GitHub a r\u00e9v\u00e9l\u00e9 des informations sur une vuln\u00e9rabilit\u00e9 permettant d'acc\u00e9der au contenu des variables d'environnement expos\u00e9es dans les conteneurs utilis\u00e9s dans l'infrastructure de travail. La vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 identifi\u00e9e par un participant au programme Bug Bounty, candidat \u00e0 une r\u00e9compense pour la d\u00e9tection de probl\u00e8mes de s\u00e9curit\u00e9. Le probl\u00e8me concerne \u00e0 la fois le service GitHub.com et les configurations de GitHub Enterprise Server (GHES) fonctionnant sur les syst\u00e8mes des utilisateurs. <\/p>\n
L'analyse des journaux et l'audit de l'infrastructure n'ont r\u00e9v\u00e9l\u00e9 aucune trace d'exploitation de la vuln\u00e9rabilit\u00e9 dans le pass\u00e9, \u00e0 l'exception des activit\u00e9s du chercheur signalant le probl\u00e8me. Cependant, l'infrastructure a initi\u00e9 le remplacement de toutes les cl\u00e9s de chiffrement et des identifiants qui pourraient avoir \u00e9t\u00e9 potentiellement compromis en cas d'exploitation de la vuln\u00e9rabilit\u00e9 par un attaquant. Le remplacement des cl\u00e9s internes a entra\u00een\u00e9 des interruptions de service du 27 au 29 d\u00e9cembre. Les administrateurs de GitHub ont tent\u00e9 de corriger les erreurs commises lors de la mise \u00e0 jour d'hier des cl\u00e9s affectant les clients. <\/p>\n
Entre autres, la cl\u00e9 GPG utilis\u00e9e pour signer num\u00e9riquement les commits cr\u00e9\u00e9s via l'\u00e9diteur web de GitHub lors de l'acceptation des pull requests sur le site ou via l'outil Codespace a \u00e9t\u00e9 mise \u00e0 jour. L'ancienne cl\u00e9 a cess\u00e9 d'\u00eatre valide le 16 janvier \u00e0 23 heures, heure de Moscou, et un nouveau cl\u00e9 est en vigueur depuis hier. \u00c0 partir du 23 janvier, tous les nouveaux commits sign\u00e9s par l'ancienne cl\u00e9 ne seront pas marqu\u00e9s comme v\u00e9rifi\u00e9s sur le site GitHub. <\/p>\n
Le 16 janvier, les cl\u00e9s publiques utilis\u00e9es pour chiffrer les donn\u00e9es utilisateur envoy\u00e9es via l'API dans GitHub Actions, GitHub Codespaces et Dependabot ont \u00e9galement \u00e9t\u00e9 mises \u00e0 jour. Les utilisateurs qui utilisent des cl\u00e9s publiques appartenant \u00e0 GitHub pour v\u00e9rifier localement les commits et chiffrer les donn\u00e9es transmises sont invit\u00e9s \u00e0 s'assurer qu'ils ont mis \u00e0 jour les cl\u00e9s GPG de GitHub et que leurs syst\u00e8mes continuent de fonctionner apr\u00e8s le remplacement des cl\u00e9s. <\/p>\n
La soci\u00e9t\u00e9 GitHub a d\u00e9j\u00e0 corrig\u00e9 la vuln\u00e9rabilit\u00e9 sur le site GitHub.com et a publi\u00e9 une mise \u00e0 jour du produit GHES 3.8.13, 3.9.8, 3.10.5 et 3.11.3, dans laquelle le correctif CVE-2024-0200 est not\u00e9 (utilisation non s\u00e9curis\u00e9e des r\u00e9flexions, entra\u00eenant l'ex\u00e9cution de code ou des m\u00e9thodes contr\u00f4l\u00e9es par l'utilisateur c\u00f4t\u00e9 serveur). de serveurs<\/a>). Une attaque sur les installations locales de GHES aurait pu \u00eatre r\u00e9alis\u00e9e par un attaquant disposant d'un compte avec des droits de gestion de l'organisation (propri\u00e9taire de l'organisation). GitHub \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u043c\u0443 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0439, \u0432\u044b\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\u0445, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0432 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u043e\u043c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b Bug Bounty, \u043f\u0440\u0435\u0442\u0435\u043d\u0434\u0443\u044e\u0449\u0438\u043c \u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f \u0437\u0430 \u043f\u043e\u0438\u0441\u043a \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043a\u0430\u043a \u0441\u0435\u0440\u0432\u0438\u0441 GitHub.com, \u0442\u0430\u043a \u0438 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 GitHub Enterprise Server (GHES), \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0435 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u0410\u043d\u0430\u043b\u0438\u0437 \u043b\u043e\u0433\u043e\u0432 \u0438 \u0430\u0443\u0434\u0438\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112958","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47GitHub a mis \u00e0 jour ses cl\u00e9s GPG en raison d'une vuln\u00e9rabilit\u00e9 entra\u00eenant des fuites de variables d'environnement | ProHoster","description":"GitHub a divulgu\u00e9 des informations sur une vuln\u00e9rabilit\u00e9 permettant d'acc\u00e9der au contenu des variables d'environnement expos\u00e9es dans les conteneurs utilis\u00e9s dans l'infrastructure de travail.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/github-obnovil-gpg-klyuchi-iz-za-uyazvimosti-privodyashhej-k-utechke-peremennyh-okruzheniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47GitHub \u043e\u0431\u043d\u043e\u0432\u0438\u043b GPG-\u043a\u043b\u044e\u0447\u0438 \u0438\u0437-\u0437\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0435\u0439 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f | ProHoster","og:description":"GitHub \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u043c\u0443 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0439, \u0432\u044b\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\u0445, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0432 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/github-obnovil-gpg-klyuchi-iz-za-uyazvimosti-privodyashhej-k-utechke-peremennyh-okruzheniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-01-17T15:28:02+00:00","article:modified_time":"2024-01-17T15:28:02+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"112958","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-22 15:29:48","updated":"2026-02-22 15:29:48","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/112958","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=112958"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/112958\/revisions"}],"predecessor-version":[{"id":162209,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/112958\/revisions\/162209"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=112958"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=112958"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=112958"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"