{"id":110893,"date":"2023-10-17T09:10:18","date_gmt":"2023-10-17T07:10:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/oczenka-problem-s-soprovozhdeniem-otkrytyh-proektov-i-ispolzovaniem-staryh-zavisimostej"},"modified":"2023-10-17T09:10:18","modified_gmt":"2023-10-17T07:10:19","slug":"oczenka-problem-s-soprovozhdeniem-otkrytyh-proektov-i-ispolzovaniem-staryh-zavisimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/oczenka-problem-s-soprovozhdeniem-otkrytyh-proektov-i-ispolzovaniem-staryh-zavisimostej","title":{"rendered":"Probleemide hindamine avatud projektide hooldamisel ja vanade s\u00f5ltuvuste kasutamisel","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Sonatype, r\u00fcnnaku- ja s\u00f5ltuvuse kaitse spetsialiseerunud ettev\u00f5te, avalikustas uuringu tulemused (PDF, 62 lk), mis k\u00e4sitlevad s\u00f5ltuvuste probleeme ja avatud projektide hooldamist Java, JavaScript, Python ja .NET keeltes, mis on esindatud Maven Central, NPM, PyPl ja Nuget hoidlates. Aasta jooksul on j\u00e4lgitavates avatud \u00f6kos\u00fcsteemides projektide arv keskmiselt suurenenud 29%. 2023. aastal on arutatud hoidlate pakettide allalaadimiste arv kasvanud 33%, kuid v\u00f5rdluseks, 2021. aastal suurenes allalaadimiste arv 73%. <\/p>\n

Kahjuliku aktiivsuse kasv hoidlates on olnud m\u00e4rkimisv\u00e4\u00e4rne \u2014 alates aasta algusest on tuvastatud 245 000 pahatahtlikku paketti ja kaks korda on suurenenud fikseeritud r\u00fcnnakute arv, mis on suunatud s\u00f5ltuvuste asendamisele.

\"Probleemide<\/center> <\/p>\n

Paljud projektid j\u00e4tkavad haavatavate versioonide kasutamist, n\u00e4iteks 23% Java-paketi Log4j allalaadimistest koosneb endiselt versioonidest, kus on kriitilised haavatavused, mis likvideeriti 2021. aastal. Maven Central hoidlas on umbes 12% k\u00f5igist allalaadimistest p\u00e4rit komponentidest, mis sisaldavad tuntud haavatavusi. Keskmiselt tuvastatakse k\u00f5igi hoidlate seas 20% allalaadimistest vanade versioonide kohta, mis kuuluvad riskantsete kategooriate hulka (nt neist, kus haavatavuste parandusi ei ole). 96% juhtudest oleks haavatavust sisaldavate komponentide allalaadimisi saanud v\u00e4ltida, valides versioonid, kus probleem on juba lahendatud. <\/p>\n

Oluline probleem turvalisuse tagamisel on projektide kvaliteetne hooldus. Java ja JavaScripti \u00f6kos\u00fcsteemides on sellega suured probleemid \u2014 viimase aastaga on igast viiendast projektist (18,6%), mis oli eelnevalt hooldatud, hooldamine l\u00f5petatud. 1,176 miljonist anal\u00fc\u00fcsitud projektist, mis esinevad Maven, NPM, PyPl ja Nuget hoidlates, j\u00e4tkab ainult 11% (118 000) aktiivset hooldamist. <\/p>\n

Uuringu k\u00e4igus viidi l\u00e4bi ka uuring 621 professionaalse arendaja seas erinevates ettev\u00f5tetes. 67% k\u00fcsitletud arvab, et nende rakendused ei kasuta haavatavaid raamatukogusid, 10% on viimase 12 kuu jooksul kogenud ohutusjuhtumeid, mis olid p\u00f5hjustatud avatud l\u00e4htekoodiga haavatavustest, ning 20% on keerulisem vastata. 28% ettev\u00f5tetest tuvastab haavatavate komponentide olemasolu \u00fche p\u00e4eva jooksul p\u00e4rast haavatavuse avaldamist, 39% \u2014 \u00fche kuni seitsme p\u00e4eva jooksul, ning 29% \u2014 rohkem kui n\u00e4dal.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Sonatype, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0430\u044f\u0441\u044f \u043d\u0430 \u0437\u0430\u0449\u0438\u0442\u0435 \u043e\u0442 \u0430\u0442\u0430\u043a, \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043f\u043e\u0434\u043c\u0435\u043d\u043e\u0439 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u0438 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (supply chain), \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f (PDF, 62 \u0441\u0442\u0440.) \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0438 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0435\u043d\u0438\u0435\u043c \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u043d\u0430 \u044f\u0437\u044b\u043a\u0430\u0445 Java, JavaScript, Python \u0438 .NET, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 Maven Central, NPM, PyPl \u0438 Nuget. \u0417\u0430 \u0433\u043e\u0434 \u043e\u0442\u043c\u0435\u0447\u0435\u043d\u043e \u0443\u0432\u0435\u043b\u0438\u0447\u0435\u043d\u0438\u0435 \u0447\u0438\u0441\u043b\u0430 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0432 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u044d\u043a\u043e\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":110894,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110893","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Probleemide hindamine avatud projektide hooldamisel ja vanade s\u00f5ltuvuste kasutamisel | ProHoster","description":"Sonatype, mis on spetsialiseerunud tarkvarakomponentide ja s\u00f5ltuvuste manipuleerimise r\u00fcnnakute kaitsele (supply chain), avaldas uuringu tulemused (PDF, 62 lk.) avatud projektide s\u00f5ltuvuste ja hoolduse probleemide kohta Java, JavaScripti, Pythoni ja .NET keeles, mis on esindatud Maven Central, NPM, PyPl ja Nuget hoidlates. Aasta jooksul on j\u00e4lgitavates avatud \u00f6kos\u00fcsteemides projektide arv suurenenud.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/oczenka-problem-s-soprovozhdeniem-otkrytyh-proektov-i-ispolzovaniem-staryh-zavisimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0446\u0435\u043d\u043a\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0435\u043d\u0438\u0435\u043c \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0441\u0442\u0430\u0440\u044b\u0445 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Sonatype, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0430\u044f\u0441\u044f \u043d\u0430 \u0437\u0430\u0449\u0438\u0442\u0435 \u043e\u0442 \u0430\u0442\u0430\u043a, \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043f\u043e\u0434\u043c\u0435\u043d\u043e\u0439 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u0438 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (supply chain), \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f (PDF, 62 \u0441\u0442\u0440.) \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0438 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0435\u043d\u0438\u0435\u043c \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u043d\u0430 \u044f\u0437\u044b\u043a\u0430\u0445 Java, JavaScript, Python \u0438 .NET, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 Maven Central, NPM, PyPl \u0438 Nuget. \u0417\u0430 \u0433\u043e\u0434 \u043e\u0442\u043c\u0435\u0447\u0435\u043d\u043e \u0443\u0432\u0435\u043b\u0438\u0447\u0435\u043d\u0438\u0435 \u0447\u0438\u0441\u043b\u0430 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0432 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u044d\u043a\u043e\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0432","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/oczenka-problem-s-soprovozhdeniem-otkrytyh-proektov-i-ispolzovaniem-staryh-zavisimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-17T07:10:19+00:00","article:modified_time":"2023-10-17T07:10:19+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/110893","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=110893"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/110893\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/110894"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=110893"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=110893"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=110893"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}