curl 7.71.0 tso tawm, kho ob qhov tsis zoo

Muaj tshiab version ntawm cov nqi hluav taws xob rau kev txais thiab xa cov ntaub ntawv hla lub network - curl 7.71.0, uas muab lub peev xwm los hloov kho qhov kev thov los ntawm kev qhia qhov tsis xws li ncuav qab zib, user_agent, referer thiab lwm yam headers. cURL txhawb HTTP, HTTPS, HTTP/2.0, HTTP/3, SMTP, IMAP, POP3, Telnet, FTP, LDAP, RTSP, RTMP thiab lwm yam kev cai network. Nyob rau tib lub sijhawm, qhov hloov tshiab tau tso tawm rau lub tsev qiv ntawv libcurl, uas tau tsim nyob rau hauv tib lub sijhawm, muab API rau kev siv tag nrho cov haujlwm curl hauv cov kev pab cuam hauv hom lus xws li C, Perl, PHP, Python.

Qhov kev tso tawm tshiab ntxiv qhov "--retry-all-errors" kev xaiv kom rov ua haujlwm yog tias muaj teeb meem tshwm sim thiab kho ob qhov tsis zoo:

  • Kom txhob raug CVE-2020-8177 tso cai rau koj los sau cov ntaub ntawv hauv zos hauv qhov system thaum nkag mus rau lub server tswj los ntawm tus neeg tawm tsam. Qhov teeb meem tsuas yog tshwm sim thaum "-J" ("-remote-header-name") thiab "-i" ("-head") kev xaiv siv ib txhij. Qhov kev xaiv "-J" tso cai rau koj khaws cov ntaub ntawv nrog lub npe teev nyob rau hauv header
    "Cov ntsiab lus-Txoj Cai". Yog tias cov ntaub ntawv nrog tib lub npe twb muaj lawm, qhov kev pab cuam curl ib txwm tsis kam ua ib qho kev sau dua, tab sis yog tias qhov kev xaiv "-i" tam sim no, daim tshev logic tau tawg thiab cov ntaub ntawv tau sau dua (qhov kos yog nqa tawm ntawm theem. ntawm tau txais lub cev teb, tab sis nrog rau "-i" kev xaiv HTTP headers tau tshwm sim ua ntej thiab muaj sij hawm kom tau txais kev cawmdim ua ntej lub cev teb yuav pib ua tiav). Tsuas yog HTTP headers tau sau rau hauv cov ntaub ntawv, tab sis cov neeg rau zaub mov tuaj yeem xa cov ntaub ntawv tsis txaus ntseeg es tsis txhob siv cov headers thiab lawv yuav raug sau.

  • Kom txhob raug CVE-2020-8169 tej zaum yuav ua rau xau mus rau DNS server ntawm qee qhov chaw nkag passwords (Basic, Digest, NTLM, thiab lwm yam). Los ntawm kev siv lub cim "@" hauv tus password, uas tseem siv los ua tus password cais hauv URL, thaum HTTP redirect tshwm sim, curl yuav xa ib feem ntawm lo lus zais tom qab lub cim "@" nrog rau tus sau los daws. lub npe. Piv txwv li, yog tias koj muab tus password "passw@rd123" thiab tus username "dan", curl yuav tsim qhov URL "https://dan:passw@[email tiv thaiv]/path" hloov "https://dan:passw%[email tiv thaiv]/path" thiab yuav xa ib daim ntawv thov los daws tus tswv tsev "[email tiv thaiv]" hloov "example.com".

    Qhov teeb meem tshwm sim thaum kev txhawb nqa rau cov txheeb ze HTTP redirectors tau qhib (disabled ntawm CURLOPT_FOLLOWLOCATION). Yog tias siv DNS ib txwm siv, cov ntaub ntawv hais txog ib feem ntawm tus password tuaj yeem tau txais los ntawm DNS tus neeg muab kev pabcuam thiab los ntawm tus neeg tawm tsam uas muaj peev xwm cuam tshuam kev thauj mus los hauv lub network (txawm tias qhov kev thov thawj zaug yog los ntawm HTTPS, vim DNS kev khiav tsis yog encrypted). Thaum siv DNS-dhau-HTTPS (DoH) yog siv, qhov xau yog txwv rau DoH tus neeg teb xov tooj.

Tau qhov twg los: opennet.ru

Ntxiv ib saib