{"id":122827,"date":"2025-03-25T04:22:52","date_gmt":"2025-03-25T02:22:52","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse"},"modified":"2025-03-25T04:22:52","modified_gmt":"2025-03-25T02:22:52","slug":"uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse","title":{"rendered":"Pagure'i ja OBS'i haavatavused, mis v\u00f5imaldasid Fedora ja openSUSE hoidlates pakettide kompromiteerimist","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Fenriski turva-uuringute teadlased avaldasid teavet haavatavuste kohta Pagure'i ja OBS (Open Build Service) t\u00f6\u00f6riistades, mis v\u00f5imaldasid kompromiteerida Fedora ja openSUSE distribuutide paketihaldusplaane. Teadlased demonstreerisid v\u00f5imalust teostada r\u00fcnnak, mis v\u00f5imaldab k\u00e4ivitada juhuslikku koodi Pagure'i ja OBS'i serverites, mida sai kasutada muudatuste sisestamiseks Fedora ja openSUSE hoidlatesse.     <\/p>\n<p>Fedora koode ja pakettide metaandmeid koost\u00f6\u00f6s kasutatav Platvorm Pagure'il on avastatud 4 haavatavust. Tuvastatud probleemide \u00e4rakasutamiseks on vajalik kasutajakonto olemasolu Pagure'is, mida saab soetada iga\u00fchel (hetkel on Pagure.io-s registreeritud 24899 kasutajat). Kolm probleemi v\u00f5imaldavad lugeda faile s\u00fcsteemis ja \u00fcks probleem v\u00f5imaldab k\u00e4ivitada oma koodi. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/server\/dts-newyork\/\"   title=\"serveril\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2806\">serveril<\/a>. Probleemid avastati 1. jaanuaril 2024, teatati bugzilla.redhat.com kaudu 25. aprillil 2024 ja k\u00f5rvaldatakse Pagure'is kolme tunni jooksul.    <\/p>\n<ul>\n<li class=\"l\"> CVE-2024-4981 ja CVE-2024-47515 haavatavused tulenevad s\u00fcmboolsete linkide eba\u00f5igest t\u00f6\u00f6tlemisest failide v\u00e4rskendamise ja arhiivide genereerimise funktsioonides. Need haavatavused v\u00f5imaldavad lugeda serveri kohalikke faile, n\u00e4iteks p\u00e4\u00e4seb ligi administraatori seansi parameetreid sisaldavale Pagure faili sisule ning kasutada selle \u00f5igusi. Haavatavuse \u00e4ra kasutamine funktsioonis _update_file_in_git() seisneb Pagures uue repo loomises; komiti lisamises uue failiga, mis on loodud s\u00fcmboolse lingina soovitud s\u00fcsteemifailile; avades selle faili redigeerimiseks veebi liideses.\n<li class=\"l\"> Rikk vulnerability (CVE-2024-4982) funktsioonis view_issue_raw_file() v\u00f5imaldab p\u00e4\u00e4seda v\u00e4lja p\u00f5hikaustast, kui taotletud Issue parameterites on kasutatud s\u00fcmboleid &#171;\/..&#187;. Probleem v\u00f5imaldab lugeda s\u00fcsteemis faile vastavalt sellele, millised on protsessi juurdep\u00e4\u00e4su\u00f5igused, mille all web-liidese k\u00e4itamine toimub. N\u00e4iteks, et vaadata faili \/etc\/passwd, saab avada lehe &#171;http:\/\/pagure.local:5000\/your-repository\/issue\/raw\/..\/..\/..\/..\/..\/..\/..\/etc\/passwd&#187;.\n<li class=\"l\"> Rikk vulnerability (CVE-2024-47516) funktsioonis PagureRepo.log(), v\u00f5imaldab sisestada enda k\u00e4ske ja t\u00e4ita koodi serveris. Probleem tuleneb sellest, et faili muudatuste ajaloo vaatamisel web-liidese kaudu kutsutakse kasutusele k\u00e4sk &#171;git&#187; koos haru identifikaatori edastamisega k\u00e4sureal (n\u00e4iteks &#171;\/usr\/bin\/git &#8212;pretty=oneline &#8212;abbrev-commit &lt;HERE&gt; &#8212; README.md&#187;). Identifikaatori \u00f5igsust ei kontrollita, seega saab selle asemel edastada igasuguseid k\u00e4surea argumendid, n\u00e4iteks &#171;&#8212;output=\/tmp\/foo.bar&#187;, et suunata v\u00e4ljund faili. R\u00fcndaja v\u00f5ib faili s\u00fcsteemis \u00fcle kirjutada, saates taotluse kujul: http:\/\/pagure.local:5000\/test\/history\/README.md?identifier=&#8212;output=\/tmp\/foo.bar\n<p>Pagure k\u00e4ivitub kasutaja git-al, seega saab \u00fcle kirjutada ainult selle kasutaja faile. Omandades v\u00f5imaluse oma koodi k\u00e4itamiseks serveris, saab kasutada teenust, mis v\u00f5imaldab juurde p\u00e4\u00e4seda repo kaudu SSH, mille korral k\u00e4ivitatakse k\u00e4sk &#171;bash -c \/usr\/libexec\/pagure\/aclchecker.py&#187;. R\u00fcndaja saab seda haavatavust kasutada faili &#171;\/srv\/git\/.bashrc&#187; \u00fcle kirjutamiseks ja see fail k\u00e4ivitatakse bash\u2019i t\u00f5lgendajaga, kui suunatakse repo kaudu ssh.      <\/p>\n<p>R\u00fcnnak koosneb s\u00fcsteemis Pagure registreerimisest, repo loomiseest, README.md faili lisamisest commit-m\u00e4rgendiga &#171;|| \/bin\/bash&#187; ja taotluse saatmisest &#171;http:\/\/pagure.local:5000\/test\/history\/README.md?identifier=&#8212;output=\/srv\/git\/.bashrc&#187;. Antud tegevuste k\u00e4igus kirjutatakse faili &#171;\/srv\/git\/.bashrc&#187; rida &#171;34\u04305\u044143 || \/bin\/bash&#187;. \u00dcksnes SSH kaudu repo kaudu oma kasutajakonto all \u00fchenduse loomine on piisav, et k\u00e4ivitada loodud fail &#171;\/srv\/git\/.bashrc&#187;. Koodi k\u00e4itamine git kasutaja \u00f5igustes Pagure serveris v\u00f5imaldab kontrollida kogu sisu pakettidega repos.    <\/ul>\n<p>    <center><iframe title=\"Pagure\" src=\"https:\/\/player.vimeo.com\/video\/1066145210?h=0716980f9b\" width=\"640\" height=\"360\" frameborder=\"0\" allowfullscreen style =\"max-width: 100%;\" loading=\"lazy\"><\/iframe><\/center>        <\/p>\n<p>OBS (Open Build Service) platvormil, mida kasutatakse openSUSE-s ja m\u00f5nedes teistes distributsioonides pakettide koostamiseks, tuvastati \u00fcks haavatavus (CVE-2024-22033), mis v\u00f5imaldab serveris oma koodi k\u00e4ivitada. Haavatavus avastati 27. juunil 2024, teavitati openSUSE projekti 29. juunil ja k\u00f5rvaldatakse 10. juulil.    <\/p>\n<p>Haavatavus on teenuses &#171;obs-service-download_url&#187;, kus puudus n\u00f5uetekohane URL-i kontroll, mis kasutatakse wget utiliidi k\u00e4itamisel skripti kaudu, mis laadib allika koodi OBS-i. R\u00fcndaja saab OBS teenuses m\u00e4\u00e4rata paketi konfigureerimise, kus allika laadimise URL-i asemel on m\u00e4\u00e4ratud wget k\u00e4surea argument, n\u00e4iteks: &lt;services&gt; &lt;service name=&#187;download_url&#187;&gt; &lt;param name=&#187;url&#187;&gt;&#8212;output-document=\/tmp\/test&lt;\/param&gt; &lt;param name=&#187;download-manifest&#187;&gt;tempfile&lt;\/param&gt; &lt;\/service&gt; &lt;\/services&gt;      <\/p>\n<p> Eba\u00f5nnestumise v\u00e4ltimiseks, kui p\u00fc\u00fctakse k\u00e4ivitada wget ilma URL-ideta, on n\u00e4idatud valik &#171;download-manifest&#187;, mis v\u00f5imaldab m\u00e4\u00e4rata URL-id loendis eraldi failis. \u00dclaltoodud n\u00e4ide viib k\u00e4su k\u00e4ivitamisele: \/usr\/bin\/wget -i \/srv\/obs\/service\/XXXXX\/src\/tempfile -4 &#8212;output-document=\/tmp\/test    <\/p>\n<p>mis v\u00f5imaldab kirjutada failisse \/tmp\/test sisu, mis on laaditud linkidelt, mis on m\u00e4\u00e4ratud failis \/srv\/obs\/service\/XXXXX\/src\/tempfile, koodist, mille r\u00fcndaja on OBS-i kaudu \u00fcles laadinud, kus registreerumine on vaba. Lisaks failide \u00fcle kirjutamisele serveris v\u00f5ib r\u00fcndaja saata endale ka mis tahes faili, asendades &#171;&#8212;output-document&#187; valikuga &#171;&#8212;post-file&#187;, n\u00e4iteks &#171;&#8212;post-file=\/etc\/passwd&#187;. Nii saab r\u00fcndaja lugeda ja kirjutada faile serveris vastavalt \u00f5igustele, millega OBS teenus t\u00f6\u00f6tab.    <\/p>\n<p>K\u00e4skude t\u00f6\u00f6ks serveris v\u00f5imaluse realiseerimiseks, pakuvad uurijad meetodit, mis koosneb kahest etapist. Kaks etappi on vajalikud, kuna r\u00fcndaja saab luua faili &#171;.wgetrc&#187; wget seadistustega, kuid see ei piisa k\u00e4skude k\u00e4ivitamiseks. Samas saab &#171;.wgetrc&#187; kaudu luua tingimused, et s\u00fcsteemis sooritada mis tahes programmi, kuid argumentide edastamine on keelatud. Arbitraarse koodi k\u00e4ivitamiseks on soovitatud kasutada programmi &#171;prove&#187;, mis t\u00f6\u00f6tleb seadistusfaili &#171;.proverc&#187;, mis v\u00f5imaldab m\u00e4\u00e4rata valiku &#171;&#8212;exec&#187; mis tahes koodi k\u00e4ivitamiseks.     <\/p>\n<p>Esimeses etapis tehakse \u00fclaltoodud toimingute kaudu failis &#171;download-manifest&#187; kasutaja kodukataloogis &#171;obsservicerun&#187; fail, mille nimeks on &#171;.proverc&#187;. See fail sisaldab k\u00e4sklusi, mis t\u00e4idetakse protsessi &#171;prove&#187; k\u00e4ivitamisel. Teises etapis luuakse fail &#171;.wgetrc&#187; parameetriga &#171;use-askpass=\/usr\/bin\/prove&#187;, mis kutsub esile &#171;prove&#187;. Kui need failid on olemas, piisab, kui luua tingimused mis tahes andmete allalaadimiseks wget abil, ja see k\u00e4ivitab r\u00fcndaja koodi serveris, kus \u00f5igused kuuluvad kasutajale &#171;obsservicerun&#187;. Kasutaja &#171;obsservicerun&#187; \u00f5igused on piisavad, et v\u00e4ljav\u00f5tte saamiseks repodega, kuhu on talletatud OBS-i kasutajate allkirjastamise v\u00f5tmed.     <center>  <iframe title=\"Open Build Service\" src=\"https:\/\/player.vimeo.com\/video\/1066093605?h=d7a210d719\" width=\"640\" height=\"360\" frameborder=\"0\" allowfullscreen style =\"max-width: 100%;\" loading=\"lazy\"><\/iframe><\/center>    <\/p>\n<p>T\u00e4iendav: SUSE tootejulgeoleku meeskond usub, et haavatavuse oht OBS-is on liialdatud ning teadlaste v\u00e4ide, et probleem v\u00f5imaldab kompromiteerida k\u00f5iki pakette openSUSE distributsioonis, ei vasta t\u00f5ele. T\u00f5detakse, et build.opensuse.org infrastruktuuri teenused k\u00e4ivituvad isoleeritud konteinerites, mis luuakse uuesti ja ei sisalda kriitilist teavet. Tuvastatud haavatavus hinnatakse ohtlikuks, kuid ei ole piisav openSUSE ehitusinfrastruktuuri ja loodud pakettide kompromiteerimiseks. Samuti on m\u00e4rgitud, et OBS-i liideses kirjeldatud tegevused, mis on r\u00fcnnaku n\u00e4ites kajastatud, oleks saanud toimuda ainult OBS-i variandis, mis on kohalikult installitud arendaja t\u00f6\u00f6jaamas.<br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=62928\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Fenrisk \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 Pagure \u0438 OBS (Open Build Service), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0445 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 Fedora \u0438 openSUSE. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0441 Pagure \u0438 OBS, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 Fedora \u0438 openSUSE. [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-122827","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Fenrisk \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 Pagure \u0438 OBS (Open Build Service), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0445 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 Fedora \u0438 openSUSE. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0441 Pagure \u0438 OBS, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 Fedora \u0438 openSUSE.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Pagure \u0438 OBS, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u0432\u0448\u0438\u0435 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 Fedora \u0438 openSUSE | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Fenrisk \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 Pagure \u0438 OBS (Open Build Service), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0445 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 Fedora \u0438 openSUSE. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0441 Pagure \u0438 OBS, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 Fedora \u0438 openSUSE.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-03-25T02:22:52+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2025-03-25T02:22:52+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavused Pagure ja OBS-is, mis v\u00f5imaldasid pakettide kompromiteerimist Fedora ja openSUSE repositooriumides | ProHoster","description":"Fenriski turva-uuringute teadlased avaldasid teavet haavatavuste kohta Pagure'i ja OBS (Open Build Service) t\u00f6\u00f6riistades, mis v\u00f5imaldasid kompromiteerida Fedora ja openSUSE distribuutide paketihaldusplaane. Teadlased demonstreerisid v\u00f5imalust teostada r\u00fcnnak, mis v\u00f5imaldab k\u00e4ivitada juhuslikku koodi Pagure'i ja OBS'i serverites, mida sai kasutada muudatuste sisestamiseks Fedora ja openSUSE hoidlatesse.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Pagure \u0438 OBS, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u0432\u0448\u0438\u0435 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 Fedora \u0438 openSUSE | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Fenrisk \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 Pagure \u0438 OBS (Open Build Service), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0445 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 Fedora \u0438 openSUSE. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0441 Pagure \u0438 OBS, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 Fedora \u0438 openSUSE.","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-03-25T02:22:52+00:00","article:modified_time":"2025-03-25T02:22:52+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"122827","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:07:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 11:32:22","updated":"2026-02-09 22:07:19"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/122827","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=122827"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/122827\/revisions"}],"predecessor-version":[{"id":160086,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/122827\/revisions\/160086"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=122827"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=122827"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=122827"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}