{"id":52757,"date":"2019-11-16T00:00:00","date_gmt":"2019-11-15T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po"},"modified":"2020-02-18T14:00:33","modified_gmt":"2020-02-18T11:00:33","slug":"github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po","title":{"rendered":"GitHub alustas koost\u00f6\u00f6projekti avatud tarkvara haavatavuste tuvastamiseks","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitHub esitles<\/a><\/noindex> algatusega GitHub Security Lab<\/a><\/noindex>, misjoniga korraldada koost\u00f6\u00f6d eri ettev\u00f5tete ja organisatsioonide turvalisuse ekspertide vahel haavatavuste tuvastamiseks ja nende parandamiseks avatud projektide koodis. <\/p>\n

K\u00f5iki huvitatud ettev\u00f5tteid ja individuaalseid arvutiturbe spetsialiste kutsub initsiatiivi osalema. Haavatavuste leidmise eest pakutakse<\/a><\/noindex> kuni 3000 dollarise tasu, s\u00f5ltuvalt probleemi t\u00f5sidusest ja aruande kvaliteedist. Probleemide esitamiseks soovitatakse kasutada t\u00f6\u00f6riistu CodeQL<\/a><\/noindex>, mis v\u00f5imaldavad luua haavatava koodi malli, et tuvastada sama haavatavuse olemasolu teiste projektide koodis (CodeQL v\u00f5imaldab teostada koodi semantilist anal\u00fc\u00fcsi ja luua p\u00e4ringuid teatud konstruktsioonide otsimiseks).<\/p>\n

Initsiatiiviga on juba liitunud turva-uuringute spetsialistid ettev\u00f5tetest F5, Google, HackerOne, Intel, IOActive, J.P. Morgan, LinkedIn, Microsoft, Mozilla, NCC Group, Oracle, Trail of Bits, Uber ja
\nVMware, kes on viimase kahe aasta jooksul tuvastasid<\/a><\/noindex> ja aidanud probleeme parandada<\/a><\/noindex> 105 haavatavust sellistes projektides nagu Chromium, libssh2, Linuxi kernel, Memcached, UBoot, VLC, Apport, HHVM, Exiv2, FFmpeg, Fizz, libav, Ansible, npm, XNU, Ghostscript, Icecast, Apache Struts, strongSwan, Apache Ignite, rsyslog, Apache Geode ja Hadoop. <\/p>\n

GitHubis ettepanekuna v\u00e4ljapakutud koodi turvalisuse s\u00e4ilitamise eluts\u00fckkel h\u00f5lmab seda, et GitHub Security Labi liikmed tuvastavad haavatavused, seej\u00e4rel edastatakse teave probleemide kohta hooldajateni ja arendajateni, kes t\u00f6\u00f6tavad v\u00e4lja lahendused, leppivad kokku teabe avalikustamise ajakava ja teavitavad s\u00f5ltuvaid projekte vajadusest installida haavatavus k\u00f5rvaldanud versioon. Andmebaasis asuvad CodeQL-mallid, mis aitavad v\u00e4ltida taastuvate probleemide ilmnemist GitHubis olevas koodis.
\n

\"GitHub<\/a><\/noindex><\/center><\/p>\n

N\u00fc\u00fcd saab GitHubi liidese kaudu piiramatu ligip\u00e4\u00e4su<\/a><\/noindex> CVE-Identifikaatori tuvastatud probleemi jaoks ja koostada aruande, seej\u00e4rel saadab GitHub vajalikud teavitused ja korraldab nende koordineeritud lahendamise. Veelgi enam, p\u00e4rast probleemi lahendamist saadab GitHub automaatselt pull-kutsed, et uuendada seotud haavatava projekti s\u00f5ltuvusi.<\/p>\n

GitHub on samuti lisanud p\u00fcsivasse haavatavuste katalooge GitHub Advisory Database<\/a><\/noindex>, kus avaldatakse teavet haavatavuste kohta, mis m\u00f5jutavad GitHubi projekte, ning teavet haavatavate pakettide ja hoidlate j\u00e4lgimise kohta. GitHubi kommentaarides mainitud CVE-i identifikaatorid viitavad n\u00fc\u00fcd automaatselt haavatavuse \u00fcksikasjadele esitatud andmebaasis. Andmebaasi haldamise automatiseerimiseks on ette n\u00e4htud eraldi API<\/a><\/noindex>.<\/p>\n

Samuti teavitatakse uuendustest teenuse<\/a><\/noindex> kaitseks tungimise<\/a><\/noindex> avalikult k\u00e4ttesaadavatesse hoidlatest
\ntundlike andmete, nagu autentimistokenid ja juurdep\u00e4\u00e4suv\u00f5tmed. Komiteerimise ajal skaneerib skanner t\u00fc\u00fcpilisi v\u00f5tme ja tokeni formaate, mida kasutatakse 20 pilveteenuse pakkujat ja teenust<\/a><\/noindex>, sealhulgas API-d Alibaba Cloud, Amazon Web Services (AWS), Azure, Google Cloud, Slack ja Stripe. Kui token tuvastatakse, saadetakse teenusepakkujale p\u00e4ring lekke kinnitamiseks ja kompromiteeritud tokenite t\u00fchistamiseks. Eelmisest p\u00e4evast alates on lisaks varasemalt toetatud formaatidele lisatud ka toetus GoCardless, HashiCorp, Postman ja Tencent tokenite tuvastamiseks.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

GitHub \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b \u0441 \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u043e\u0439 GitHub Security Lab, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044e \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u043e\u0432 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u0441\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044e \u043f\u043e \u0438\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e \u0432 \u043a\u043e\u0434\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432. \u0414\u043b\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u0435 \u043f\u0440\u0438\u0433\u043b\u0430\u0448\u0430\u044e\u0442\u0441\u044f \u0432\u0441\u0435 \u0437\u0430\u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0438 \u0438\u043d\u0434\u0438\u0432\u0438\u0434\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043f\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0417\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0435\u0434\u0443\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u0430 \u0432\u044b\u043f\u043b\u0430\u0442\u0430 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c \u0434\u043e 3000 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":52758,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-52757","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47GitHub k\u00e4ivitas koost\u00f6\u00f6projekti avatud tarkvara haavatavuste tuvastamiseks | ProHoster","description":"GitHub esitas algatuse","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47GitHub \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u044b\u0439 \u043f\u0440\u043e\u0435\u043a\u0442 \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u041f\u041e | ProHoster","og:description":"GitHub \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b \u0441 \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u043e\u0439","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-15T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52757","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 04:44:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:18:18","updated":"2026-01-24 04:44:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/52757","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=52757"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/52757\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/52758"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=52757"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=52757"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=52757"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}