{"id":122827,"date":"2025-03-25T04:22:52","date_gmt":"2025-03-25T02:22:52","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse"},"modified":"2025-03-25T04:22:52","modified_gmt":"2025-03-25T02:22:52","slug":"uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse","title":{"rendered":"Vulnerabilit\u0103\u021bi \u00een Pagure \u0219i OBS care puteau compromite pachetele din repozitoarele Fedora \u0219i openSUSE","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Cercet\u0103torii de securitate de la compania Fenrisk au dezv\u0103luit informa\u021bii despre vulnerabilit\u0103\u021bile din instrumentele Pagure \u0219i OBS (Open Build Service), care permiteau compromiterea infrastructurilor de generare a pachetelor pentru distribu\u021biile Fedora \u0219i openSUSE. Cercet\u0103torii au demonstrat posibilitatea efectu\u0103rii unui atac pentru executarea de cod arbitrar pe serverele cu Pagure \u0219i OBS, ceea ce putea fi folosit pentru a introduce modific\u0103ri \u00een pachete \u00een repozitoarele Fedora \u0219i openSUSE.     <\/p>\n<p>\u00cen platforma Pagure, utilizat\u0103 \u00een Fedora pentru colaborarea cu codul \u0219i metadatele pachetelor, au fost identificate 4 vulnerabilit\u0103\u021bi. Pentru a exploata problemele identificate, este necesar\u0103 o cont \u00een serviciul Pagure, pe care o poate ob\u021bine oricine (\u00een prezent, \u00een Pagure.io sunt \u00eenregistra\u021bi 24.899 de utilizatori). Trei dintre probleme permit citirea fi\u0219ierelor din sistem, iar una dintre probleme permite executarea unui cod propriu pe <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/ro\/server\/dts-newyork\/\"   title=\"server\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2806\">server<\/a>. Problemele au fost identificate pe 1 ianuarie 2024, raportate prin bugzilla.redhat.com pe 25 aprilie 2024 \u0219i remediate \u00een Pagure \u00een termen de 3 ore.    <\/p>\n<ul>\n<li class=\"l\"> Vulnerabilit\u0103\u021bile CVE-2024-4981 \u0219i CVE-2024-47515 sunt cauzate de o gestionare incorect\u0103 a leg\u0103turilor simbolice \u00een func\u021biile de actualizare a fi\u0219ierului \u0219i generare a arhivelor. Aceste vulnerabilit\u0103\u021bi permit citirea con\u021binutului fi\u0219ierelor locale pe server, de exemplu, se pot ob\u021bine informa\u021bii despre fi\u0219ierul cu parametrii sesiunii administratorului Pagure \u0219i acces la drepturile acestuia. Exploatarea vulnerabilit\u0103\u021bii \u00een func\u021bia _update_file_in_git() const\u0103 \u00een crearea unui repozitoriu \u00een Pagure; ad\u0103ugarea unui commit cu un fi\u0219ier nou, care este creat ca o leg\u0103tur\u0103 simbolic\u0103 la fi\u0219ierul sistemului dorit; deschiderea acestui fi\u0219ier pentru editare \u00een interfa\u021ba web.\n<li class=\"l\"> Vulnerabilitatea (CVE-2024-4982) \u00een func\u021bia view_issue_raw_file() permite ie\u0219irea din directorul de baz\u0103 prin indicarea caracterelor \u00ab\/..\u00bb \u00een parametrii problemei solicitate. Problema permite citirea fi\u0219ierelor din sistem, \u00een func\u021bie de drepturile de acces ale procesului sub care ruleaz\u0103 interfa\u021ba web. De exemplu, pentru a vizualiza fi\u0219ierul \/etc\/passwd se poate deschide pagina \u00abhttp:\/\/pagure.local:5000\/your-repository\/issue\/raw\/..\/..\/..\/..\/..\/..\/etc\/passwd\u00bb.\n<li class=\"l\"> Vulnerabilitatea (CVE-2024-47516) \u00een func\u021bia PagureRepo.log() permite substituirea comenzilor proprii \u0219i executarea codului pe server. Problema este cauzat\u0103 de faptul c\u0103, \u00een timpul vizualiz\u0103rii istoricului modific\u0103rilor de fi\u0219ier prin interfa\u021ba web, se invoc\u0103 comanda \u00abgit\u00bb cu transmiterea identificatorului ramurii \u00een linia de comand\u0103 (de exemplu, \u00ab\/usr\/bin\/git --pretty=oneline --abbrev-commit  -- README.md\u00bb). Corectitudinea identificatorului nu este verificat\u0103, astfel \u00eenc\u00e2t se poate transmite orice op\u021biune de linie de comand\u0103, de exemplu, \u00ab--output=\/tmp\/foo.bar\u00bb pentru a redirec\u021biona ie\u0219irea c\u0103tre un fi\u0219ier. Atacatorul poate suprascrie un fi\u0219ier \u00een sistem prin trimiterea unei cereri de urm\u0103torul tip: http:\/\/pagure.local:5000\/test\/history\/README.md?identifier=--output=\/tmp\/foo.bar\n<p>Pagure ruleaz\u0103 sub utilizatorul git, a\u0219a c\u0103 se pot suprascrie doar fi\u0219ierele acestui utilizator. Pentru a executa codul pe server, se poate folosi un serviciu de accesare a repository-ului prin SSH, la care, atunci c\u00e2nd se face apel, se execut\u0103 comanda \u00abbash -c \/usr\/libexec\/pagure\/aclchecker.py\u00bb. Atacatorul poate folosi vulnerabilitatea pentru a suprascrie fi\u0219ierul \u00ab\/srv\/git\/.bashrc\u00bb, iar acest fi\u0219ier va fi executat de interpretul de comenzi bash la accesarea repository-ului prin SSH.      <\/p>\n<p>Atacul const\u0103 \u00een \u00eenregistrarea \u00een sistemul Pagure, crearea unui repository, ad\u0103ugarea \u00een repository a fi\u0219ierului README.md cu o not\u0103 la commit de tipul \u00ab|| \/bin\/bash\u00bb \u0219i trimiterea unei cereri \u00abhttp:\/\/pagure.local:5000\/test\/history\/README.md?identifier=--output=\/srv\/git\/.bashrc\u00bb. Pe parcursul acestor pa\u0219i, \u00een fi\u0219ierul \u00ab\/srv\/git\/.bashrc\u00bb va fi scris\u0103 o linie de forma \u00ab34\u04305\u044143 || \/bin\/bash\u00bb. Pentru a executa fi\u0219ierul creat \u00ab\/srv\/git\/.bashrc\u00bb este suficient s\u0103 te conectezi la repository prin SSH cu contul t\u0103u. Executarea codului cu drepturile utilizatorului git pe serverul Pagure permite controlul asupra \u00eentregului con\u021binut al repository-urilor cu pachete.    <\/ul>\n<p>    <center><iframe title=\"Pagure\" src=\"https:\/\/player.vimeo.com\/video\/1066145210?h=0716980f9b\" width=\"640\" height=\"360\" frameborder=\"0\" allowfullscreen style =\"max-width: 100%;\" loading=\"lazy\"><\/iframe><\/center>        <\/p>\n<p>\u00cen platforma OBS (Open Build Service), utilizat\u0103 \u00een openSUSE \u0219i \u00een alte distribu\u021bii pentru construirea pachetelor, a fost descoperit\u0103 o vulnerabilitate (CVE-2024-22033) care permite executarea codului propriu pe server. Vulnerabilitatea a fost identificat\u0103 pe 27 iunie 2024, raportat\u0103 proiectului openSUSE pe 29 iunie \u0219i remediate pe 10 iulie.    <\/p>\n<p>Vulnerabilitatea este prezent\u0103 \u00een serviciul &#171;obs-service-download_url&#187;, unde lipsa unei corecte verific\u0103ri a URL-ului utilizat la rularea utilitarului wget din scriptul care descarc\u0103 codul surs\u0103 \u00een OBS. Un atacator poate specifica \u00een serviciul OBS configura\u021bia pachetului generat, \u00een care \u00een loc de URL-ul pentru desc\u0103rcarea codului va fi specificat\u0103 op\u021biunea din linia de comand\u0103 pentru wget, de exemplu: &lt;services&gt; &lt;service name=&#187;download_url&#187;&gt; &lt;param name=&#187;url&#187;&gt;&#8212;output-document=\\\/tmp\\\/test&lt;\\\/param&gt; &lt;param name=&#187;download-manifest&#187;&gt;tempfile&lt;\\\/param&gt; &lt;\\\/service&gt; &lt;\\\/services&gt;      <\/p>\n<p> Pentru a ocoli returnarea erorii la \u00eencercarea de a rula wget f\u0103r\u0103 URL, \u00een exemplu a fost specificat\u0103 op\u021biunea &#171;download-manifest&#187;, care permite specificarea unei liste de URL-uri \u00eentr-un fi\u0219ier separat. Exemplul men\u021bionat va duce la rularea comenzii: \\\/usr\\\/bin\\\/wget -i \\\/srv\\\/obs\\\/service\\\/XXXXX\\\/src\\\/tempfile -4 &#8212;output-document=\\\/tmp\\\/test    <\/p>\n<p>care permite salvarea \u00een fi\u0219ierul \\\/tmp\\\/test a con\u021binutului desc\u0103rcat de la linkul specificat \u00een fi\u0219ierul \\\/srv\\\/obs\\\/service\\\/XXXXX\\\/src\\\/tempfile din codul \u00eenc\u0103rcat de atacator \u00een OBS prin intermediul interfe\u021bei build.opensuse.org, care permite \u00eenregistrarea liber\u0103. \u00cen plus fa\u021b\u0103 de suprascrierea fi\u0219ierului pe server, atacatorul poate trimite orice fi\u0219ier pentru sine, specific\u00e2nd \u00een loc de &#171;&#8212;output-document&#187; op\u021biunea &#171;&#8212;post-file&#187;, de exemplu, &#171;&#8212;post-file=\\\/etc\\\/passwd&#187;. Astfel, atacatorul poate citi \u0219i scrie fi\u0219iere pe server, \u00een limita permisiunilor sub care ruleaz\u0103 serviciul OBS.    <\/p>\n<p>Pentru a transforma posibilitatea de scriere \u00eentr-un fi\u0219ier \u00een executarea de cod pe server, cercet\u0103torii au propus o metod\u0103 care const\u0103 \u00een dou\u0103 etape. Cele dou\u0103 etape sunt necesare, astfel \u00eenc\u00e2t atacatorul s\u0103 poat\u0103 crea un fi\u0219ier &#171;.wgetrc&#187; cu set\u0103rile pentru wget, dar aceasta nu este suficient\u0103 pentru a rula comenzi. Totu\u0219i, prin intermediul &#171;.wgetrc&#187; pot fi create condi\u021bii pentru a executa \u00een sistem orice program, dar f\u0103r\u0103 a-i transmite argumente. Pentru a rula cod arbitrar, a fost propus s\u0103 se lanseze programul &#171;prove&#187;, care proceseaz\u0103 fi\u0219ierul de configura\u021bie &#171;.proverc&#187;, permi\u021b\u00e2nd specificarea op\u021biunii &#171;&#8212;exec&#187; pentru a executa orice cod.     <\/p>\n<p>\u00cen prima etap\u0103, prin manipul\u0103rile men\u021bionate mai sus cu &#171;download-manifest&#187;, \u00een directorul de acas\u0103 al utilizatorului &#171;obsservicerun&#187; se creeaz\u0103 un fi\u0219ier &#171;.proverc&#187;, care include comenzile ce vor fi executate la pornirea procesului &#171;prove&#187;. \u00cen a doua etap\u0103, se creeaz\u0103 fi\u0219ierul &#171;.wgetrc&#187; cu parametrul &#171;use-askpass=\\\/usr\\\/bin\\\/prove&#187;, care duce la apelarea lui &#171;prove&#187;. Dup\u0103 apari\u021bia acestor fi\u0219iere, este suficient s\u0103 se creeze condi\u021biile pentru desc\u0103rcarea oric\u0103ror date folosind wget \u0219i aceasta va conduce la executarea codului atacatorului pe server cu drepturile utilizatorului &#171;obsservicerun&#187;. Drepturile utilizatorului &#171;obsservicerun&#187; sunt suficiente pentru extragerea cheilor din repositorii, utilizate de utilizatorii OBS pentru semnarea pachetelor.     <center>  <iframe title=\"Open Build Service\" src=\"https:\/\/player.vimeo.com\/video\/1066093605?h=d7a210d719\" width=\"640\" height=\"360\" frameborder=\"0\" allowfullscreen style =\"max-width: 100%;\" loading=\"lazy\"><\/iframe><\/center>    <\/p>\n<p>Complement: Echipa de Securitate a Produselor SUSE consider\u0103 c\u0103 pericolul vulnerabilit\u0103\u021bii din OBS este supraevaluat \u0219i afirma\u021bia cercet\u0103torilor c\u0103 problema permite compromiterea tuturor pachetelor din distribu\u021bia openSUSE nu este fondat\u0103. Se remarc\u0103 faptul c\u0103 serviciile din infrastructura build.opensuse.org sunt lansate folosind containere izolate, recreate \u0219i f\u0103r\u0103 informa\u021bii critice. Vulnerabilitatea descoperit\u0103 este apreciat\u0103 ca fiind periculoas\u0103, dar nu suficient\u0103 pentru a compromite infrastructura de construire openSUSE \u0219i pachetele generate. Mai mult, s-a men\u021bionat c\u0103 ac\u021biunile \u00een interfa\u021ba OBS, descrise \u00een exemplul atacului, ar fi putut fi realizate doar \u00een varianta OBS, instalat\u0103 local pe sta\u021bia de lucru a dezvoltatorului.<br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=62928\">opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Fenrisk \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 Pagure \u0438 OBS (Open Build Service), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0445 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 Fedora \u0438 openSUSE. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0441 Pagure \u0438 OBS, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 Fedora \u0438 openSUSE. [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-122827","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Fenrisk \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 Pagure \u0438 OBS (Open Build Service), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0445 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Pagure \u0438 OBS, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u0432\u0448\u0438\u0435 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 Fedora \u0438 openSUSE | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Fenrisk \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 Pagure \u0438 OBS (Open Build Service), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0445 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-03-25T02:22:52+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2025-03-25T02:22:52+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u0103\u021bi \u00een Pagure \u0219i OBS, care permiteau compromiterea pachetelor \u00een repozitoarele Fedora \u0219i openSUSE | ProHoster","description":"Cercet\u0103torii \u00een securitate de la Fenrisk au dezv\u0103luit informa\u021bii despre vulnerabilit\u0103\u021bi \u00een uneltele Pagure \u0219i OBS (Open Build Service), care permiteau compromiterea infrastructurilor de formare a pachetelor pentru distribu\u021bii.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Pagure \u0438 OBS, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u0432\u0448\u0438\u0435 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 Fedora \u0438 openSUSE | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Fenrisk \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 Pagure \u0438 OBS (Open Build Service), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0445 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-03-25T02:22:52+00:00","article:modified_time":"2025-03-25T02:22:52+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"122827","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:07:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 11:32:22","updated":"2026-02-09 22:07:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/122827","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=122827"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/122827\/revisions"}],"predecessor-version":[{"id":160086,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/122827\/revisions\/160086"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=122827"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=122827"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=122827"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}