{"id":104974,"date":"2022-08-31T09:36:39","date_gmt":"2022-08-31T07:36:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vtoraya-za-nedelyu-kriticheskaya-uyazvimost-v-gitlab"},"modified":"2022-08-31T09:36:39","modified_gmt":"2022-08-31T07:36:39","slug":"vtoraya-za-nedelyu-kriticheskaya-uyazvimost-v-gitlab","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/vtoraya-za-nedelyu-kriticheskaya-uyazvimost-v-gitlab","title":{"rendered":"A doua vulnerabilitate critic\u0103 a s\u0103pt\u0103m\u00e2nii \u00een GitLab","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Compania GitLab a publicat o nou\u0103 serie de actualiz\u0103ri corective pentru platforma sa de dezvoltare colaborativ\u0103 \u2014 15.3.2, 15.2.4 \u0219i 15.1.6, care remediaz\u0103 o vulnerabilitate critic\u0103 (CVE-2022-2992) ce permite unui utilizator autentificat s\u0103Execute cod pe server. La fel ca vulnerabilitatea CVE-2022-2884, corectat\u0103 s\u0103pt\u0103m\u00e2na trecut\u0103, noua problem\u0103 este prezent\u0103 \u00een API-ul pentru importul de date din serviciul GitHub. Vulnerabilitatea este prezent\u0103 \u0219i \u00een versiunile 15.3.1, 15.2.3 \u0219i 15.1.5, \u00een care a fost corectat\u0103 prima vulnerabilitate din codul de import din GitHub. <\/p>\n

Detalii despre exploatare nu sunt disponibile deocamdat\u0103. Informa\u021biile despre vulnerabilitate au fost transmise c\u0103tre GitLab \u00een cadrul programului HackerOne pentru recompensarea descoperirii de vulnerabilit\u0103\u021bi, dar, spre deosebire de problema anterioar\u0103, au fost identificate de un alt participant. Ca solu\u021bie temporar\u0103, administratorul este recomandat s\u0103 dezactiveze func\u021bia de import din GitHub (\u00een interfa\u021ba web GitLab: \u201eMenu\u201d -> \u201eAdmin\u201d -> \u201eSettings\u201d -> \u201eGeneral\u201d -> \u201eVisibility and access controls\u201d -> \u201eImport sources\u201d -> dezactiveaz\u0103 \u201eGitHub\u201d). <\/p>\n

\u00cen plus, \u00een actualiz\u0103rile propuse au fost corectate \u00eenc\u0103 14 vulnerabilit\u0103\u021bi, dintre care dou\u0103 sunt marcate ca fiind periculoase, zece au un nivel mediu de pericol, iar dou\u0103 sunt considerate non-periculoase. Vulnerabilit\u0103\u021bile periculoase includ: vulnerabilitatea CVE-2022-2865, care permite ad\u0103ugarea propriului cod JavaScript pe paginile afi\u0219ate altor utilizatori prin manipularea etichetelor colorate, precum \u0219i vulnerabilitatea CVE-2022-2527, care permite substituirea con\u021binutului prin c\u00e2mpul de descriere \u00een cronologia incidentelor (Incidents Timeline). Vulnerabilit\u0103\u021bile de grad mediu de pericol sunt, \u00een principal, legate de posibilitatea de a provoca un refuz de serviciu.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitLab \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u0443\u044e \u0441\u0435\u0440\u0438\u044e \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0441\u0432\u043e\u0435\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 — 15.3.2, 15.2.4 \u0438 15.1.6, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-2992), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041a\u0430\u043a \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2022-2884, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u043d\u0435\u0434\u0435\u043b\u044e \u043d\u0430\u0437\u0430\u0434, \u043d\u043e\u0432\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 API \u0434\u043b\u044f \u0438\u043c\u043f\u043e\u0440\u0442\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438\u0437 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 GitHub. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104974","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A doua vulnerabilitate critic\u0103 \u00een GitLab \u00een decurs de o s\u0103pt\u0103m\u00e2n\u0103 | ProHoster","description":"Compania GitLab a publicat o nou\u0103 serie de actualiz\u0103ri corective pentru platforma sa de colaborare \u00een dezvoltare - 15.3.2, 15.2.4 \u0219i 15.1.6, \u00een care a fost eliminat\u0103 o vulnerabilitate critic\u0103 (CVE-2022-2992).","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/vtoraya-za-nedelyu-kriticheskaya-uyazvimost-v-gitlab","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u0442\u043e\u0440\u0430\u044f \u0437\u0430 \u043d\u0435\u0434\u0435\u043b\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 GitLab | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitLab \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u0443\u044e \u0441\u0435\u0440\u0438\u044e \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0441\u0432\u043e\u0435\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 - 15.3.2, 15.2.4 \u0438 15.1.6, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-2992).","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/vtoraya-za-nedelyu-kriticheskaya-uyazvimost-v-gitlab","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-08-31T07:36:39+00:00","article:modified_time":"2022-08-31T07:36:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104974","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-08-31 07:37:51","updated":"2022-09-27 14:58:25","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/104974","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=104974"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/104974\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=104974"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=104974"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=104974"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}