{"id":112958,"date":"2024-01-17T17:28:02","date_gmt":"2024-01-17T15:28:02","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/github-obnovil-gpg-klyuchi-iz-za-uyazvimosti-privodyashhej-k-utechke-peremennyh-okruzheniya"},"modified":"2024-01-17T17:28:02","modified_gmt":"2024-01-17T15:28:02","slug":"github-obnovil-gpg-klyuchi-iz-za-uyazvimosti-privodyashhej-k-utechke-peremennyh-okruzheniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/github-obnovil-gpg-klyuchi-iz-za-uyazvimosti-privodyashhej-k-utechke-peremennyh-okruzheniya","title":{"rendered":"GitHub a actualizat cheile GPG din cauza unei vulnerabilit\u0103\u021bi care duce la scurgerea variabilelor de mediu.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitHub a dezv\u0103luit detalii despre o vulnerabilitate care permite accesul la con\u021binutul variabilelor de mediu expuse \u00een containere folosite \u00een infrastructura de lucru. Vulnerabilitatea a fost identificat\u0103 de un participant la programul Bug Bounty, care pretinde recompense pentru g\u0103sirea problemelor de securitate. Problema afecteaz\u0103 at\u00e2t serviciul GitHub.com, c\u00e2t \u0219i configura\u021biile GitHub Enterprise Server (GHES) care ruleaz\u0103 pe sistemele utilizatorilor. <\/p>\n

Analiza logurilor \u0219i auditul infrastructurii nu au identificat dovezi ale exploat\u0103rii vulnerabilit\u0103\u021bii \u00een trecut, \u00een afar\u0103 de activitatea cercet\u0103torului care a raportat problema. Cu toate acestea, \u00een infrastructur\u0103 a fost ini\u021biat\u0103 o \u00eenlocuire a tuturor cheilor de criptare \u0219i a acreditivului care ar fi putut fi poten\u021bial compromise \u00een cazul exploat\u0103rii vulnerabilit\u0103\u021bii de c\u0103tre un atacator. \u00cenlocuirea cheilor interne a dus la \u00eentreruperea func\u021bion\u0103rii unor servicii \u00eentre 27 \u0219i 29 decembrie. Administratorii GitHub au \u00eencercat s\u0103 \u021bin\u0103 cont de gre\u0219elile f\u0103cute \u00een timpul actualiz\u0103rii cheilor de ieri, care \u00eei afecteaz\u0103 pe clien\u021bi. <\/p>\n

Printre altele, a fost actualizat GPG-cheia utilizat\u0103 pentru a semna digital explica\u021biile create prin editorul web GitHub atunci c\u00e2nd sunt acceptate pull request-uri pe site sau prin instrumentul Codespace. Fosta cheie \u0219i-a \u00eencetat activitatea pe 16 ianuarie la ora 23:00, ora Moscovei, \u0219i \u00eencep\u00e2nd de ieri, se aplic\u0103 o nou\u0103 cheie. \u00cencep\u00e2nd cu 23 ianuarie, toate noile explica\u021bii semnate cu cheia anterioar\u0103 nu vor fi marcate pe site-ul GitHub ca verificate. <\/p>\n

Pe 16 ianuarie, au fost actualizate \u0219i cheile publice utilizate pentru criptarea datelor trimise de utilizatori prin API \u00een GitHub Actions, GitHub Codespaces \u0219i Dependabot. Utilizatorii care folosesc cheile publice asociate GitHub pentru a verifica local explica\u021biile \u0219i a cripta datele transmise sunt sf\u0103tui\u021bi s\u0103 se asigure c\u0103 au actualizat GPG-cheile GitHub, iar sistemele lor continu\u0103 s\u0103 func\u021bioneze dup\u0103 \u00eenlocuirea cheilor. <\/p>\n

Compania GitHub a remediat deja vulnerabilitatea pe site-ul GitHub.com \u0219i a lansat o actualizare a produsului GHES 3.8.13, 3.9.8, 3.10.5 \u0219i 3.11.3, \u00een care este men\u021bionat\u0103 corectarea CVE-2024-0200 (utilizarea nesigur\u0103 a reflexiilor, care duce la executarea codului sau a metodelor controlate de utilizator pe partea de client). server<\/a>). Atacul asupra instal\u0103rilor locale GHES ar fi putut fi efectuat dac\u0103 un atacator avea un cont cu drepturi de administrator al organiza\u021biei (organization owner).
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

GitHub \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u043c\u0443 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0439, \u0432\u044b\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\u0445, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0432 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u043e\u043c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b Bug Bounty, \u043f\u0440\u0435\u0442\u0435\u043d\u0434\u0443\u044e\u0449\u0438\u043c \u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f \u0437\u0430 \u043f\u043e\u0438\u0441\u043a \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043a\u0430\u043a \u0441\u0435\u0440\u0432\u0438\u0441 GitHub.com, \u0442\u0430\u043a \u0438 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 GitHub Enterprise Server (GHES), \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0435 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u0410\u043d\u0430\u043b\u0438\u0437 \u043b\u043e\u0433\u043e\u0432 \u0438 \u0430\u0443\u0434\u0438\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112958","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47GitHub a actualizat cheile GPG din cauza unei vulnerabilit\u0103\u021bi care duce la scurgerea variabilelor de mediu | ProHoster","description":"GitHub a dezv\u0103luit informa\u021bii despre o vulnerabilitate care permite accesul la con\u021binutul variabilelor de mediu setate \u00een containerele utilizate \u00een infrastructura de lucru.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/github-obnovil-gpg-klyuchi-iz-za-uyazvimosti-privodyashhej-k-utechke-peremennyh-okruzheniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47GitHub \u043e\u0431\u043d\u043e\u0432\u0438\u043b GPG-\u043a\u043b\u044e\u0447\u0438 \u0438\u0437-\u0437\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0435\u0439 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f | ProHoster","og:description":"GitHub \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u043c\u0443 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0439, \u0432\u044b\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\u0445, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0432 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/github-obnovil-gpg-klyuchi-iz-za-uyazvimosti-privodyashhej-k-utechke-peremennyh-okruzheniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-01-17T15:28:02+00:00","article:modified_time":"2024-01-17T15:28:02+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"112958","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-22 15:29:48","updated":"2026-02-22 15:29:48","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/112958","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=112958"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/112958\/revisions"}],"predecessor-version":[{"id":162209,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/112958\/revisions\/162209"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=112958"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=112958"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=112958"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}