{"id":114665,"date":"2024-03-30T12:25:45","date_gmt":"2024-03-30T10:25:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/retrospektiva-prodvizheniya-bekdora-v-paket-xz"},"modified":"2024-03-30T12:25:45","modified_gmt":"2024-03-30T10:25:45","slug":"retrospektiva-prodvizheniya-bekdora-v-paket-xz","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/retrospektiva-prodvizheniya-bekdora-v-paket-xz","title":{"rendered":"A h\u00e1ts\u00f3 bej\u00e1rat csomagba val\u00f3 bevezet\u00e9s\u00e9nek visszatekint\u00e9se az xz-re","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Val\u00f3sz\u00edn\u0171leg a xz csomagba egy h\u00e1tlapot \u00e9p\u00edtett be Jia Tan fejleszt\u0151, aki 2022-ben t\u00e1mogat\u00f3i st\u00e1tuszt kapott, \u00e9s a 5.4.2-es verzi\u00f3t\u00f3l kezdve adta ki a kiad\u00e1sokat. Az xz projekten k\u00edv\u00fcl a h\u00e1tlap felt\u00e9telezett szerz\u0151je r\u00e9szt vett az xz-java \u00e9s xz-embedded csomagok fejleszt\u00e9s\u00e9ben, \u00e9s a Linux kernelben haszn\u00e1lt XZ Embedded projekt karbantart\u00f3i k\u00f6z\u00e9 is be lett sorolva. <\/p>\n

A h\u00e1ts\u00f3 ajt\u00f3 n\u00e9pszer\u0171s\u00edt\u00e9se sor\u00e1n k\u00e9t m\u00e1sik r\u00e9sztvev\u0151t is megfigyeltek - Jigar Kumar-t \u00e9s Hans Jansen-t, akik l\u00e1that\u00f3an virtu\u00e1lis karakterek. Jigar Kumar 2022 \u00e1prilis\u00e1ban hozz\u00e1j\u00e1rult a Jia Tan korai foltjaiban a xz t\u00e1mogat\u00e1s\u00e1hoz, amely a sz\u0171r\u0151sz\u00f6vegek t\u00e1mogat\u00e1s\u00e1t val\u00f3s\u00edtotta meg, \u00e9s mor\u00e1lis nyom\u00e1st gyakorolt Lasse Collinra, a kor\u00e1bbi karbantart\u00f3ra, azt kritiz\u00e1lva, hogy nem k\u00e9pes ell\u00e1tni feladatait, \u00e9s nem fogad el hasznos jav\u00edt\u00e1sokat. J\u00faniusban Lasse Collin egyet\u00e9rtett azzal, hogy a projektnek \u00faj karbantart\u00f3ra van sz\u00fcks\u00e9ge, panaszolta a ki\u00e9g\u00e9st \u00e9s a ment\u00e1lis eg\u00e9szs\u00e9gi probl\u00e9m\u00e1kat, \u00e9s \u00e1tadta a karbantart\u00f3i jogokat Jia Tan-nak. Ezt k\u00f6vet\u0151en Jigar Kumar t\u00f6bbet nem jelent meg a levelez\u00e9sben. <\/p>\n

A karbantart\u00f3i jogok megszerz\u00e9s\u00e9vel Jia Tan akt\u00edvan elkezdte m\u00f3dos\u00edt\u00e1sok hozz\u00e1ad\u00e1s\u00e1t a projekthez, \u00e9s statisztik\u00e1k alapj\u00e1n k\u00e9t \u00e9v alatt a m\u00e1sodik helyet foglalta el a fejleszt\u0151k k\u00f6z\u00f6tt a m\u00f3dos\u00edt\u00e1sok sz\u00e1m\u00e1ban. 2023 m\u00e1rcius\u00e1ban az xz csomag tesztel\u00e9s\u00e9\u00e9rt felel\u0151s szem\u00e9lyt Lasse Collint\u00f3l Jia Tanra cser\u00e9lt\u00e9k, j\u00faniusban pedig az xz-be elfogadt\u00e1k a liblzma IFUNC mechanizmus\u00e1nak t\u00e1mogat\u00e1s\u00e1t hozz\u00e1ad\u00f3 m\u00f3dos\u00edt\u00e1sokat (a crc64_fast konstruktor ifunc-ra lett cser\u00e9lve), amelyet k\u00e9s\u0151bb a h\u00e1tlapban haszn\u00e1ltak a funkci\u00f3k elfog\u00e1s\u00e1ra. A m\u00f3dos\u00edt\u00e1st Hans Jansen javasolta, Jia Tan fogadta el az xz r\u00e9szek\u00e9nt. Hans Jansen fi\u00f3kja k\u00f6zvetlen\u00fcl a pull-k\u00e9r\u00e9s elk\u00fcld\u00e9se el\u0151tt lett l\u00e9trehozva. <\/p>\n

2023 j\u00falius\u00e1ban Jia Tan k\u00e9rv\u00e9nyezte az oss-fuzz fejleszt\u0151in\u00e9l az ifunc ellen\u0151rz\u00e9s\u00e9nek letilt\u00e1s\u00e1t annak inkompatibilit\u00e1sa miatt a «-fsanitize=address» m\u00f3ddal. 2024 febru\u00e1r elej\u00e9n a projekt webhely\u00e9re mutat\u00f3 hivatkoz\u00e1s az oss-fuzz-ban \u00e9s a tukaani.org f\u0151oldal\u00e1n a «tukaani.org\/xz\/» c\u00edmr\u0151l «xz.tukaani.org» c\u00edmre v\u00e1ltozott, ahol az «xz.tukaani.org» aldomain a GitHub Pages szolg\u00e1ltat\u00e1sban volt el\u00e9rhet\u0151, \u00e9s szem\u00e9lyesen Jia Tan ellen\u0151rizte. Febru\u00e1r 23-\u00e1n az xz t\u00e1rol\u00f3ban arch\u00edvumokat tettek k\u00f6zz\u00e9 a dek\u00f3der teljes\u00edtm\u00e9ny\u00e9nek tesztel\u00e9s\u00e9re, k\u00f6zt\u00fck a bad-3-corrupt_lzma2.xz \u00e9s good-large_compressed.lzma f\u00e1jlokat, amelyek rejtett h\u00e1ts\u00f3 ajt\u00f3t tartalmaztak. A h\u00e1ts\u00f3 ajt\u00f3 aktiv\u00e1l\u00e1s\u00e1hoz sz\u00fcks\u00e9ges M4-makr\u00f3k csak a 5.6.0-\u00e1s kiad\u00e1s tar-arch\u00edvum\u00e1ba lettek belefoglalva, \u00e9s ki lettek z\u00e1rva a Git-t\u00e1rol\u00f3b\u00f3l, de megjelentek a .gitignore f\u00e1jlban. <\/p>\n

M\u00e1rcius 17-\u00e9n Hans Jansen, aki kor\u00e1bban javaslatokat tett az IFUNC t\u00e1mogat\u00e1s\u00e1ra, a Debian projekt r\u00e9szes\u00e9v\u00e9 v\u00e1lt, \u00e9s m\u00e1rcius 25-\u00e9n k\u00e9rte a xz-utils csomag verzi\u00f3j\u00e1nak friss\u00edt\u00e9s\u00e9t a Debian t\u00e1rol\u00f3ban. Verzi\u00f3friss\u00edt\u00e9si k\u00e9relmeket a Fedora \u00e9s az Ubuntu fejleszt\u0151ihez is bek\u00fcldtek (az Ubuntu t\u00e1rol\u00f3ja fagyaszt\u00e1si f\u00e1zisban volt, \u00edgy a m\u00f3dos\u00edt\u00e1st elutas\u00edtott\u00e1k). <\/p>\n

A verzi\u00f3friss\u00edt\u00e9si k\u00e9r\u00e9sekhez n\u00e9h\u00e1ny felhaszn\u00e1l\u00f3 is csatlakozott, akik azt \u00e1ll\u00edtott\u00e1k, hogy az \u00faj verzi\u00f3ban megsz\u00fcntett\u00e9k a valgrind alatt jelentkez\u0151 zavarokat, melyeket a h\u00e1ts\u00f3ajt\u00f3 kezel\u0151j\u00e9nek hib\u00e1s veremelrendez\u00e9se okozott, \u00e9s ezeket a probl\u00e9m\u00e1kat a h\u00e1ts\u00f3ajt\u00f3 fejleszt\u0151i az xz 5.6.1 verzi\u00f3ban igyekeztek orvosolni. A hib\u00e1kat Andr\u00e9s Freund, a Microsoft munkat\u00e1rsa, aki a PostgreSQL fejleszt\u00e9s\u00e9ben r\u00e9szt vesz, is \u00e9rdekl\u0151dve figyelte, mivel felfedezte a h\u00e1ts\u00f3ajt\u00f3 jelenl\u00e9t\u00e9t, \u00e9s \u00e9rtes\u00edtette a k\u00f6z\u00f6ss\u00e9get.
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0431\u044d\u043a\u0434\u043e\u0440 \u0432 \u043f\u0430\u043a\u0435\u0442 xz \u0431\u044b\u043b \u0432\u043d\u0435\u0434\u0440\u0451\u043d \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u043c Jia Tan, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432 2022 \u0433\u043e\u0434\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u0441\u0442\u0430\u0442\u0443\u0441 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u0438 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u043b \u0440\u0435\u043b\u0438\u0437\u044b \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 5.4.2. \u041f\u043e\u043c\u0438\u043c\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 xz \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u043c\u044b\u0439 \u0430\u0432\u0442\u043e\u0440 \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0442\u0430\u043a\u0436\u0435 \u0443\u0447\u0430\u0441\u0442\u0432\u043e\u0432\u0430\u043b \u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 xz-java \u0438 xz-embedded, \u0438 \u0431\u044b\u043b \u0432\u043a\u043b\u044e\u0447\u0451\u043d \u0432 \u0447\u0438\u0441\u043b\u043e \u043c\u044d\u0439\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 XZ Embedded, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432 \u044f\u0434\u0440\u0435 Linux. \u0412 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114665","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 H\u00e1ts\u00f3ajt\u00f3 el\u0151ret\u00f6r\u00e9s\u00e9nek visszatekint\u00e9se az xz csomagba | ProHoster","description":"Felt\u00e9telez\u00e9sek szerint a h\u00e1ts\u00f3ajt\u00f3t a Jia Tan nev\u0171 fejleszt\u0151 helyezte el az xz csomagba, aki 2022-ben karbantart\u00f3i st\u00e1tuszt kapott, \u00e9s a 5.4.2 verzi\u00f3t\u00f3l kezdve publik\u00e1lta a kiad\u00e1sokat.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/retrospektiva-prodvizheniya-bekdora-v-paket-xz","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0442\u0440\u043e\u0441\u043f\u0435\u043a\u0442\u0438\u0432\u0430 \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0432 \u043f\u0430\u043a\u0435\u0442 xz | ProHoster","og:description":"\u041f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0431\u044d\u043a\u0434\u043e\u0440 \u0432 \u043f\u0430\u043a\u0435\u0442 xz \u0431\u044b\u043b \u0432\u043d\u0435\u0434\u0440\u0451\u043d \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u043c Jia Tan, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432 2022 \u0433\u043e\u0434\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u0441\u0442\u0430\u0442\u0443\u0441 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u0438 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u043b \u0440\u0435\u043b\u0438\u0437\u044b \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 5.4.2.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/retrospektiva-prodvizheniya-bekdora-v-paket-xz","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-30T10:25:45+00:00","article:modified_time":"2024-03-30T10:25:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/114665","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=114665"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/114665\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=114665"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=114665"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=114665"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}