{"id":112958,"date":"2024-01-17T17:28:02","date_gmt":"2024-01-17T15:28:02","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/github-obnovil-gpg-klyuchi-iz-za-uyazvimosti-privodyashhej-k-utechke-peremennyh-okruzheniya"},"modified":"2024-01-17T17:28:02","modified_gmt":"2024-01-17T15:28:02","slug":"github-obnovil-gpg-klyuchi-iz-za-uyazvimosti-privodyashhej-k-utechke-peremennyh-okruzheniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/github-obnovil-gpg-klyuchi-iz-za-uyazvimosti-privodyashhej-k-utechke-peremennyh-okruzheniya","title":{"rendered":"GitHub uuendas GPG-v\u00f5tmeid haavatavuse t\u00f5ttu, mis p\u00f5hjustab keskkonnamuutujate leket","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitHub on avalikustanud teavet haavatavuse kohta, mis v\u00f5imaldab p\u00e4\u00e4seda ligi konteinerites kasutatavate keskkonna muutuja sisu, mis on kasutusel t\u00f6\u00f6infrastruktuuris. Haavatavuse tuvastas Bug Bounty programmi osaleja, kes taotleb julgeolekuprobleemide leidmise eest tasu. Probleem m\u00f5jutab nii GitHub.com teenust kui ka GitHub Enterprise Server (GHES) konfigureerimisi, mis t\u00f6\u00f6tavad kasutajate s\u00fcsteemides. <\/p>\n

Logide anal\u00fc\u00fcs ja infrastruktuuri audit ei ole tuvastanud haavatavuse varasemat \u00e4rakasutamist peale uurija tegevuse, kes teatas probleemist. Siiski algatati infrastruktuuris k\u00f5ikide kr\u00fcpteerimisv\u00f5tmete ja potentsiaalselt kompromiteeritud mandaadi vahetus haavatavuse kuritarvitamise korral. Sisemiste v\u00f5tmete vahetus p\u00f5hjustas m\u00f5nede teenuste rikkumise ajavahemikus 27. kuni 29. detsember. GitHubi administraatorid p\u00fc\u00fcdsid arvesse v\u00f5tta teadlikke vigu eilse v\u00f5tmeuuenduse k\u00e4igus, mis m\u00f5jutas kliente. <\/p>\n

Muuhulgas uuendati GPG-v\u00f5tit, mida kasutatakse digitaalseteks allkirjadeks GitHubi veebiredaktoris commitide kinnitamisel pull-requestide vastuv\u00f5tmise ajal, veebilehel v\u00f5i Codespace'i t\u00f6\u00f6riistade kaudu. Vana v\u00f5ti lakkas kehtimast 16. jaanuaril kell 23:00 Moskva aja j\u00e4rgi, ja alates eilset rakendatakse uut v\u00f5tit. Alates 23. jaanuarist ei m\u00e4rgistata k\u00f5iki uusi commit'e, mis on allkirjastatud eelmise v\u00f5tmega, GitHubi lehel kui t\u00f5endatud. <\/p>\n

16. jaanuaril uuendati ka avalikke v\u00f5tmeid, mida kasutatakse kasutaja andmete kr\u00fcptimiseks, mis edastatakse GitHubi API-sse GitHub Actions, GitHub Codespaces ja Dependabot kaudu. Kasutajatele, kes kasutavad commitide lokaalset kontrollimist ja edastatavate andmete kr\u00fcptimist GitHubi avalikke v\u00f5tmeid, soovitatakse veenduda, et nad on uuendanud GitHubi GPG-v\u00f5tmeid ja nende s\u00fcsteemid j\u00e4tkavad funktsioneerimist p\u00e4rast v\u00f5tmeuuendust. <\/p>\n

GitHub on juba k\u00f5rvaldanud haavatavuse GitHub.com veebilehelt ning v\u00e4lja andnud toote uuenduse GHES 3.8.13, 3.9.8, 3.10.5 ja 3.11.3, milles on m\u00e4rgitud CVE-2024-0200 parandamine (turvalise peegeldamise eba\u00f5ige kasutamine, mis viib koodide v\u00f5i kasutaja m\u00e4\u00e4ratud meetodite t\u00e4itmiseni) serverilt<\/a>). R\u00fcnnakud kohalikule GHES paigaldustele oleks v\u00f5imalikud, kui r\u00fcndajal oleks organisatsiooni haldajate konto (organization owner).
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

GitHub \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u043c\u0443 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0439, \u0432\u044b\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\u0445, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0432 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u043e\u043c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b Bug Bounty, \u043f\u0440\u0435\u0442\u0435\u043d\u0434\u0443\u044e\u0449\u0438\u043c \u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f \u0437\u0430 \u043f\u043e\u0438\u0441\u043a \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043a\u0430\u043a \u0441\u0435\u0440\u0432\u0438\u0441 GitHub.com, \u0442\u0430\u043a \u0438 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 GitHub Enterprise Server (GHES), \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0435 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u0410\u043d\u0430\u043b\u0438\u0437 \u043b\u043e\u0433\u043e\u0432 \u0438 \u0430\u0443\u0434\u0438\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112958","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47GitHub uuendas GPG-v\u00f5tmeid haavatavuse t\u00f5ttu, mis p\u00f5hjustas keskkonna muutujate v\u00e4ljavoolu | ProHoster","description":"GitHub avalikustas teavet haavatavuse kohta, mis v\u00f5imaldab p\u00e4\u00e4seda ligi konteinerites kasutatavate keskkonna muutujate sisule, mis on \u00fcles seatud t\u00f6\u00f6stuslikus infrastruktuuris.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/github-obnovil-gpg-klyuchi-iz-za-uyazvimosti-privodyashhej-k-utechke-peremennyh-okruzheniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47GitHub \u043e\u0431\u043d\u043e\u0432\u0438\u043b GPG-\u043a\u043b\u044e\u0447\u0438 \u0438\u0437-\u0437\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0435\u0439 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f | ProHoster","og:description":"GitHub \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u043c\u0443 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0439, \u0432\u044b\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\u0445, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0432 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/github-obnovil-gpg-klyuchi-iz-za-uyazvimosti-privodyashhej-k-utechke-peremennyh-okruzheniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-01-17T15:28:02+00:00","article:modified_time":"2024-01-17T15:28:02+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"112958","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-22 15:29:48","updated":"2026-02-22 15:29:48","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/112958","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=112958"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/112958\/revisions"}],"predecessor-version":[{"id":162209,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/112958\/revisions\/162209"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=112958"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=112958"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=112958"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}