{"id":86563,"date":"2020-06-27T01:42:01","date_gmt":"2020-06-26T23:42:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-curl-7-71-0-s-ustraneniem-dvuh-uyazvimostej"},"modified":"2020-06-27T01:42:01","modified_gmt":"2020-06-26T23:42:01","slug":"vypusk-curl-7-71-0-s-ustraneniem-dvuh-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/vypusk-curl-7-71-0-s-ustraneniem-dvuh-uyazvimostej","title":{"rendered":"Rilascio di curl 7.71.0 con la risoluzione di due vulnerabilit\u00e0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/curl.haxx.se\/mail\/archive-2020-06\/0055.html\">Disponibile<\/a><\/noindex> nuova versione dell'utilit\u00e0 per ricevere e inviare dati attraverso la rete \u2014 <noindex><a rel=\"nofollow\" href=\"https:\/\/curl.haxx.se\/\">curl 7.71.0<\/a><\/noindex>, che offre la possibilit\u00e0 di creare richieste flessibili specificando parametri come cookie, user_agent, referer e qualsiasi altro header. cURL supporta HTTP, HTTPS, HTTP\/2.0, HTTP\/3, SMTP, IMAP, POP3, Telnet, FTP, LDAP, RTSP, RTMP e altri protocolli di rete. \u00c8 stato rilasciato anche un aggiornamento della libreria libcurl, che fornisce un'API per utilizzare tutte le funzionalit\u00e0 di curl nei programmi scritti in linguaggi come C, Perl, PHP, Python. <\/p>\n<p>Nel nuovo aggiornamento \u00e8 stata aggiunta l'opzione &#171;&#8212;retry-all-errors&#187; per tentare nuovamente le operazioni in caso di errori e sono state risolte due vulnerabilit\u00e0:<\/p>\n<ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openwall.com\/lists\/oss-security\/2020\/06\/24\/2\">Vulnerabilit\u00e0<\/a><\/noindex> <noindex><a rel=\"nofollow\" href=\"https:\/\/curl.haxx.se\/docs\/CVE-2020-8177.html)\">CVE-2020-8177<\/a><\/noindex> consente di sovrascrivere un file locale nel sistema quando si accede a un server controllato dall'attaccante. Il problema si verifica solo con l'uso simultaneo delle opzioni &#171;-J&#187; (&#171;&#8212;remote-header-name&#187;) e &#171;-i&#187; (&#171;&#8212;head&#187;). L'opzione &#171;-J&#187; consente di salvare il file con il nome specificato nell'intestazione<br \/>\n&#171;Content-Disposition&#187;. Se un file con quel nome esiste gi\u00e0, il programma curl rifiuta normalmente di sovrascrivere, ma in presenza dell'opzione &#171;-i&#187; la logica di controllo viene violata e il file viene sovrascritto (il controllo avviene nella fase di ricezione del corpo della risposta, ma con l'opzione &#171;-i&#187; le intestazioni HTTP vengono stampate prima e riescono a essere salvate prima dell'elaborazione del corpo della risposta). Solo le intestazioni HTTP vengono registrate, ma il server pu\u00f2 restituire dati casuali al posto delle intestazioni e questi verranno registrati.<\/p>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openwall.com\/lists\/oss-security\/2020\/06\/24\/1\">Vulnerabilit\u00e0<\/a><\/noindex> <noindex><a rel=\"nofollow\" href=\"https:\/\/curl.haxx.se\/docs\/CVE-2020-8169.html\">CVE-2020-8169<\/a><\/noindex>  pu\u00f2 portare a una fuga su server DNS di alcune parti delle password di accesso al sito (Basic, Digest, NTLM, ecc.). Quando si utilizza il simbolo &#171;@&#187; nella password, che \u00e8 anche utilizzato come delimitatore della password nell'URL, in caso di reindirizzamento HTTP curl invier\u00e0 la parte della password dopo il simbolo &#171;@&#187; insieme al dominio per determinare il nome. Ad esempio, specificando la password &#171;passw@rd123&#187; e il nome utente &#171;dan&#187;, curl generer\u00e0 l'URL &#171;https:\/\/dan:passw@rd123@example.com\/path&#187; anzich\u00e9 &#171;https:\/\/dan:passwrd123@example.com\/path&#187; e invier\u00e0 la richiesta per risolvere l'host &#171;rd123@example.com&#187; anzich\u00e9 &#171;example.com&#187;.\n<p>Il problema si verifica quando si attiva il supporto per i reindirizzamenti HTTP relativi (disabilitati tramite CURLOPT_FOLLOWLOCATION). Nel caso si utilizzi DNS tradizionale, un provider DNS e un aggressore che ha la possibilit\u00e0 di intercettare il traffico di rete in transito possono scoprire parte della password (anche se la richiesta iniziale era in HTTPS, poich\u00e9 il traffico DNS non \u00e8 crittografato). Con l'uso di DNS-over-HTTPS (DoH), la fuga di dati \u00e8 limitata all'operatore DoH.<\/p>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Fonte: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53239\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e \u0441\u0435\u0442\u0438 &#8212; curl 7.71.0, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0433\u0438\u0431\u043a\u043e\u0433\u043e \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0441 \u0437\u0430\u0434\u0430\u043d\u0438\u0435\u043c \u0442\u0430\u043a\u0438\u0445 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432, \u043a\u0430\u043a cookie, user_agent, referer \u0438 \u043b\u044e\u0431\u044b\u0445 \u0434\u0440\u0443\u0433\u0438\u0445 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432. cURL \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 HTTP, HTTPS, HTTP\/2.0, HTTP\/3, SMTP, IMAP, POP3, Telnet, FTP, LDAP, RTSP, RTMP \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u044b. \u041e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0432\u044b\u0448\u043b\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-86563","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e \u0441\u0435\u0442\u0438 -\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/it\/blog\/news\/vypusk-curl-7-71-0-s-ustraneniem-dvuh-uyazvimostej\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"it_IT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a curl 7.71.0 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e \u0441\u0435\u0442\u0438 -\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/it\/blog\/news\/vypusk-curl-7-71-0-s-ustraneniem-dvuh-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-06-26T23:42:01+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-06-26T23:42:01+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Rilascio di curl 7.71.0 con la risoluzione di due vulnerabilit\u00e0 | ProHoster","description":"\u00c8 disponibile una nuova versione dello strumento per ricevere e inviare dati attraverso la rete -","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/vypusk-curl-7-71-0-s-ustraneniem-dvuh-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a curl 7.71.0 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e \u0441\u0435\u0442\u0438 -","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/vypusk-curl-7-71-0-s-ustraneniem-dvuh-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-26T23:42:01+00:00","article:modified_time":"2020-06-26T23:42:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"86563","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:13:22","updated":"2022-09-28 00:04:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/86563","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=86563"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/86563\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=86563"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=86563"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=86563"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}