{"id":105840,"date":"2022-12-05T15:36:44","date_gmt":"2022-12-05T13:36:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-vs-code-grafana-gnu-emacs-i-apache-fineract"},"modified":"2022-12-05T15:36:44","modified_gmt":"2022-12-05T13:36:44","slug":"uyazvimosti-v-vs-code-grafana-gnu-emacs-i-apache-fineract","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/news\/uyazvimosti-v-vs-code-grafana-gnu-emacs-i-apache-fineract","title":{"rendered":"Kwetsbaarheden in VS Code, Grafana, GNU Emacs en Apache Fineract","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Onlangs ontdekte kwetsbaarheden:  <\/p>\n<ul>\n<li class=\"l\"> In de Visual Studio Code (VS Code) editor is een kritieke kwetsbaarheid ontdekt (CVE-2022-41034) die het mogelijk maakt om code uit te voeren wanneer een gebruiker een link opent die door een aanvaller is voorbereid. De code kan worden uitgevoerd op de computer met VS Code, maar ook op andere computers die zijn verbonden met VS Code via de functie 'Remote Development'. Het probleem vormt de grootste bedreiging voor gebruikers van de webversie van VS Code en webeditors die daarop zijn gebaseerd, waaronder GitHub Codespaces en github.dev.\n<p>De kwetsbaarheid wordt veroorzaakt door de mogelijkheid om speciale links 'command:' te verwerken om een terminalvenster te openen en daarin willekeurige shell-opdrachten uit te voeren, bij het verwerken in de editor van speciaal opgemaakte documenten in Jupyter Notebook-formaat, opgehaald van <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/nl\/server\/\"   title=\"webserver\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"765\">webserver<\/a>, onder controle van de aanvaller (extern bestanden met de extensie '.ipynb' worden zonder aanvullende bevestigingen geopend in de 'isTrusted'-modus, die 'command:'-verwerking toestaat).    <\/p>\n<li class=\"l\"> In de teksteditor GNU Emacs is een kwetsbaarheid (CVE-2022-45939) ontdekt, die het mogelijk maakt om opdrachten uit te voeren bij het openen van een codebestand door speciale tekens in de naam te substitueren, die worden verwerkt met behulp van de ctags-tool.\n<li class=\"l\"> In het open datavisualisatieplatform Grafana is een kwetsbaarheid (CVE-2022-31097) ontdekt, die het mogelijk maakt om JavaScript-code uit te voeren bij het tonen van een melding via het Grafana Alerting-systeem. Een aanvaller met redacteursrechten (Editor) kan een speciaal opgemaakte link voorbereiden en toegang krijgen tot de Grafana-interface met beheerdersrechten als een beheerder op deze link klikt. De kwetsbaarheid is verholpen in de versies Grafana 9.2.7, 9.3.0, 9.0.3, 8.5.9, 8.4.10 en 8.3.10.\n<li class=\"l\"> Kwetsbaarheid (CVE-2022-46146) in de exporter-toolkit-bibliotheek, die wordt gebruikt voor het maken van modules voor het exporteren van metrics voor Prometheus. Het probleem maakt het mogelijk om basisauthenticatie te omzeilen.\n<li class=\"l\"> De kwetsbaarheid (CVE-2022-44635) in het platform voor het cre\u00ebren van financi\u00eble diensten, Apache Fineract, maakt het mogelijk voor een niet-geauthenticeerde gebruiker om op afstand code uit te voeren. Het probleem wordt veroorzaakt door het ontbreken van juiste escaperings van de symbolen '..' in de paden die worden verwerkt door de component voor het uploaden van bestanden. De kwetsbaarheid is verholpen in de versies Apache Fineract 1.7.1 en 1.8.1.\n<li class=\"l\"> Een kwetsbaarheid (CVE-2022-46366) in het Java-framework Apache Tapestry die het mogelijk maakt om eigen code uit te voeren bij het deserialiseren van speciaal opgemaakte gegevens. Dit probleem doet zich alleen voor in de oude tak van Apache Tapestry 3.x, die al niet meer wordt ondersteund.\n<li class=\"l\"> Kwetsbaarheden in de aanbieders Apache Airflow naar Hive (CVE-2022-41131), Pinot (CVE-2022-38649), Pig (CVE-2022-40189) en Spark (CVE-2022-40954), die leiden tot remote code execution via het uploaden van willekeurige bestanden of het invoegen van opdrachten in de context van het uitvoeren van taken, zonder schrijfrechten op DAG-bestanden.                <\/ul>\n<p>Bron: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=58264\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: \u0412 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 Visual Studio Code (VS Code) \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-41034), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0441\u0441\u044b\u043b\u043a\u0438, \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c. \u041a\u043e\u0434 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d \u043a\u0430\u043a \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435 \u0441 VS Code, \u0442\u0430\u043a \u0438 \u043d\u0430 \u043b\u044e\u0431\u044b\u0445 \u0434\u0440\u0443\u0433\u0438\u0445 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430\u0445, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u044b\u0445 \u043a VS Code \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 &#171;Remote Development&#187;. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u043d\u0430\u0438\u0431\u043e\u043b\u044c\u0448\u0443\u044e \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0434\u043b\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105840","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: \u0412 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 Visual Studio Code (VS Code) \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-41034), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/nl\/blog\/news\/uyazvimosti-v-vs-code-grafana-gnu-emacs-i-apache-fineract\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"nl_NL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 VS Code, Grafana, GNU Emacs \u0438 Apache Fineract | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: \u0412 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 Visual Studio Code (VS Code) \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-41034), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/nl\/blog\/news\/uyazvimosti-v-vs-code-grafana-gnu-emacs-i-apache-fineract\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2022-12-05T13:36:44+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-12-05T13:36:44+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kwetsbaarheden in VS Code, Grafana, GNU Emacs en Apache Fineract | ProHoster","description":"Enkele recent ontdekte kwetsbaarheden: In de editor Visual Studio Code (VS Code) is een kritieke kwetsbaarheid (CVE-2022-41034) ontdekt die het mogelijk maakt om code uit te voeren bij het openen.","canonical_url":"https:\/\/prohoster.info\/nl\/blog\/news\/uyazvimosti-v-vs-code-grafana-gnu-emacs-i-apache-fineract","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nl_NL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 VS Code, Grafana, GNU Emacs \u0438 Apache Fineract | ProHoster","og:description":"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: \u0412 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 Visual Studio Code (VS Code) \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-41034), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438.","og:url":"https:\/\/prohoster.info\/nl\/blog\/news\/uyazvimosti-v-vs-code-grafana-gnu-emacs-i-apache-fineract","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-12-05T13:36:44+00:00","article:modified_time":"2022-12-05T13:36:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"105840","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-08 20:31:51","updated":"2026-02-08 20:31:51","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/105840","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/comments?post=105840"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/105840\/revisions"}],"predecessor-version":[{"id":157956,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/105840\/revisions\/157956"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media?parent=105840"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/categories?post=105840"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/tags?post=105840"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}