{"id":99390,"date":"2021-03-09T10:22:48","date_gmt":"2021-03-09T08:22:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/github-ustranil-uyazvimost-privodivshuyu-k-podmene-seansa-polzovatelya"},"modified":"2021-03-09T10:22:48","modified_gmt":"2021-03-09T08:22:48","slug":"github-ustranil-uyazvimost-privodivshuyu-k-podmene-seansa-polzovatelya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/github-ustranil-uyazvimost-privodivshuyu-k-podmene-seansa-polzovatelya","title":{"rendered":"GitHub a corrig\u00e9 une vuln\u00e9rabilit\u00e9 permettant de remplacer la session utilisateur","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitHub a annonc\u00e9 la r\u00e9initialisation de toutes les sessions authentifi\u00e9es sur GitHub.com et la n\u00e9cessit\u00e9 de se reconnecter en raison de la d\u00e9couverte d'un probl\u00e8me de s\u00e9curit\u00e9. Il est \u00e0 noter que ce probl\u00e8me se manifeste tr\u00e8s rarement et n'affecte qu'un petit nombre de sessions, mais repr\u00e9sente potentiellement un grand danger, car il permet \u00e0 un utilisateur authentifi\u00e9 d'acc\u00e9der \u00e0 la session d'un autre utilisateur. <\/p>\n

La vuln\u00e9rabilit\u00e9 est caus\u00e9e par une condition de course lors du traitement des requ\u00eates par le backend, ce qui entra\u00eene le routage de la session d'un utilisateur vers le navigateur d'un autre utilisateur, permettant ainsi d'acc\u00e9der \u00e0 l'int\u00e9gralit\u00e9 du cookie de session d'autrui. Selon des estimations, le redirection incorrecte a touch\u00e9 environ 0,001 % de toutes les sessions authentifi\u00e9es sur GitHub.com. Il est affirm\u00e9 que ce type de redirection se produisait dans des circonstances accidentelles que les actions d'un malfaiteur ne peuvent pas provoquer d\u00e9lib\u00e9r\u00e9ment. Les modifications \u00e0 l'origine du probl\u00e8me ont \u00e9t\u00e9 effectu\u00e9es le 8 f\u00e9vrier et corrig\u00e9es le 5 mars. Le 8 mars, des v\u00e9rifications suppl\u00e9mentaires ont \u00e9t\u00e9 ajout\u00e9es pour une protection plus g\u00e9n\u00e9rale contre ce type d'erreur.
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

GitHub \u0441\u043e\u043e\u0431\u0449\u0438\u043b \u043e \u0441\u0431\u0440\u043e\u0441\u0435 \u0432\u0441\u0435\u0445 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0430\u043d\u0441\u043e\u0432 \u043a GitHub.com \u0438 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0441\u0435\u0440\u0432\u0438\u0441\u0443 \u0432\u043d\u043e\u0432\u044c \u0438\u0437-\u0437\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e. \u041e\u0442\u043c\u0435\u0447\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0447\u0435\u043d\u044c \u0440\u0435\u0434\u043a\u043e \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043b\u0438\u0448\u044c \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0435 \u0447\u0438\u0441\u043b\u043e \u0441\u0435\u0430\u043d\u0441\u043e\u0432, \u043d\u043e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0431\u043e\u043b\u044c\u0448\u0443\u044e \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c, \u0442\u0430\u043a \u043a\u0430\u043a \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0434\u043d\u043e\u043c\u0443 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0435\u0430\u043d\u0441\u0443 \u0434\u0440\u0443\u0433\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435\u043c \u0433\u043e\u043d\u043a\u0438 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99390","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47GitHub a r\u00e9solu la vuln\u00e9rabilit\u00e9 conduisant \u00e0 la substitution de session d'utilisateur | ProHoster","description":"GitHub a annonc\u00e9 la r\u00e9initialisation de toutes les sessions authentifi\u00e9es sur GitHub.com et la n\u00e9cessit\u00e9 de se reconnecter en raison de la d\u00e9couverte d'un probl\u00e8me de s\u00e9curit\u00e9.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/github-ustranil-uyazvimost-privodivshuyu-k-podmene-seansa-polzovatelya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47GitHub \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0432\u0448\u0443\u044e \u043a \u043f\u043e\u0434\u043c\u0435\u043d\u0435 \u0441\u0435\u0430\u043d\u0441\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f | ProHoster","og:description":"GitHub \u0441\u043e\u043e\u0431\u0449\u0438\u043b \u043e \u0441\u0431\u0440\u043e\u0441\u0435 \u0432\u0441\u0435\u0445 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0430\u043d\u0441\u043e\u0432 \u043a GitHub.com \u0438 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0441\u0435\u0440\u0432\u0438\u0441\u0443 \u0432\u043d\u043e\u0432\u044c \u0438\u0437-\u0437\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/github-ustranil-uyazvimost-privodivshuyu-k-podmene-seansa-polzovatelya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-03-09T08:22:48+00:00","article:modified_time":"2021-03-09T08:22:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99390","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-09 08:27:40","updated":"2022-10-01 23:24:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/99390","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=99390"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/99390\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=99390"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=99390"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=99390"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}