{"id":104974,"date":"2022-08-31T09:36:39","date_gmt":"2022-08-31T07:36:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vtoraya-za-nedelyu-kriticheskaya-uyazvimost-v-gitlab"},"modified":"2022-08-31T09:36:39","modified_gmt":"2022-08-31T07:36:39","slug":"vtoraya-za-nedelyu-kriticheskaya-uyazvimost-v-gitlab","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/news\/vtoraya-za-nedelyu-kriticheskaya-uyazvimost-v-gitlab","title":{"rendered":"Otr\u0101 kritisk\u0101 ievainojam\u012bba GitLab \u0161oned\u0113\u013c","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitLab uz\u0146\u0113mums ir public\u0113jis n\u0101kamo labojumu s\u0113riju savai sadarb\u012bbas izstr\u0101des platformai \u2014 15.3.2, 15.2.4 un 15.1.6, kur\u0101s ir nov\u0113rsta kritiska ievainojam\u012bba (CVE-2022-2992), kas \u013cauj autentific\u0113tam lietot\u0101jam att\u0101lin\u0101ti izpild\u012bt kodu server\u012b. L\u012bdz\u012bgi k\u0101 ievainojam\u012bba CVE-2022-2884, kas tika nov\u0113rsta pirms ned\u0113\u013cas, jaun\u0101 probl\u0113ma ir kl\u0101teso\u0161a API, kas paredz\u0113ts datu import\u0113\u0161anai no GitHub pakalpojuma. Ievainojam\u012bba izpau\u017eas ar\u012b versij\u0101s 15.3.1, 15.2.3 un 15.1.5, kur\u0101s pirm\u0101 ievainojam\u012bba import\u0113\u0161anas kod\u0101 no GitHub tika nov\u0113rsta. <\/p>\n

S\u012bk\u0101ka inform\u0101cija par ekspluat\u0101ciju pagaid\u0101m netiek sniegta. Inform\u0101cija par ievainojam\u012bbu ir nodota GitLab, pamatojoties uz akt\u012bvo HackerOne programmu, kas paredz\u0113ta atl\u012bdz\u012bb\u0101m par ievainojam\u012bbu atkl\u0101\u0161anu, bet at\u0161\u0137ir\u012bb\u0101 no iepriek\u0161\u0113j\u0101s probl\u0113mas, to ir identific\u0113jis cits dal\u012bbnieks. K\u0101 apvedce\u013c\u0161 administratoram ieteicams atsl\u0113gt GitHub import\u0113\u0161anas funkciju (GitLab t\u012bmek\u013ca saskarn\u0113: \u00abMenu\u00bb -> \u00abAdmin\u00bb -> \u00abSettings\u00bb -> \u00abGeneral\u00bb -> \u00abVisibility and access controls\u00bb -> \u00abImport sources\u00bb -> atsl\u0113gt \u00abGitHub\u00bb). <\/p>\n

Turkl\u0101t pied\u0101v\u0101tajos atjaunin\u0101jumos ir nov\u0113rstas v\u0113l 14 ievainojam\u012bbas, no kur\u0101m divas ir atz\u012btas par b\u012bstam\u0101m, desmit ir pie\u0161\u0137irts vid\u0113js b\u012bstam\u012bbas l\u012bmenis, bet divas atz\u012bm\u0113tas k\u0101 nekait\u012bgas. B\u012bstamas atz\u012btas: ievainojam\u012bba CVE-2022-2865, kas \u013cauj pievienot savu JavaScript kodu citiem lietot\u0101jiem redzam\u0101s lap\u0101s, manipul\u0113jot ar kr\u0101sainaj\u0101m eti\u0137et\u0113m, k\u0101 ar\u012b ievainojam\u012bba CVE-2022-2527, kas dod iesp\u0113ju ievietot savu saturu, izmantojot apraksta lauku incidentu hronolo\u0123ij\u0101 (Incidents Timeline). Vid\u0113ja l\u012bme\u0146a ievainojam\u012bbas galvenok\u0101rt ir saist\u012btas ar atteik\u0161an\u0101s no pakalpojuma iesp\u0113j\u0101m.
\n
Avots: opennet.lv<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitLab \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u0443\u044e \u0441\u0435\u0440\u0438\u044e \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0441\u0432\u043e\u0435\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 — 15.3.2, 15.2.4 \u0438 15.1.6, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-2992), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041a\u0430\u043a \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2022-2884, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u043d\u0435\u0434\u0435\u043b\u044e \u043d\u0430\u0437\u0430\u0434, \u043d\u043e\u0432\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 API \u0434\u043b\u044f \u0438\u043c\u043f\u043e\u0440\u0442\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438\u0437 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 GitHub. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104974","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Otr\u0101 \u0161oned\u0113\u013c kritisk\u0101 ievainojam\u012bba GitLab | ProHoster","description":"Uz\u0146\u0113mums GitLab ir public\u0113jis jaunu labojumu s\u0113riju savai platformai sadarb\u012bbas izstr\u0101d\u0113 - 15.3.2, 15.2.4 un 15.1.6, kur\u0101s nov\u0113rsta kritiska ievainojam\u012bba (CVE-2022-2992).","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/news\/vtoraya-za-nedelyu-kriticheskaya-uyazvimost-v-gitlab","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u0442\u043e\u0440\u0430\u044f \u0437\u0430 \u043d\u0435\u0434\u0435\u043b\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 GitLab | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitLab \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u0443\u044e \u0441\u0435\u0440\u0438\u044e \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0441\u0432\u043e\u0435\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 - 15.3.2, 15.2.4 \u0438 15.1.6, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-2992).","og:url":"https:\/\/prohoster.info\/lv\/blog\/news\/vtoraya-za-nedelyu-kriticheskaya-uyazvimost-v-gitlab","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-08-31T07:36:39+00:00","article:modified_time":"2022-08-31T07:36:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104974","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-08-31 07:37:51","updated":"2022-09-27 14:58:25","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/104974","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=104974"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/104974\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=104974"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=104974"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=104974"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}