{"id":52757,"date":"2019-11-16T00:00:00","date_gmt":"2019-11-15T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po"},"modified":"2020-02-18T14:00:33","modified_gmt":"2020-02-18T11:00:33","slug":"github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po","title":{"rendered":"A GitHub elind\u00edtott egy k\u00f6z\u00f6s projektet az ny\u00edlt forr\u00e1sk\u00f3d\u00fa szoftverek sebezhet\u0151s\u00e9geinek felismer\u00e9s\u00e9re.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitHub ki\u00e1llt<\/a><\/noindex> a kezdem\u00e9nyez\u00e9ssel GitHub Security Lab<\/a><\/noindex>, amelynek c\u00e9lja a k\u00fcl\u00f6nb\u00f6z\u0151 c\u00e9gek \u00e9s szervezetek biztons\u00e1gi szak\u00e9rt\u0151inek k\u00f6z\u00f6s munk\u00e1j\u00e1nak megszervez\u00e9se a sebezhet\u0151s\u00e9gek azonos\u00edt\u00e1sa \u00e9s a ny\u00edlt projektek k\u00f3dj\u00e1ban val\u00f3 orvosl\u00e1s el\u0151seg\u00edt\u00e9se \u00e9rdek\u00e9ben. <\/p>\n

A kezdem\u00e9nyez\u00e9shez minden \u00e9rdekelt v\u00e1llalat \u00e9s sz\u00e1m\u00edt\u00f3g\u00e9pes biztons\u00e1gi szakember csatlakoz\u00e1s\u00e1t v\u00e1rj\u00e1k. A sebezhet\u0151s\u00e9g azonos\u00edt\u00e1s\u00e1\u00e9rt jutalom j\u00e1r<\/a><\/noindex> , amely legfeljebb 3000 doll\u00e1r lehet, a probl\u00e9ma s\u00falyoss\u00e1g\u00e1t\u00f3l \u00e9s a jelent\u00e9s min\u0151s\u00e9g\u00e9t\u0151l f\u00fcgg\u0151en. A probl\u00e9m\u00e1k jelent\u00e9s\u00e9re CodeQL<\/a><\/noindex>aj\u00e1nlott eszk\u00f6zt\u00e1r haszn\u00e1lata, amely lehet\u0151v\u00e9 teszi egy s\u00e9r\u00fcl\u00e9keny k\u00f3d sablon\u00e1nak l\u00e9trehoz\u00e1s\u00e1t, hogy azonos\u00edtani lehessen hasonl\u00f3 sebezhet\u0151s\u00e9geket m\u00e1s projektek k\u00f3dj\u00e1ban (a CodeQL lehet\u0151s\u00e9get ad a k\u00f3d szemantikai elemz\u00e9s\u00e9re \u00e9s lek\u00e9rdez\u00e9sek k\u00e9sz\u00edt\u00e9s\u00e9re specifikus strukt\u00far\u00e1k keres\u00e9s\u00e9re).<\/p>\n

A kezdem\u00e9nyez\u00e9shez m\u00e1r csatlakoztak biztons\u00e1gi kutat\u00f3k az F5, Google, HackerOne, Intel, IOActive, J.P. Morgan, LinkedIn, Microsoft, Mozilla, NCC Group, Oracle, Trail of Bits, Uber \u00e9s
\nVMware c\u00e9gekt\u0151l, akik az elm\u00falt k\u00e9t \u00e9vben felfedeztek<\/a><\/noindex> \u00e9s seg\u00edtettek kijav\u00edtani<\/a><\/noindex> 105 sebezhet\u0151s\u00e9get olyan projekteken, mint a Chromium, libssh2, a Linux kernel, Memcached, UBoot, VLC, Apport, HHVM, Exiv2, FFmpeg, Fizz, libav, Ansible, npm, XNU, Ghostscript, Icecast, Apache Struts, strongSwan, Apache Ignite, rsyslog, Apache Geode \u00e9s Hadoop. <\/p>\n

A GitHub \u00e1ltal javasolt k\u00f3d biztons\u00e1gi fenntart\u00e1si \u00e9letciklusa azt jelenti, hogy a GitHub Security Lab r\u00e9sztvev\u0151i felfedezik a sebezhet\u0151s\u00e9geket, majd az inform\u00e1ci\u00f3kat eljuttatj\u00e1k a karbantart\u00f3khoz \u00e9s fejleszt\u0151kh\u00f6z, akik kidolgozz\u00e1k a jav\u00edt\u00e1sokat, egyes\u00edtik az \u00e9rtes\u00edt\u00e9sek k\u00f6zz\u00e9t\u00e9teli idej\u00e9t, \u00e9s inform\u00e1lj\u00e1k a kapcsol\u00f3d\u00f3 projekteket a sebezhet\u0151s\u00e9g orvosl\u00e1s\u00e1hoz sz\u00fcks\u00e9ges verzi\u00f3k telep\u00edt\u00e9s\u00e9r\u0151l. Az alapban CodeQL sablonok lesznek elhelyezve, amelyek megakad\u00e1lyozz\u00e1k a m\u00e1r orvosolt probl\u00e9m\u00e1k \u00fajb\u00f3li megjelen\u00e9s\u00e9t a GitHub-on l\u00e9v\u0151 k\u00f3dban.
\n

\"A<\/a><\/noindex><\/center><\/p>\n

A GitHub fel\u00fclet\u00e9n most m\u00e1r lek\u00e9rhet\u0151<\/a><\/noindex> CVE-azonos\u00edt\u00f3 a felfedezett probl\u00e9m\u00e1hoz, \u00e9s a jelent\u00e9s elk\u00e9sz\u00edthet\u0151, m\u00edg a GitHub m\u00e1r maga k\u00fcldi el a sz\u00fcks\u00e9ges \u00e9rtes\u00edt\u00e9seket \u00e9s szervezi a koordin\u00e1lt jav\u00edt\u00e1st. Tov\u00e1bb\u00e1, a probl\u00e9ma kijav\u00edt\u00e1sa ut\u00e1n a GitHub automatikusan pull-reqeust k\u00fcld a sebezhet\u0151 projekttel kapcsolatos f\u00fcgg\u0151s\u00e9gek friss\u00edt\u00e9s\u00e9re.<\/p>\n

A GitHub szint\u00e9n bevezetett egy s\u00e9r\u00fcl\u00e9kenys\u00e9g katal\u00f3gust. GitHub Tan\u00e1csad\u00f3 Adatb\u00e1zis<\/a><\/noindex>, amelyben a GitHub projektekre vonatkoz\u00f3 sebezhet\u0151s\u00e9gek adatai valamint a probl\u00e9m\u00e1s csomagok \u00e9s t\u00e1rol\u00f3k nyomon k\u00f6vet\u00e9s\u00e9hez sz\u00fcks\u00e9ges inform\u00e1ci\u00f3k tal\u00e1lhat\u00f3k. A GitHub kommentjeiben eml\u00edtett CVE-azonos\u00edt\u00f3k mostant\u00f3l automatikusan hivatkoznak a sebezhet\u0151s\u00e9gr\u0151l sz\u00f3l\u00f3 r\u00e9szletes inform\u00e1ci\u00f3kra a bemutatott adatb\u00e1zisban. Az adatb\u00e1zissal val\u00f3 munka automatiz\u00e1l\u00e1s\u00e1ra k\u00fcl\u00f6n API<\/a><\/noindex>.<\/p>\n

Szint\u00e9n friss\u00edt\u00e9sr\u0151l sz\u00e1moltak be szolg\u00e1ltat\u00e1s<\/a><\/noindex> v\u00e9d\u00e9sek \u00e9rdek\u00e9ben a nyilv\u00e1nosan el\u00e9rhet\u0151 t\u00e1rol\u00f3kba<\/a><\/noindex> \u00e9rz\u00e9keny adatok, p\u00e9ld\u00e1ul hiteles\u00edt\u00e9si tokenek \u00e9s hozz\u00e1f\u00e9r\u00e9si kulcsok bek\u00f6lt\u00f6z\u00e9se ellen. A k\u00f6lcs\u00f6nz\u00e9s sor\u00e1n a szkenner ellen\u0151rzi a haszn\u00e1lt tokenek \u00e9s kulcsok mint\u00e1zatait,
\n20 felh\u0151szolg\u00e1ltat\u00e1s \u00e9s szolg\u00e1ltat\u00e1s , bele\u00e9rtve az Alibaba Cloud, Amazon Web Services (AWS), Azure, Google Cloud, Slack \u00e9s Stripe API-j\u00e1t. Amennyiben token ker\u00fcl felfedez\u00e9sre, a szolg\u00e1ltat\u00f3 k\u00e9rd\u00e9st k\u00fcld a leak meger\u0151s\u00edt\u00e9s\u00e9re \u00e9s a kompromitt\u00e1lt tokenek visszavon\u00e1s\u00e1ra. Tegnap \u00f3ta, a m\u00e1r kor\u00e1bban t\u00e1mogatott form\u00e1tumok mellett, a GoCardless, HashiCorp, Postman \u00e9s Tencent tokenek azonos\u00edt\u00e1s\u00e1nak t\u00e1mogat\u00e1sa is hozz\u00e1ad\u00f3dott.<\/a><\/noindex>IT szektor b\u00e9rez\u00e9se \u00e9s a legnagyobb 10 IT c\u00e9g nyitott \u00e1ll\u00e1sai az \u00f6rm\u00e9ny piacon<\/p>\n

<\/a><\/noindex><\/p>\n

Forr\u00e1s: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

GitHub \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b \u0441 \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u043e\u0439 GitHub Security Lab, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044e \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u043e\u0432 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u0441\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044e \u043f\u043e \u0438\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e \u0432 \u043a\u043e\u0434\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432. \u0414\u043b\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u0435 \u043f\u0440\u0438\u0433\u043b\u0430\u0448\u0430\u044e\u0442\u0441\u044f \u0432\u0441\u0435 \u0437\u0430\u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0438 \u0438\u043d\u0434\u0438\u0432\u0438\u0434\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043f\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0417\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0435\u0434\u0443\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u0430 \u0432\u044b\u043f\u043b\u0430\u0442\u0430 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c \u0434\u043e 3000 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":52758,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-52757","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47GitHub egy\u00fcttm\u0171k\u00f6d\u00e9st ind\u00edtott a ny\u00edlt forr\u00e1sk\u00f3d\u00fa sebezhet\u0151s\u00e9gek azonos\u00edt\u00e1s\u00e1ra | ProHoster","description":"\ud83e\udd47A GitHub k\u00f6z\u00f6s projektet ind\u00edtott a ny\u00edlt forr\u00e1sk\u00f3d\u00fa szoftverek sebezhet\u0151s\u00e9geinek felfedez\u00e9s\u00e9re | ProHoster","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47GitHub \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u044b\u0439 \u043f\u0440\u043e\u0435\u043a\u0442 \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u041f\u041e | ProHoster","og:description":"GitHub \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b \u0441 \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u043e\u0439","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-15T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52757","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 04:44:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:18:18","updated":"2026-01-24 04:44:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/52757","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=52757"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/52757\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media\/52758"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=52757"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=52757"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=52757"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}