{"id":101282,"date":"2021-09-17T04:22:36","date_gmt":"2021-09-17T02:22:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-travis-ci-privodyashhaya-k-utechke-klyuchej-publichnyh-repozitoriev"},"modified":"2021-09-17T04:22:36","modified_gmt":"2021-09-17T02:22:36","slug":"uyazvimost-v-travis-ci-privodyashhaya-k-utechke-klyuchej-publichnyh-repozitoriev","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-travis-ci-privodyashhaya-k-utechke-klyuchej-publichnyh-repozitoriev","title":{"rendered":"Vuln\u00e9rabilit\u00e9 dans Travis CI entra\u00eenant une fuite de cl\u00e9s des d\u00e9p\u00f4ts publics","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Un probl\u00e8me de s\u00e9curit\u00e9 (CVE-2021-41077) a \u00e9t\u00e9 d\u00e9couvert dans le service d'int\u00e9gration continue Travis CI, destin\u00e9 aux tests et \u00e0 la construction de projets d\u00e9velopp\u00e9s sur GitHub et Bitbucket. Cette vuln\u00e9rabilit\u00e9 permet de r\u00e9v\u00e9ler le contenu des variables d'environnement sensibles des d\u00e9p\u00f4ts publics utilisant Travis CI. En particulier, elle permet de conna\u00eetre les cl\u00e9s utilis\u00e9es dans Travis CI pour g\u00e9n\u00e9rer des signatures num\u00e9riques, ainsi que les cl\u00e9s d'acc\u00e8s et les jetons pour acc\u00e9der \u00e0 l'API. <\/p>\n

Le probl\u00e8me a exist\u00e9 dans Travis CI du 3 au 10 septembre. Fait int\u00e9ressant, l'information concernant la vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 transmise aux d\u00e9veloppeurs le 7 septembre, mais la r\u00e9ponse re\u00e7ue \u00e9tait uniquement une suggestion d'effectuer une rotation des cl\u00e9s. Ne recevant pas de retour ad\u00e9quat, les chercheurs ont contact\u00e9 GitHub et ont propos\u00e9 de mettre Travis sur liste noire. Le probl\u00e8me a \u00e9t\u00e9 r\u00e9solu seulement le 10 septembre apr\u00e8s un grand nombre de plaintes de diff\u00e9rents projets. Apr\u00e8s cet incident, un rapport curieux sur le site de Travis CI a \u00e9t\u00e9 publi\u00e9, dans lequel, au lieu d'informer sur la correction de la vuln\u00e9rabilit\u00e9, une recommandation qui sortait du contexte a \u00e9t\u00e9 donn\u00e9e, conseillant de changer cycliquement les cl\u00e9s d'acc\u00e8s. <\/p>\n

\u00c0 la suite de l'indignation suscit\u00e9e par la dissimulation d'informations exprim\u00e9e par plusieurs grands projets, un rapport plus d\u00e9taill\u00e9 a \u00e9t\u00e9 publi\u00e9 sur le forum de support de Travis CI, dans lequel il \u00e9tait averti que le propri\u00e9taire d'un fork de tout d\u00e9p\u00f4t public, en soumettant une demande de tirage, pouvait initier le processus de construction et obtenir un acc\u00e8s non autoris\u00e9 aux variables d'environnement confidentielles du d\u00e9p\u00f4t d'origine, expos\u00e9es lors de la construction sur la base des champs du fichier \u00ab .travis.yml \u00bb ou d\u00e9finies via l'interface web de Travis CI. Ces variables sont stock\u00e9es sous forme chiffr\u00e9e et ne sont d\u00e9chiffr\u00e9es que durant la construction. Le probl\u00e8me ne concernait que les d\u00e9p\u00f4ts accessibles publiquement ayant des forks (les d\u00e9p\u00f4ts priv\u00e9s ne sont pas vuln\u00e9rables \u00e0 cette attaque).
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 \u043d\u0435\u043f\u0440\u0435\u0440\u044b\u0432\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 Travis CI, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u043c \u0434\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0440\u0430\u0437\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u043c\u044b\u0445 \u043d\u0430 GitHub \u0438 Bitbucket, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e (CVE-2021-41077), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0437\u043d\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 Travis CI. \u0412 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0437\u043d\u0430\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0435 \u0432 Travis CI \u043a\u043b\u044e\u0447\u0438 \u0434\u043b\u044f \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439, \u043a\u043b\u044e\u0447\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u0442\u043e\u043a\u0435\u043d\u044b \u0434\u043b\u044f \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101282","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vuln\u00e9rabilit\u00e9 dans Travis CI entra\u00eenant une fuite des cl\u00e9s des d\u00e9p\u00f4ts publics | ProHoster","description":"Un probl\u00e8me de s\u00e9curit\u00e9 (CVE-2021-41077) a \u00e9t\u00e9 d\u00e9couvert dans le service d'int\u00e9gration continue Travis CI, destin\u00e9 aux tests et \u00e0 la construction de projets d\u00e9velopp\u00e9s sur GitHub et Bitbucket. Cette vuln\u00e9rabilit\u00e9 permet de r\u00e9v\u00e9ler le contenu.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-travis-ci-privodyashhaya-k-utechke-klyuchej-publichnyh-repozitoriev","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Travis CI, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u043a\u043b\u044e\u0447\u0435\u0439 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 | ProHoster","og:description":"\u0412 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 \u043d\u0435\u043f\u0440\u0435\u0440\u044b\u0432\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 Travis CI, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u043c \u0434\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0440\u0430\u0437\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u043c\u044b\u0445 \u043d\u0430 GitHub \u0438 Bitbucket, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e (CVE-2021-41077), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0437\u043d\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-travis-ci-privodyashhaya-k-utechke-klyuchej-publichnyh-repozitoriev","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-17T02:22:36+00:00","article:modified_time":"2021-09-17T02:22:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101282","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-17 02:23:32","updated":"2022-09-29 06:14:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/101282","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=101282"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/101282\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=101282"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=101282"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=101282"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}