{"id":99606,"date":"2021-03-29T22:22:34","date_gmt":"2021-03-29T20:22:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-git-repozitorii-proekta-php-vyyavleny-vredonosnye-izmeneniya"},"modified":"2021-03-29T22:22:34","modified_gmt":"2021-03-29T20:22:34","slug":"v-git-repozitorii-proekta-php-vyyavleny-vredonosnye-izmeneniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/v-git-repozitorii-proekta-php-vyyavleny-vredonosnye-izmeneniya","title":{"rendered":"Des modifications malveillantes ont \u00e9t\u00e9 d\u00e9tect\u00e9es dans le d\u00e9p\u00f4t Git du projet PHP.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Les d\u00e9veloppeurs du projet PHP ont averti de la compromission du d\u00e9p\u00f4t Git du projet et de la d\u00e9couverte de deux commits malveillants, ajout\u00e9s le 28 mars dans le d\u00e9p\u00f4t php-src au nom de Rasmus Lerdorf, le cr\u00e9ateur de PHP, et de Nikita Popov, l'un des principaux d\u00e9veloppeurs de PHP. <\/p>\n

\u00c9tant donn\u00e9 qu'il n'y a aucune certitude quant \u00e0 la fiabilit\u00e9 du serveur sur lequel le d\u00e9p\u00f4t Git \u00e9tait h\u00e9berg\u00e9, les d\u00e9veloppeurs ont d\u00e9cid\u00e9 que maintenir leur propre infrastructure Git pr\u00e9sente des risques suppl\u00e9mentaires pour la s\u00e9curit\u00e9 et ont transf\u00e9r\u00e9 le d\u00e9p\u00f4t de r\u00e9f\u00e9rence sur la plateforme GitHub, qui est d\u00e9sormais propos\u00e9e comme primaire. Tous les changements doivent d\u00e9sormais \u00eatre envoy\u00e9s vers GitHub, et non vers git.php.net, y compris lors du d\u00e9veloppement o\u00f9 l'interface web de GitHub peut \u00e9galement \u00eatre utilis\u00e9e. <\/p>\n

Dans le premier commit malveillant d\u00e9guis\u00e9 en correction de faute dans le fichier ext\/zlib\/zlib.c, un changement a \u00e9t\u00e9 introduit, activant le code PHP transmis dans l'en-t\u00eate HTTP User Agent, si le contenu commence par le mot \u00ab zerodium \u00bb. Apr\u00e8s que les d\u00e9veloppeurs ont remarqu\u00e9 le changement malveillant et l'ont annul\u00e9, un second commit est apparu dans le d\u00e9p\u00f4t, qui annulait l'action des d\u00e9veloppeurs PHP et r\u00e9tablissait le changement malveillant. <\/p>\n

Le code ajout\u00e9 contient la ligne \u00ab REMOVETHIS: sold to zerodium, mid 2017 \u00bb, ce qui peut sugg\u00e9rer que depuis 2017, le code contient un autre changement malveillant, bien camoufl\u00e9, ou une vuln\u00e9rabilit\u00e9 non corrig\u00e9e, vendue \u00e0 Zerodium, une entreprise sp\u00e9cialis\u00e9e dans l'achat des vuln\u00e9rabilit\u00e9s 0-day (Zerodium a r\u00e9pondu qu'elle n'avait pas achet\u00e9 d'informations sur la vuln\u00e9rabilit\u00e9 PHP). <\/p>\n

Pour l'instant, il n'y a pas d'informations d\u00e9taill\u00e9es sur l'incident, il est seulement suppos\u00e9 que les changements ont \u00e9t\u00e9 ajout\u00e9s \u00e0 la suite d'un piratage de git.php.net, et non par la compromission de comptes individuels de d\u00e9veloppeurs. Une analyse du d\u00e9p\u00f4t pour d'autres changements malveillants, en plus des probl\u00e8mes identifi\u00e9s, a commenc\u00e9. Tous ceux qui le souhaitent sont invit\u00e9s \u00e0 participer \u00e0 l'examen, et les informations sur les changements suspects doivent \u00eatre envoy\u00e9es \u00e0 security@php.net. de serveurs<\/a> git.php.net, et non \u00e0 la compromission de comptes de d\u00e9veloppeurs individuels. L'analyse du d\u00e9p\u00f4t a \u00e9t\u00e9 lanc\u00e9e pour d\u00e9tecter d'autres modifications malveillantes en plus des probl\u00e8mes identifi\u00e9s. Tous ceux qui souhaitent participer \u00e0 la r\u00e9vision sont invit\u00e9s, et toute information sur des modifications suspectes doit \u00eatre envoy\u00e9e \u00e0 security@php.net. <\/p>\n

Concernant la transition vers GitHub, pour obtenir un acc\u00e8s \u00e9crit au nouveau d\u00e9p\u00f4t, les participants au d\u00e9veloppement doivent faire partie de l'organisation PHP. Ceux qui ne font pas partie des d\u00e9veloppeurs PHP sur GitHub doivent contacter Nikita Popov par email \u00e0 nikic@php.net. Pour \u00eatre ajout\u00e9s, il est obligatoire d'activer l'authentification \u00e0 deux facteurs. Une fois les droits appropri\u00e9s obtenus, il suffit d'ex\u00e9cuter la commande \u00ab git remote set-url origin git@github.com:php\/php-src.git \u00bb. De plus, la question de rendre la signature des commits par une signature num\u00e9rique obligatoire est envisag\u00e9e. Une proposition est \u00e9galement faite pour interdire l'ajout direct de modifications n'ayant pas \u00e9t\u00e9 pr\u00e9alablement examin\u00e9es.
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0434\u0432\u0443\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 28 \u043c\u0430\u0440\u0442\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 php-src \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0420\u0430\u0441\u043c\u0443\u0441\u0430 \u041b\u0435\u0440\u0434\u043e\u0440\u0444\u0430, \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044f PHP, \u0438 \u041d\u0438\u043a\u0438\u0442\u044b \u041f\u043e\u043f\u043e\u0432\u0430, \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043a\u043b\u044e\u0447\u0435\u0432\u044b\u0445 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 PHP. \u0422\u0430\u043a \u043a\u0430\u043a \u043d\u0435\u0442 \u0443\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0432 \u043d\u0430\u0434\u0451\u0436\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0431\u044b\u043b \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0440\u0435\u0448\u0438\u043b\u0438, \u0447\u0442\u043e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0441\u0432\u043e\u0438\u043c\u0438 \u0441\u0438\u043b\u0430\u043c\u0438 Git-\u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0441\u043e\u0437\u0434\u0430\u0451\u0442 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0440\u0438\u0441\u043a\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99606","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Des modifications malveillantes d\u00e9tect\u00e9es dans le d\u00e9p\u00f4t Git du projet PHP | ProHoster","description":"Les d\u00e9veloppeurs du projet PHP ont averti de la compromission du d\u00e9p\u00f4t Git du projet et de la d\u00e9couverte de deux commits malveillants, ajout\u00e9s le 28 mars dans le d\u00e9p\u00f4t php-src au nom de Rasmus Lerdorf, le fondateur de PHP, et de Nikita.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/v-git-repozitorii-proekta-php-vyyavleny-vredonosnye-izmeneniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0434\u0432\u0443\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 28 \u043c\u0430\u0440\u0442\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 php-src \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0420\u0430\u0441\u043c\u0443\u0441\u0430 \u041b\u0435\u0440\u0434\u043e\u0440\u0444\u0430, \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044f PHP, \u0438 \u041d\u0438\u043a\u0438\u0442\u044b.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/v-git-repozitorii-proekta-php-vyyavleny-vredonosnye-izmeneniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-03-29T20:22:34+00:00","article:modified_time":"2021-03-29T20:22:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99606","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-29 20:30:58","updated":"2026-02-22 15:29:48","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/99606","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=99606"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/99606\/revisions"}],"predecessor-version":[{"id":162210,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/99606\/revisions\/162210"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=99606"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=99606"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=99606"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}