curl 7.71.0 an sake shi, yana gyara lahani biyu

Akwai sabon sigar mai amfani don karɓa da aikawa da bayanai akan hanyar sadarwa - 7.71.0 curl, wanda ke ba da ikon tsara buƙata ta sassauƙa ta hanyar ƙayyadaddun sigogi kamar kuki, mai amfani_agent, referer da duk wani rubutun kai. CURL yana goyan bayan HTTP, HTTPS, HTTP/2.0, HTTP/3, SMTP, IMAP, POP3, Telnet, FTP, LDAP, RTSP, RTMP da sauran ka'idojin cibiyar sadarwa. A lokaci guda, an fitar da sabuntawa don ɗakin karatu na libcurl, wanda ake haɓakawa a layi daya, yana samar da API don amfani da duk ayyukan curl a cikin shirye-shirye a cikin harsuna kamar C, Perl, PHP, Python.

Sabuwar sakin ta ƙara zaɓin "--retry-all-errors" don sake gwada ayyuka idan wasu kurakurai sun faru kuma suna gyara lahani biyu:

  • Varfafawa CVE-2020-8177 yana ba ka damar sake rubuta fayil ɗin gida a cikin tsarin lokacin samun damar uwar garken da maharin ke sarrafawa. Matsalar tana bayyana ne kawai lokacin da aka yi amfani da zaɓuɓɓukan “-J” (“–remote-header-name”) da “-i” (“—kai”) a lokaci guda. Zaɓin "-J" yana ba ku damar adana fayil ɗin tare da sunan da aka ƙayyade a cikin taken
    "Content-Disposition". Idan fayil mai suna iri ɗaya ya riga ya wanzu, tsarin curl yawanci ya ƙi yin sake rubutawa, amma idan zaɓin “-i” yana nan, binciken binciken ya karye kuma an sake rubuta fayil ɗin (ana yin rajistan a matakin. na karɓar jikin amsawa, amma tare da zaɓin "-i" masu rubutun HTTP ana nunawa da farko kuma suna da lokacin da za a adana kafin a fara sarrafa jikin amsa). Ana rubuta rubutun HTTP kawai zuwa fayil ɗin, amma uwar garken na iya aika bayanan sabani maimakon masu kai kuma za a rubuta su.

  • Varfafawa CVE-2020-8169 na iya haifar da ɗigowa zuwa uwar garken DNS na wasu kalmomin shiga shafin (Basic, Digest, NTLM, da sauransu). Ta amfani da alamar "@" a cikin kalmar sirri, wanda kuma ake amfani dashi azaman mai raba kalmar sirri a cikin URL, lokacin da aka kunna tura HTTP, curl zai aika sashin kalmar sirri bayan alamar "@" tare da yankin don warwarewa. sunan. Misali, idan kun samar da kalmar sirri "passw@rd123" da sunan mai amfani "dan", curl zai samar da URL "https://dan:passw@[email kariya]/hanya" maimakon "https://dan:passw%[email kariya]/hanya" kuma zai aika da buƙatun don warware mai watsa shiri"[email kariya]" maimakon "example.com".

    Matsalar tana bayyana lokacin da aka kunna goyan baya ga masu turawa HTTP dangi (an kashe ta hanyar CURLOPT_FOLLOWLOCATION). Idan ana amfani da DNS na al'ada, mai ba da sabis na DNS na iya samun bayanai game da ɓangaren kalmar sirri ta mai ba da sabis na DNS da kuma ta maharin da ke da ikon kutse zirga-zirgar hanyar sadarwa (ko da ainihin buƙatar ta HTTPS ne, tunda ba a ɓoye zirga-zirgar DNS). Lokacin da aka yi amfani da DNS-over-HTTPS (DoH), ɗigon ruwan yana iyakance ga ma'aikacin DoH.

source: budenet.ru

Add a comment