021-28918, CVE-2021-29418), private-ip (JavaScript, CVE-2020-28360), ipaddress (Python, CVE-2021-29921), Data::Validate::IP (Perl, CVE-2021-29662) ja Net::Netmask (Perl, CVE-2021-29424) raamatukogudes. <\/p>\n

Vastavalt spetsifikatsioonile peavad stringiv\u00e4\u00e4rtused IP-aadresse<\/a>, nullist alates nullist, tuleks t\u00f5lgendada oktaalsete arvudena, kuid paljud raamatukogud ei arvestanud seda omadust ja lihtsalt k\u00f5rvaldavad nulli, k\u00e4sitledes v\u00e4\u00e4rtust kui k\u00fcmnends\u00fcsteemi arvu. N\u00e4iteks oktaals\u00fcsteemis olev number 0177 on k\u00fcmnends\u00fcsteemis 127. R\u00fcndaja v\u00f5ib taotleda ressurssi, m\u00e4rkides v\u00e4\u00e4rtuse «0177.0.0.1», mis k\u00fcmnends\u00fcsteemi esituses vastab «127.0.0.1». Probleemse raamatukogu kasutamisel ei m\u00e4\u00e4ra rakendus, et aadress 0177.0.0.1 kuulub alamv\u00f5rku 127.0.0.1\/8, kuid tegelikult v\u00f5ib taotluse saatmisel toimida aadressile «0177.0.0.1», mille v\u00f5rgufunktsioonid t\u00f6\u00f6tlevad kui 127.0.0.1. Sarnasel viisil saab petta ka sissetulevaid aadresside kontrollimist, m\u00e4rkides v\u00e4\u00e4rtused nagu «012.0.0.1» (samav\u00e4\u00e4rne «10.0.0.1»). <\/p>\n

Rustis oli probleem standardraamatukogus «std::net» (CVE-2021-29922). Selle raamatukogu IP-aadressi parser k\u00f5rvaldaks nulli aadressi v\u00e4\u00e4rtuste ees, vaid ainult siis, kui on m\u00e4rgitud mitte rohkem kui kolm numbrit, n\u00e4iteks «0177.0.0.1» loetakse kehtetuks, kuid 010.8.8.8 ja 127.0.026.1 korral antakse vale tulemus. Rakendused, mis kasutavad std::net::IpAddr kasutaja m\u00e4\u00e4ratud aadresside anal\u00fc\u00fcsimisel, on potentsiaalselt vastuv\u00f5tlikud SSRF (Server-side request forgery), RFI (Remote File Inclusion) ja LFI (Local File Inclusion) r\u00fcnnakutele. Haavatavus on k\u00f5rvaldatud Rust 1.53.0 versioonis.

\"Haavatavus<\/center> <\/p>\n

Go keeles on probleem standardraamatukogus «net» (CVE-2021-29923). Sisseehitatud funktsioon net.ParseCIDR j\u00e4tab oktaalarvude ees olevad nullid arvestamata. N\u00e4iteks v\u00f5ib r\u00fcndaja edastada v\u00e4\u00e4rtuse 00000177.0.0.1, mis kontrollimisel net.ParseCIDR(00000177.0.0.1\/24) anal\u00fc\u00fcsitakse kui 177.0.0.1\/24, mitte 127.0.0.1\/24. Probleem avaldub ka Kubernetes platvormil. Haavatavus on k\u00f5rvaldatud Go 1.16.3 ja beetaversiooni 1.17 v\u00e4ljaandes.

\"Haavatavus<\/center>
\r\n \"M\u00e4ngi\r\n
<\/div>\r\n <\/div><\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 \u044f\u0437\u044b\u043a\u043e\u0432 Rust \u0438 Go \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0441 \u0432\u043e\u0441\u044c\u043c\u0438\u0440\u0438\u0447\u043d\u044b\u043c\u0438 \u0446\u0438\u0444\u0440\u0430\u043c\u0438 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u0445 \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0430\u0434\u0440\u0435\u0441\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u044b\u0445 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a \u0430\u0434\u0440\u0435\u0441\u0430\u043c loopback-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 (127.x.x.x) \u0438\u043b\u0438 \u0438\u043d\u0442\u0440\u0430\u043d\u0435\u0442-\u043f\u043e\u0434\u0441\u0435\u0442\u044f\u043c \u043f\u0440\u0438 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u0430\u0442\u0430\u043a SSRF (Server-side request forgery). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0446\u0438\u043a\u043b \u043f\u0440\u043e\u0431\u043b\u0435\u043c, \u0440\u0430\u043d\u0435\u0435 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 node-netmask […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":100946,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100945","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus Rusti ja Go keelte v\u00f5rguteekides, mis v\u00f5imaldab IP-aadressi kontrollimisest m\u00f6\u00f6da hiilida | ProHoster","description":"Keelte Rust ja Go standardteekides on tuvastatud haavatavused, mis on seotud IP-aadresside valesti t\u00f6\u00f6tlemisega, kui need sisaldavad kaheksandike numbreid aadresside anal\u00fc\u00fcsi funktsioonides.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-setevyh-bibliotekah-yazykov-rust-i-go-pozvolyayushhaya-obojti-proverku-ip-adresov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 \u044f\u0437\u044b\u043a\u043e\u0432 Rust \u0438 Go, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 | ProHoster","og:description":"\u0412 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 \u044f\u0437\u044b\u043a\u043e\u0432 Rust \u0438 Go \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0441 \u0432\u043e\u0441\u044c\u043c\u0438\u0440\u0438\u0447\u043d\u044b\u043c\u0438 \u0446\u0438\u0444\u0440\u0430\u043c\u0438 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u0445 \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0430\u0434\u0440\u0435\u0441\u0430.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-setevyh-bibliotekah-yazykov-rust-i-go-pozvolyayushhaya-obojti-proverku-ip-adresov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-08-08T14:22:47+00:00","article:modified_time":"2021-08-08T14:22:47+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100945","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-08-08 15:21:11","updated":"2026-02-08 20:40:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/100945","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=100945"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/100945\/revisions"}],"predecessor-version":[{"id":158030,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/100945\/revisions\/158030"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/100946"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=100945"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=100945"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=100945"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}