{"id":101282,"date":"2021-09-17T04:22:36","date_gmt":"2021-09-17T02:22:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-travis-ci-privodyashhaya-k-utechke-klyuchej-publichnyh-repozitoriev"},"modified":"2021-09-17T04:22:36","modified_gmt":"2021-09-17T02:22:36","slug":"uyazvimost-v-travis-ci-privodyashhaya-k-utechke-klyuchej-publichnyh-repozitoriev","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-travis-ci-privodyashhaya-k-utechke-klyuchej-publichnyh-repozitoriev","title":{"rendered":"Haavatavus Travis CI-s, mis p\u00f5hjustab avalike repositooriumide v\u00f5tmete leket","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Travis CI pide a s\u00fcntees on testimiseks ja projektide komplekteerimiseks, mida arendatakse GitHubis ja Bitbucketis, tuvastatud turvaprobleem (CVE-2021-41077), mis v\u00f5imaldab avalike hoidlate konfidentsiaalsete keskkonnaparameetrite sisu teada saada, millel on Travis CI. See haavatavus v\u00f5imaldab teada saada Travis CIs kasutatavaid v\u00f5tmeid digitaalsete allkirjade genereerimiseks, ligip\u00e4\u00e4suv\u00f5tmeid ja API-le p\u00f6\u00f6rdumise tokenit. <\/p>\n

Probleem kestis Travis CI-s 3. kuni 10. septembrini. M\u00e4rkimisv\u00e4\u00e4rne on, et teave haavatavuse kohta edastati arendajatele 7. septembril, kuid vastuseks saadi ainult standardne soovitus kasutada v\u00f5tmete rotatsiooni. Puudulikust tagasisidest puudutavate probleemide t\u00f5ttu v\u00f5tsid uurijad \u00fchendust GitHubiga ja pakkusid v\u00e4lja Travis musta nimekirja kandmise. Probleem lahendati alles 10. septembril p\u00e4rast rohkete kaebuste esitamist erinevate projektide poolt. P\u00e4rast juhtumit avaldas Travis CI veebisaidil kummalise raporti probleemist, kus selle asemel, et informeerida haavatavuse parandamisest, esitati vaid kontekstist v\u00e4ljas soovitus v\u00f5tmete vahetamisprotsessi kordamiseks. <\/p>\n

P\u00e4rast mitme suure projekti esitatud \u00e4rritust teabe varjamise kohta avaldati Travis CI tugifoorumis p\u00f5hjalikum aruanne, kus hoiatati, et avaliku reposti omandiha j\u00e4tmine pull-request'i kaudu v\u00f5is k\u00e4ivitada koostamisprotsessi ja saada volitamata juurdep\u00e4\u00e4su algse repositooriumi konfidentsiaalsetele keskkonnamuutujatele, mis on seadistatud koostamise ajal «.travis.yml» faili v\u00e4ljade alusel v\u00f5i m\u00e4\u00e4ratud l\u00e4bi Travis CI veebi liidese. Sellised muutujad on salajases vormis ja dekodeeritakse ainult koostamise ajal. Probleem puudutas ainult avalikult kergelt juurdep\u00e4\u00e4setavaid repositooriume, millel on forkid (privaatseid repositooriume r\u00fcnnak ei m\u00f5juta).
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 \u043d\u0435\u043f\u0440\u0435\u0440\u044b\u0432\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 Travis CI, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u043c \u0434\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0440\u0430\u0437\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u043c\u044b\u0445 \u043d\u0430 GitHub \u0438 Bitbucket, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e (CVE-2021-41077), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0437\u043d\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 Travis CI. \u0412 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0437\u043d\u0430\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0435 \u0432 Travis CI \u043a\u043b\u044e\u0447\u0438 \u0434\u043b\u044f \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439, \u043a\u043b\u044e\u0447\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u0442\u043e\u043a\u0435\u043d\u044b \u0434\u043b\u044f \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101282","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus Travis CI-s, mis viib avalike hoidlate v\u00f5tmete lekkimiseni | ProHoster","description":"Travis CI, mis on m\u00f5eldud GitHubis ja Bitbucketis arendatud projektide testimiseks ja ehitamiseks, on tuvastanud turvaprobleemi (CVE-2021-41077), mis v\u00f5imaldab juurdep\u00e4\u00e4su sisu kohta.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-travis-ci-privodyashhaya-k-utechke-klyuchej-publichnyh-repozitoriev","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Travis CI, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u043a\u043b\u044e\u0447\u0435\u0439 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 | ProHoster","og:description":"\u0412 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 \u043d\u0435\u043f\u0440\u0435\u0440\u044b\u0432\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 Travis CI, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u043c \u0434\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0440\u0430\u0437\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u043c\u044b\u0445 \u043d\u0430 GitHub \u0438 Bitbucket, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e (CVE-2021-41077), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0437\u043d\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-travis-ci-privodyashhaya-k-utechke-klyuchej-publichnyh-repozitoriev","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-17T02:22:36+00:00","article:modified_time":"2021-09-17T02:22:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101282","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-17 02:23:32","updated":"2022-09-29 06:14:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101282","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=101282"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101282\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=101282"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=101282"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=101282"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}