Kusintha kwa code yoyipa mu phukusi la Ruby Strong_password kwapezeka

Π’ lofalitsidwa June 25 kutulutsidwa kwa phukusi lamtengo wapatali Strong_password 0.7 kuwululidwa kusintha koyipa (CVE-2019-13354), kutsitsa ndikuchita ma code akunja omwe amayendetsedwa ndi wowukira wosadziwika, yemwe amakhala pa Pastebin service. Chiwerengero chonse cha kutsitsa kwa polojekitiyi ndi 247 zikwi, ndipo mtundu wa 0.6 uli pafupi 38 zikwi. Kwa mtundu woyipa, kuchuluka kwa zotsitsa kumalembedwa ngati 537, koma sizikuwonekeratu kuti izi ndi zolondola bwanji, popeza kutulutsidwaku kwachotsedwa kale ku Ruby Gems.

Laibulale ya Strong_password imapereka zida zowunikira mphamvu ya mawu achinsinsi omwe amatchulidwa ndi wogwiritsa ntchito panthawi yolembetsa.
pakati kugwiritsa ntchito phukusi la Strong_password think_feel_do_engine (zotsitsa 65), think_feel_do_dashboard (zotsitsa 15) ndi
superhosting (1.5 zikwi). Zimadziwika kuti kusintha koyipa kudawonjezedwa ndi munthu wosadziwika yemwe adalanda malo osungira kuchokera kwa wolemba.

Khodi yoyipa idawonjezedwa ku RubyGems.org, Git repository ntchitoyo sinakhudzidwe. Vutoli lidadziwika pambuyo poti m'modzi mwa omanga, omwe amagwiritsa ntchito Strong_password m'mapulojekiti ake, adayamba kudziwa chifukwa chake kusintha komaliza kudawonjezedwa ku malo osungiramo miyezi 6 yapitayo, koma kumasulidwa kwatsopano kunawonekera pa RubyGems, yosindikizidwa m'malo mwa watsopano. wosamalira, yemwe palibe amene adamumva kale sindinamve kalikonse.

Wowukirayo atha kuyika ma code pa seva pogwiritsa ntchito mtundu wamavuto wa Strong_password. Vuto la Pastebin litapezeka, script idakwezedwa kuti igwiritse ntchito khodi iliyonse yomwe kasitomala amadutsa kudzera pa Cookie "__id" ndikusungidwa pogwiritsa ntchito njira ya Base64. Khodi yoyipa idatumizanso magawo a wolandila pomwe zosintha zoyipa za Strong_password zidayikidwa ku seva yoyendetsedwa ndi wowukirayo.

Kusintha kwa code yoyipa mu phukusi la Ruby Strong_password kwapezeka

Kusintha kwa code yoyipa mu phukusi la Ruby Strong_password kwapezeka

Source: opennet.ru

Kuwonjezera ndemanga