{"id":100945,"date":"2021-08-08T16:22:46","date_gmt":"2021-08-08T14:22:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-setevyh-bibliotekah-yazykov-rust-i-go-pozvolyayushhaya-obojti-proverku-ip-adresov"},"modified":"2021-08-08T16:22:46","modified_gmt":"2021-08-08T14:22:47","slug":"uyazvimost-v-setevyh-bibliotekah-yazykov-rust-i-go-pozvolyayushhaya-obojti-proverku-ip-adresov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-setevyh-bibliotekah-yazykov-rust-i-go-pozvolyayushhaya-obojti-proverku-ip-adresov","title":{"rendered":"Vulnerabilit\u00e0 nelle librerie di rete dei linguaggi Rust e Go che consente di eludere il controllo degli indirizzi IP","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Nelle librerie standard dei linguaggi Rust e Go sono state identificate vulnerabilit\u00e0 legate alla gestione errata degli indirizzi IP con cifre ottali nelle funzioni di parsing degli indirizzi. Queste vulnerabilit\u00e0 consentono di bypassare i controlli sugli indirizzi validi nelle applicazioni, ad esempio per effettuare chiamate agli indirizzi dell'interfaccia loopback (127.x.x.x) o alle sottoreti intranet durante gli attacchi SSRF (Server-side request forgery). Le vulnerabilit\u00e0 continuano il ciclo di problemi precedentemente identificati nelle librerie node-netmask (JavaScript, CVE-2021-28918, CVE-2021-29418), private-ip (JavaScript, CVE-2020-28360), ipaddress (Python, CVE-2021-29921), Data::Validate::IP (Perl, CVE-2021-29662) e Net::Netmask (Perl, CVE-2021-29424). <\/p>\n

Secondo la specifica, i valori stringa IP addresses<\/a>, che iniziano con zero, devono essere interpretati come numeri ottali, ma molte librerie non tengono conto di questa peculiarit\u00e0 e semplicemente ignorano lo zero, trattando il valore come un numero decimale. Ad esempio, il numero 0177 nel sistema ottale \u00e8 uguale a 127 in decimale. Un attaccante pu\u00f2 richiedere una risorsa specificando il valore \u00ab0177.0.0.1\u00bb, che nella rappresentazione decimale corrisponde a \u00ab127.0.0.1\u00bb. Nel caso venga utilizzata una libreria problematica, l'applicazione non riconoscer\u00e0 l'ingresso dell'indirizzo 0177.0.0.1 nella rete 127.0.0.1\/8, ma effettivamente inviando la richiesta pu\u00f2 eseguire la chiamata all'indirizzo \u00ab0177.0.0.1\u00bb, che le funzioni di rete elaboreranno come 127.0.0.1. In modo simile, \u00e8 possibile ingannare anche il controllo sugli indirizzi intranet specificando valori come \u00ab012.0.0.1\u00bb (equivalente a \u00ab10.0.0.1\u00bb). <\/p>\n

In Rust, the issue affected the standard library std::net<\/code> (CVE-2021-29922). The IP address parser in this library discarded leading zeros before address values, but only if no more than three digits were specified; for example, 0177.0.0.1<\/code> would be considered an invalid value, while 010.8.8.8<\/code> and 127.0.026.1<\/code> would return incorrect results. Applications using std::net::IpAddr<\/code> when parsing user-specified addresses are potentially vulnerable to SSRF (Server-side request forgery), RFI (Remote File Inclusion), and LFI (Local File Inclusion) attacks. The vulnerability was fixed in Rust version 1.53.0.

\"Vulnerabilit\u00e0<\/center> <\/p>\n

In the Go language, the issue was present in the standard library net<\/code> (CVE-2021-29923). The built-in function net.ParseCIDR<\/code> ignores leading zeros before octal numbers instead of processing them correctly. For example, an attacker can send the value 00000177.0.0.1<\/code>, which when checked in the function net.ParseCIDR(00000177.0.0.1\/24)<\/code> will be parsed as 177.0.0.1\/24<\/code> instead of 127.0.0.1\/24<\/code>. The problem also manifests in the Kubernetes platform. The vulnerability was addressed in Go release 1.16.3 and beta version 1.17.

\"Vulnerabilit\u00e0<\/center>
\r\n \"Riproduci\r\n
<\/div>\r\n <\/div><\/center>
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 \u044f\u0437\u044b\u043a\u043e\u0432 Rust \u0438 Go \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0441 \u0432\u043e\u0441\u044c\u043c\u0438\u0440\u0438\u0447\u043d\u044b\u043c\u0438 \u0446\u0438\u0444\u0440\u0430\u043c\u0438 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u0445 \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0430\u0434\u0440\u0435\u0441\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u044b\u0445 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a \u0430\u0434\u0440\u0435\u0441\u0430\u043c loopback-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 (127.x.x.x) \u0438\u043b\u0438 \u0438\u043d\u0442\u0440\u0430\u043d\u0435\u0442-\u043f\u043e\u0434\u0441\u0435\u0442\u044f\u043c \u043f\u0440\u0438 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u0430\u0442\u0430\u043a SSRF (Server-side request forgery). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0446\u0438\u043a\u043b \u043f\u0440\u043e\u0431\u043b\u0435\u043c, \u0440\u0430\u043d\u0435\u0435 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 node-netmask […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":100946,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100945","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u00e0 nelle librerie di rete dei linguaggi Rust e Go che consente di bypassare il controllo degli indirizzi IP | ProHoster","description":"Sono state identificate vulnerabilit\u00e0 nelle librerie standard dei linguaggi Rust e Go, legate a un'errata elaborazione degli indirizzi IP con cifre ottali nelle funzioni di parsing dell'indirizzo.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-setevyh-bibliotekah-yazykov-rust-i-go-pozvolyayushhaya-obojti-proverku-ip-adresov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 \u044f\u0437\u044b\u043a\u043e\u0432 Rust \u0438 Go, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 | ProHoster","og:description":"\u0412 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 \u044f\u0437\u044b\u043a\u043e\u0432 Rust \u0438 Go \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0441 \u0432\u043e\u0441\u044c\u043c\u0438\u0440\u0438\u0447\u043d\u044b\u043c\u0438 \u0446\u0438\u0444\u0440\u0430\u043c\u0438 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u0445 \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0430\u0434\u0440\u0435\u0441\u0430.","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-setevyh-bibliotekah-yazykov-rust-i-go-pozvolyayushhaya-obojti-proverku-ip-adresov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-08-08T14:22:47+00:00","article:modified_time":"2021-08-08T14:22:47+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100945","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-08-08 15:21:11","updated":"2026-02-08 20:40:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/100945","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=100945"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/100945\/revisions"}],"predecessor-version":[{"id":158030,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/100945\/revisions\/158030"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media\/100946"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=100945"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=100945"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=100945"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}