{"id":104974,"date":"2022-08-31T09:36:39","date_gmt":"2022-08-31T07:36:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vtoraya-za-nedelyu-kriticheskaya-uyazvimost-v-gitlab"},"modified":"2022-08-31T09:36:39","modified_gmt":"2022-08-31T07:36:39","slug":"vtoraya-za-nedelyu-kriticheskaya-uyazvimost-v-gitlab","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/vtoraya-za-nedelyu-kriticheskaya-uyazvimost-v-gitlab","title":{"rendered":"Teine kriitiline turvaprobleem GitLabis selle n\u00e4dala jooksul","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitLab on v\u00e4lja andnud uue rea parandustega v\u00e4rskendusi oma koost\u00f6\u00f6tamise platvormile \u2014 15.3.2, 15.2.4 ja 15.1.6, kus on k\u00f5rvaldatud kriitiline haavatavus (CVE-2022-2992), mis v\u00f5imaldab autentitud kasutajal kaugkood t\u00e4ita serveris. Nagu ka eelmisel n\u00e4dalal parandatud haavatavus CVE-2022-2884, on uus probleem olemas GitHubi andmete importimise API-s. Haavatavus esines ka versioonides 15.3.1, 15.2.3 ja 15.1.5, kus esines esimene GitHubi impordikoodi haavatavus. <\/p>\n

Kasutamise \u00fcksikasju ei ole veel avaldatud. Haavatavuse teave on edastatud GitLabile HackerOne'i praeguse haavatavuste avastamise preemiate programmi raames, kuid erinevalt eelmisest probleemist avastas selle teine osaleja. \u00dcmbersuunamiseks soovitatakse administraatoril keelduda GitHubi impordi funktsioonist (GitLabi veebiliideses: \u00abMen\u00fc\u00fc\u00bb -> \u00abAdmin\u00bb -> \u00abSeaded\u00bb -> \u00ab\u00dcldine\u00bb -> \u00abN\u00e4htavus ja ligip\u00e4\u00e4sukontroll\u00bb -> \u00abImportimise allikad\u00bb -> keelata \u00abGitHub\u00bb). <\/p>\n

Lisaks on soovitatud v\u00e4rskendustes parandatud veel 14 haavatavust, millest kaks on m\u00e4rgitud ohtlikeks, k\u00fcmme on klassifitseeritud m\u00f5\u00f5duka riskiga ja kaks on madala riskiga. Ohtlikeks loetakse: haavatavus CVE-2022-2865, mis v\u00f5imaldab sisestada oma JavaScripti koodi teistele kasutajatele n\u00e4htavatesse lehtedesse v\u00e4rviliste siltide manipuleerimise kaudu, samuti haavatavus CVE-2022-2527, mis v\u00f5imaldab oma sisu sisestada intsidentide ajaskaala (Incidents Timeline) kirjeldusv\u00e4lja kaudu. M\u00f5\u00f5duka riski haavatavused on peamiselt seotud teenuse keeldumise v\u00f5imalustega.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitLab \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u0443\u044e \u0441\u0435\u0440\u0438\u044e \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0441\u0432\u043e\u0435\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 — 15.3.2, 15.2.4 \u0438 15.1.6, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-2992), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041a\u0430\u043a \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2022-2884, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u043d\u0435\u0434\u0435\u043b\u044e \u043d\u0430\u0437\u0430\u0434, \u043d\u043e\u0432\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 API \u0434\u043b\u044f \u0438\u043c\u043f\u043e\u0440\u0442\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438\u0437 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 GitHub. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104974","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Teine kriitiline haavatavus GitLabis selle n\u00e4dala jooksul | ProHoster","description":"GitLab on avaldanud j\u00e4rjekordse seeria parandavaid v\u00e4rskendusi oma koost\u00f6\u00f6 arendusplatvormile - 15.3.2, 15.2.4 ja 15.1.6, mis k\u00f5rvaldavad kriitilise haavatavuse (CVE-2022-2992).","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/vtoraya-za-nedelyu-kriticheskaya-uyazvimost-v-gitlab","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u0442\u043e\u0440\u0430\u044f \u0437\u0430 \u043d\u0435\u0434\u0435\u043b\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 GitLab | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitLab \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u0443\u044e \u0441\u0435\u0440\u0438\u044e \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0441\u0432\u043e\u0435\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 - 15.3.2, 15.2.4 \u0438 15.1.6, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-2992).","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/vtoraya-za-nedelyu-kriticheskaya-uyazvimost-v-gitlab","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-08-31T07:36:39+00:00","article:modified_time":"2022-08-31T07:36:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104974","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-08-31 07:37:51","updated":"2022-09-27 14:58:25","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/104974","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=104974"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/104974\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=104974"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=104974"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=104974"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}