{"id":122827,"date":"2025-03-25T04:22:52","date_gmt":"2025-03-25T02:22:52","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse"},"modified":"2025-03-25T04:22:52","modified_gmt":"2025-03-25T02:22:52","slug":"uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse","title":{"rendered":"Vulnerabilities in Pagure and OBS that permitted package compromise in Fedora and openSUSE repositories","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>A Fenrisk biztons\u00e1gi kutat\u00f3i felt\u00e1rt\u00e1k a Pagure \u00e9s az OBS (Open Build Service) eszk\u00f6zeiben tal\u00e1lhat\u00f3 sebezhet\u0151s\u00e9geket, amelyek lehet\u0151v\u00e9 tett\u00e9k a Fedora \u00e9s openSUSE disztrib\u00faci\u00f3k csomaggener\u00e1l\u00f3 infrastrukt\u00far\u00e1inak kompromitt\u00e1l\u00e1s\u00e1t. A kutat\u00f3k bemutatt\u00e1k, hogy lehets\u00e9ges t\u00e1mad\u00e1st v\u00e9grehajtani, amely lehet\u0151v\u00e9 tette a tetsz\u0151leges k\u00f3d v\u00e9grehajt\u00e1s\u00e1t a Pagure \u00e9s az OBS szerverein, ez\u00e1ltal hozz\u00e1j\u00e1rulva a Fedora \u00e9s openSUSE t\u00e1rol\u00f3iban tal\u00e1lhat\u00f3 csomagok m\u00f3dos\u00edt\u00e1s\u00e1hoz.     <\/p>\n<p>A Fedora \u00e1ltal a k\u00f3d \u00e9s a csomagok metainform\u00e1ci\u00f3inak k\u00f6z\u00f6s munk\u00e1j\u00e1ra haszn\u00e1lt Pagure platformon 4 sebezhet\u0151s\u00e9g ker\u00fclt el\u0151. A felfedezett probl\u00e9m\u00e1k kihaszn\u00e1l\u00e1s\u00e1hoz sz\u00fcks\u00e9ges egy fi\u00f3k a Pagure szolg\u00e1ltat\u00e1sban, amelyet b\u00e1rki megszerezhet (jelenleg 24899 felhaszn\u00e1l\u00f3 van regisztr\u00e1lva a Pagure.io-n). H\u00e1rom probl\u00e9ma lehet\u0151v\u00e9 teszi f\u00e1jlok olvas\u00e1s\u00e1t a rendszerben, m\u00edg egy probl\u00e9ma lehet\u0151v\u00e9 teszi a k\u00f3dunk v\u00e9grehajt\u00e1s\u00e1t. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/hu\/server\/dts-newyork\/\"   title=\"szerveren\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2806\">szerveren<\/a>. A probl\u00e9m\u00e1kat 2024. janu\u00e1r 1-j\u00e9n azonos\u00edtott\u00e1k, a bugzilla.redhat.com-on 2024. \u00e1prilis 25-\u00e9n jelentett\u00e9k, \u00e9s 3 \u00f3r\u00e1n bel\u00fcl orvosolt\u00e1k a Pagure-ban.    <\/p>\n<ul>\n<li class=\"l\"> A CVE-2024-4981 \u00e9s CVE-2024-47515 sebezhet\u0151s\u00e9gek a szimbolikus linkek nem megfelel\u0151 kezel\u00e9s\u00e9b\u0151l ad\u00f3dnak a f\u00e1jl friss\u00edt\u00e9si \u00e9s arch\u00edvum-gener\u00e1l\u00f3 funkci\u00f3k sor\u00e1n. A sebezhet\u0151s\u00e9gek lehet\u0151v\u00e9 teszik a helyi f\u00e1jlok tartalm\u00e1nak olvas\u00e1s\u00e1t a szerveren, p\u00e9ld\u00e1ul hozz\u00e1f\u00e9r\u00e9st ny\u00fajtanak a Pagure adminisztr\u00e1tor\u00e1nak munkamenet-param\u00e9tereit tartalmaz\u00f3 f\u00e1jlhoz, \u00edgy az adminisztr\u00e1tori jogosults\u00e1gokkal val\u00f3 hozz\u00e1f\u00e9r\u00e9shez. A _update_file_in_git() funkci\u00f3 kihaszn\u00e1l\u00e1sa a Pagure-ban t\u00f6rt\u00e9n\u0151 t\u00e1rol\u00f3 l\u00e9trehoz\u00e1s\u00e1hoz; egy olyan commit hozz\u00e1ad\u00e1s\u00e1hoz, amely \u00faj f\u00e1jlt tartalmaz, amely szimbolikus linkk\u00e9nt van l\u00e9trehozva a k\u00edv\u00e1nt rendszerf\u00e1jlra; e f\u00e1jl szerkeszt\u00e9s\u00e9nek megnyit\u00e1s\u00e1hoz a webes fel\u00fcleten.\n<li class=\"l\"> A sebezhet\u0151s\u00e9g (CVE-2024-4982) a view_issue_raw_file() funkci\u00f3ban lehet\u0151v\u00e9 teszi, hogy a felhaszn\u00e1l\u00f3k a alapmappa hat\u00e1rain k\u00edv\u00fclre l\u00e9pjenek a k\u00e9r\u00e9s param\u00e9tereiben haszn\u00e1lt \"\/..\" karakterek megad\u00e1s\u00e1val. A probl\u00e9ma lehet\u0151v\u00e9 teszi, hogy f\u00e1jlokat olvassanak a rendszeren, amennyire a webes fel\u00fclet \u00e1ltal futtatott folyamat hozz\u00e1f\u00e9r\u00e9si jogai megengedik. P\u00e9ld\u00e1ul a \"\/etc\/passwd\" f\u00e1jl megtekint\u00e9s\u00e9hez a k\u00f6vetkez\u0151 oldalt nyithatjuk meg: \"http:\/\/pagure.local:5000\/your-repository\/issue\/raw\/..\/..\/..\/..\/..\/..\/etc\/passwd\".\n<li class=\"l\"> A sebezhet\u0151s\u00e9g (CVE-2024-47516) a PagureRepo.log() funkci\u00f3ban lehet\u0151s\u00e9get ad arra, hogy a t\u00e1mad\u00f3 saj\u00e1t parancsait helyettes\u00edtse, \u00e9s k\u00f3dot futtasson a szerveren. A probl\u00e9ma abb\u00f3l ad\u00f3dik, hogy a f\u00e1jl m\u00f3dos\u00edt\u00e1si el\u0151zm\u00e9nyeinek megtekint\u00e9se sor\u00e1n a webes interf\u00e9sz a \"git\" parancsot h\u00edvja meg a parancssorban a branch azonos\u00edt\u00f3j\u00e1nak \u00e1tad\u00e1s\u00e1val (p\u00e9ld\u00e1ul: \"\/usr\/bin\/git --pretty=oneline --abbrev-commit  -- README.md\"). Az azonos\u00edt\u00f3 helyess\u00e9g\u00e9t nem ellen\u0151rzik, \u00edgy b\u00e1rmilyen parancssori opci\u00f3t meg lehet adni, p\u00e9ld\u00e1ul \"--output=\/tmp\/foo.bar\" a kimenet f\u00e1jlba val\u00f3 \u00e1tir\u00e1ny\u00edt\u00e1s\u00e1hoz. A t\u00e1mad\u00f3 \u00edgy a k\u00f6vetkez\u0151 k\u00e9r\u00e9s elk\u00fcld\u00e9s\u00e9vel fel\u00fcl\u00edrhat egy f\u00e1jlt a rendszerben: http:\/\/pagure.local:5000\/test\/history\/README.md?identifier=--output=\/tmp\/foo.bar\n<p>A Pagure git felhaszn\u00e1l\u00f3k\u00e9nt fut, ez\u00e9rt csak ennek a felhaszn\u00e1l\u00f3nak a f\u00e1jljait lehet fel\u00fcl\u00edrni. A szerveren l\u00e9v\u0151 k\u00f3d futtat\u00e1s\u00e1hoz SSH-n kereszt\u00fcli repository-hoz val\u00f3 hozz\u00e1f\u00e9r\u00e9st lehet ig\u00e9nybe venni, amikor a k\u00f6vetkez\u0151 parancs fut le: \"bash -c \/usr\/libexec\/pagure\/aclchecker.py\". A t\u00e1mad\u00f3 a sebezhet\u0151s\u00e9get kihaszn\u00e1lva fel\u00fcl\u00edrhatja a \" \/srv\/git\/.bashrc\" f\u00e1jlt, \u00e9s ez a f\u00e1jl a bash parancs\u00e9rtelmez\u0151vel lesz futtatva SSH kapcsolaton kereszt\u00fcl a repository el\u00e9r\u00e9sekor.      <\/p>\n<p>A t\u00e1mad\u00e1s l\u00e9nyege a Pagure rendszerbe val\u00f3 regisztr\u00e1l\u00e1s, repository l\u00e9trehoz\u00e1sa, a README.md f\u00e1jl hozz\u00e1ad\u00e1sa a repositoryhoz, megjegyz\u00e9ssel a commit form\u00e1j\u00e1ban: \"|| \/bin\/bash\", \u00e9s a k\u00e9r\u00e9s elk\u00fcld\u00e9se: \"http:\/\/pagure.local:5000\/test\/history\/README.md?identifier=--output=\/srv\/git\/.bashrc\". E l\u00e9p\u00e9sek sor\u00e1n a \"\/srv\/git\/.bashrc\" f\u00e1jlba egy olyan sor lesz be\u00edrva, ami p\u00e9ld\u00e1ul: \"34\u04305\u044143 || \/bin\/bash\". A l\u00e9trehozott \" \/srv\/git\/.bashrc\" f\u00e1jl futtat\u00e1s\u00e1hoz elegend\u0151 SSH-n csatlakozni a repositoryhoz a saj\u00e1t fi\u00f3kj\u00e1val. A Pagure szerveren a git felhaszn\u00e1l\u00f3 jogainak megfelel\u0151 k\u00f3dv\u00e9grehajt\u00e1s lehet\u0151v\u00e9 teszi az \u00f6sszes repository tartalm\u00e1nak ellen\u0151rz\u00e9s\u00e9t a csomagokkal.    <\/ul>\n<p>    <center><iframe title=\"Pagure\" src=\"https:\/\/player.vimeo.com\/video\/1066145210?h=0716980f9b\" width=\"640\" height=\"360\" frameborder=\"0\" allowfullscreen style =\"max-width: 100%;\" loading=\"lazy\"><\/iframe><\/center>        <\/p>\n<p>Az OBS (Open Build Service) platformban, amelyet az openSUSE \u00e9s n\u00e9h\u00e1ny m\u00e1s disztrib\u00faci\u00f3n a csomagok \u00f6ssze\u00e1ll\u00edt\u00e1s\u00e1ra haszn\u00e1lnak, egy s\u00e9r\u00fcl\u00e9kenys\u00e9get (CVE-2024-22033) fedeztek fel, amely lehet\u0151v\u00e9 teszi saj\u00e1t k\u00f3d v\u00e9grehajt\u00e1s\u00e1t a szerveren. A s\u00e9r\u00fcl\u00e9kenys\u00e9get 2024. j\u00fanius 27-\u00e9n azonos\u00edtott\u00e1k, az openSUSE projektnek 2024. j\u00fanius 29-\u00e9n jelentett\u00e9k, \u00e9s 2024. j\u00falius 10-\u00e9n jav\u00edtott\u00e1k.    <\/p>\n<p>A sebezhet\u0151s\u00e9g az \u201eobs-service-download_url\u201d szolg\u00e1ltat\u00e1sban tal\u00e1lhat\u00f3, ahol nem volt megfelel\u0151 ellen\u0151rz\u00e9s a URL-en, amelyet a wget seg\u00e9dprogram futtat\u00e1sakor alkalmaztak a forr\u00e1sk\u00f3d OBS-be val\u00f3 let\u00f6lt\u00e9s\u00e9re. A t\u00e1mad\u00f3 megadhat egy konfigur\u00e1ci\u00f3t az OBS szolg\u00e1ltat\u00e1sban, ahol a k\u00f3d let\u00f6lt\u00e9s\u00e9nek URL-je helyett a wget parancs\u00e1nak egy opci\u00f3j\u00e1t adj\u00e1k meg, p\u00e9ld\u00e1ul:            &lt;service name=&#187;download_url&#187;&gt;     &lt;param name=&#187;url&#187;&gt;&#8212;output-document=\\\/tmp\\\/test&lt;\\\/param&gt;     &lt;param name=&#187;download-manifest&#187;&gt;tempfile&lt;\\\/param&gt;     &lt;\\\/service&gt;     &lt;\\\/services&gt;      <\/p>\n<p> A wget URL n\u00e9lk\u00fcli futtat\u00e1sakor fell\u00e9p\u0151 hiba megker\u00fcl\u00e9s\u00e9re a p\u00e9lda a \u201edownload-manifest\u201d opci\u00f3t alkalmazza, amely lehet\u0151v\u00e9 teszi egy URL-lista megad\u00e1s\u00e1t k\u00fcl\u00f6n f\u00e1jlban. A fent eml\u00edtett p\u00e9lda a k\u00f6vetkez\u0151 parancs v\u00e9grehajt\u00e1s\u00e1hoz vezet:       \\\/usr\\\/bin\\\/wget -i \\\/srv\\\/obs\\\/service\\\/XXXXX\\\/src\\\/tempfile -4 &#8212;output-document=\\\/tmp\\\/test    <\/p>\n<p>amely lehet\u0151v\u00e9 teszi, hogy a \\\/tmp\\\/test f\u00e1jlba a f\u00e1jlban, a \\\/srv\\\/obs\\\/service\\\/XXXXX\\\/src\\\/tempfile f\u00e1jlban megadott hivatkoz\u00e1sb\u00f3l let\u00f6lt\u00f6tt tartalom ker\u00fclj\u00f6n. Az OBS fel\u00fclet\u00e9n kereszt\u00fcl a t\u00e1mad\u00f3 ezen a linken kereszt\u00fcl t\u00f6lti fel a k\u00f3dot a build.opensuse.org webhelyre, amely ingyenes regisztr\u00e1ci\u00f3t tesz lehet\u0151v\u00e9. A f\u00e1jl fel\u00fcl\u00edr\u00e1s\u00e1n k\u00edv\u00fcl a t\u00e1mad\u00f3 b\u00e1rmilyen f\u00e1jlt is elk\u00fcldhet mag\u00e1nak, ha a \u201e&#171;&#8212;output-document&#187;\u201d opci\u00f3 helyett a \u201e&#171;&#8212;post-file&#187;\u201d opci\u00f3t adja meg, p\u00e9ld\u00e1ul: \u201e&#171;&#8212;post-file=\\\/etc\\\/passwd&#187;\u201d. \u00cdgy a t\u00e1mad\u00f3 olvashat \u00e9s \u00edrhat f\u00e1jlokat a szerveren, amennyire a hozz\u00e1f\u00e9r\u00e9si jogok lehet\u0151v\u00e9 teszik, amely alatt az OBS szolg\u00e1ltat\u00e1s fut.    <\/p>\n<p>Ahhoz, hogy a f\u00e1jlba t\u00f6rt\u00e9n\u0151 \u00edr\u00e1s lehet\u0151s\u00e9g\u00e9t k\u00f3d futtat\u00e1ss\u00e1 alak\u00edts\u00e1k a szerveren, a kutat\u00f3k egy k\u00e9tl\u00e9pcs\u0151s m\u00f3dszert javasoltak. A k\u00e9t l\u00e9p\u00e9s sz\u00fcks\u00e9ges, mivel a t\u00e1mad\u00f3 l\u00e9trehozhat egy \u201e.wgetrc\u201d f\u00e1jlt a wget be\u00e1ll\u00edt\u00e1saival, de ez \u00f6nmag\u00e1ban nem elegend\u0151 parancsok v\u00e9grehajt\u00e1s\u00e1hoz. Ugyanakkor a \u201e.wgetrc\u201d f\u00e1jl seg\u00edts\u00e9g\u00e9vel felt\u00e9teleket lehet l\u00e9trehozni b\u00e1rmely program v\u00e9grehajt\u00e1s\u00e1hoz a rendszerben, de argumentumok \u00e1tad\u00e1sa n\u00e9lk\u00fcl. Tetsz\u0151leges k\u00f3d v\u00e9grehajt\u00e1s\u00e1hoz javasolt a \u201eprove\u201d programot futtatni, amely feldolgozza a \u201e.proverc\u201d konfigur\u00e1ci\u00f3s f\u00e1jlt, amely lehet\u0151v\u00e9 teszi a \u201e&#8212;exec\u201d opci\u00f3 megad\u00e1s\u00e1t b\u00e1rmilyen k\u00f3d v\u00e9grehajt\u00e1s\u00e1hoz.     <\/p>\n<p>Az els\u0151 l\u00e9p\u00e9sben a fent eml\u00edtett manipul\u00e1ci\u00f3k r\u00e9v\u00e9n a felhaszn\u00e1l\u00f3 otthoni k\u00f6nyvt\u00e1r\u00e1ban, az \u201eobsservicerun\u201d n\u00e9ven, l\u00e9trej\u00f6n egy \u201e.proverc\u201d f\u00e1jl, amely tartalmazza azokat a parancsokat, amelyeket a \u201eprove\u201d folyamat ind\u00edt\u00e1sakor fognak v\u00e9grehajtani. A m\u00e1sodik l\u00e9p\u00e9sben egy .wgetrc f\u00e1jl keletkezik az \u201euse-askpass=\/usr\/bin\/prove\u201d param\u00e9terrel, amely a \u201eprove\u201d h\u00edv\u00e1s\u00e1t eredm\u00e9nyezi. Amint ezek a f\u00e1jlok megjelennek, elegend\u0151 l\u00e9trehozni a wget seg\u00edts\u00e9g\u00e9vel a sz\u00fcks\u00e9ges adatbet\u00f6lt\u00e9si k\u00f6r\u00fclm\u00e9nyeket, \u00e9s ez elind\u00edtja a t\u00e1mad\u00f3 k\u00f3dj\u00e1t a szerveren az \u201eobsservicerun\u201d felhaszn\u00e1l\u00f3i jog\u00e1val. Az \u201eobsservicerun\u201d felhaszn\u00e1l\u00f3i joga elegend\u0151 az OBS felhaszn\u00e1l\u00f3k \u00e1ltal a csomagok al\u00e1\u00edr\u00e1s\u00e1hoz haszn\u00e1lt kulcsok kinyer\u00e9s\u00e9hez a t\u00e1rol\u00f3kb\u00f3l.     <center>  <iframe title=\"Open Build Service\" src=\"https:\/\/player.vimeo.com\/video\/1066093605?h=d7a210d719\" width=\"640\" height=\"360\" frameborder=\"0\" allowfullscreen style =\"max-width: 100%;\" loading=\"lazy\"><\/iframe><\/center>    <\/p>\n<p>Kieg\u00e9sz\u00edt\u00e9s: A SUSE Term\u00e9kv\u00e9delmi Csapat szerint az OBS sebezhet\u0151s\u00e9g\u00e9nek vesz\u00e9lye t\u00fals\u00e1gosan fel van \u00e9rt\u00e9kelve, \u00e9s a kutat\u00f3k \u00e1ll\u00edt\u00e1sa, miszerint a probl\u00e9ma lehet\u0151v\u00e9 teszi az \u00f6sszes csomag kompromitt\u00e1l\u00e1s\u00e1t az openSUSE disztrib\u00faci\u00f3ban, nem felel meg a val\u00f3s\u00e1gnak. Megjegyzik, hogy a build.opensuse.org infrastrukt\u00far\u00e1ban fut\u00f3 szolg\u00e1ltat\u00e1sok elszigetelt tart\u00e1lyok haszn\u00e1lat\u00e1val m\u0171k\u00f6dnek, amelyek \u00fajra l\u00e9trehozva \u00e9s kritikus inform\u00e1ci\u00f3t\u00f3l mentesen k\u00e9sz\u00fclnek. A felfedezett sebezhet\u0151s\u00e9get vesz\u00e9lyesnek \u00e9rt\u00e9kelik, de nem elegend\u0151nek az openSUSE \u00e9p\u00edt\u00e9si infrastrukt\u00far\u00e1j\u00e1nak \u00e9s a kialak\u00edtott csomagoknak a kompromitt\u00e1l\u00e1s\u00e1hoz. Ezen k\u00edv\u00fcl megjegyezt\u00e9k, hogy az OBS fel\u00fclet\u00e9n v\u00e9gzett, a t\u00e1mad\u00e1si p\u00e9ld\u00e1ban le\u00edrt m\u0171veletek csak a fejleszt\u0151 munka\u00e1llom\u00e1s\u00e1n helyben telep\u00edtett OBS verzi\u00f3j\u00e1ban val\u00f3sulhattak meg.<br \/>\n<br \/>Forr\u00e1s: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=62928\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Fenrisk \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 Pagure \u0438 OBS (Open Build Service), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0445 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 Fedora \u0438 openSUSE. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0441 Pagure \u0438 OBS, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 Fedora \u0438 openSUSE. [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-122827","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Fenrisk \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 Pagure \u0438 OBS (Open Build Service), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0445 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"hu_HU\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Pagure \u0438 OBS, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u0432\u0448\u0438\u0435 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 Fedora \u0438 openSUSE | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Fenrisk \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 Pagure \u0438 OBS (Open Build Service), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0445 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-03-25T02:22:52+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2025-03-25T02:22:52+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sebezhet\u0151s\u00e9gek a Pagure-ban \u00e9s az OBS-ben, amelyek lehet\u0151v\u00e9 tett\u00e9k a Fedora \u00e9s az openSUSE t\u00e1rol\u00f3iban l\u00e9v\u0151 csomagok kompromitt\u00e1l\u00e1s\u00e1t | ProHoster","description":"A Fenrisk c\u00e9g biztons\u00e1gi kutat\u00f3i felfedt\u00e9k a Pagure \u00e9s az OBS (Open Build Service) eszk\u00f6zeiben l\u00e9v\u0151 sebezhet\u0151s\u00e9geket, amelyek lehet\u0151v\u00e9 tett\u00e9k a disztrib\u00faci\u00f3k csomagform\u00e1l\u00e1si infrastrukt\u00far\u00e1inak kompromitt\u00e1l\u00e1s\u00e1t.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Pagure \u0438 OBS, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u0432\u0448\u0438\u0435 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 Fedora \u0438 openSUSE | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Fenrisk \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 Pagure \u0438 OBS (Open Build Service), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0445 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-03-25T02:22:52+00:00","article:modified_time":"2025-03-25T02:22:52+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"122827","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:07:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 11:32:22","updated":"2026-02-09 22:07:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/122827","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=122827"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/122827\/revisions"}],"predecessor-version":[{"id":160086,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/122827\/revisions\/160086"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=122827"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=122827"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=122827"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}