{"id":99606,"date":"2021-03-29T22:22:34","date_gmt":"2021-03-29T20:22:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-git-repozitorii-proekta-php-vyyavleny-vredonosnye-izmeneniya"},"modified":"2021-03-29T22:22:34","modified_gmt":"2021-03-29T20:22:34","slug":"v-git-repozitorii-proekta-php-vyyavleny-vredonosnye-izmeneniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/v-git-repozitorii-proekta-php-vyyavleny-vredonosnye-izmeneniya","title":{"rendered":"Modific\u0103ri d\u0103un\u0103toare au fost detectate \u00een depozitul Git al proiectului PHP.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Dezvoltatorii proiectului PHP au avertizat cu privire la compromiterea depozitului Git al proiectului \u0219i la descoperirea a dou\u0103 commit-uri mali\u021bioase ad\u0103ugate pe 28 martie \u00een depozitul php-src, \u00een numele lui Rasmus Lerdorf, fondatorul PHP, \u0219i al lui Nikita Popov, unul dintre dezvoltatorii cheie ai PHP. <\/p>\n

Deoarece nu exist\u0103 certitudinea privind fiabilitatea serverului pe care a fost g\u0103zduit depozitul Git, dezvoltatorii au decis c\u0103 men\u021binerea infrastructurii Git de c\u0103tre ei ar crea riscuri de securitate suplimentare \u0219i au mutat depozitul de referin\u021b\u0103 pe platforma GitHub, care este propus\u0103 ca fiind prima. Toate modific\u0103rile trebuie acum trimise pe GitHub, \u0219i nu pe git.php.net, inclusiv dezvoltarea, unde poate fi folosit acum interfa\u021ba web GitHub. <\/p>\n

\u00cen primul commit mali\u021bios, sub pretextul unei corecturi de tipar \u00een fi\u0219ierul ext\/zlib\/zlib.c, a fost f\u0103cut\u0103 o modificare care execut\u0103 cod PHP furnizat \u00een antetul HTTP User Agent, dac\u0103 con\u021binutul \u00eencepe cu cuv\u00e2ntul \u201ezerodium\u201d. Dup\u0103 ce dezvoltatorii au observat modificarea mali\u021bioas\u0103 \u0219i au anulat-o, \u00een repository a ap\u0103rut un al doilea commit care a r\u0103sturnat ac\u021biunea dezvoltatorilor PHP \u0219i a restituit modificarea mali\u021bioas\u0103. <\/p>\n

\u00cen codul ad\u0103ugat se reg\u0103se\u0219te linia \u201eREMOVETHIS: sold to zerodium, mid 2017\u201d, care ar putea sugera c\u0103 din 2017 \u00een cod se afl\u0103 o alt\u0103 modificare mali\u021bioas\u0103 mascat\u0103, sau o vulnerabilitate nerezolvat\u0103, v\u00e2ndut\u0103 companiei Zerodium, care cump\u0103r\u0103 vulnerabilit\u0103\u021bi de tip 0-day (compania Zerodium a r\u0103spuns c\u0103 nu a cump\u0103rat informa\u021bii despre vulnerabilitatea din PHP). <\/p>\n

\u00cen prezent, nu exist\u0103 informa\u021bii detaliate despre incident, se presupune doar c\u0103 modific\u0103rile au fost ad\u0103ugate \u00een urma unei bre\u0219e de securitate \u00een git.php.net \u0219i nu din compromiterea unor conturi individuale de dezvoltatori. A \u00eenceput analiza depozitului pentru a c\u0103uta alte modific\u0103ri mali\u021bioase \u00een afar\u0103 de problemele identificate. To\u021bi cei interesa\u021bi sunt invita\u021bi s\u0103 participe la revizuire, iar dac\u0103 descoperi\u021bi modific\u0103ri suspecte, ar trebui s\u0103 trimite\u021bi informa\u021biile la security@php.net. server<\/a> \u00cen prezent, nu exist\u0103 informa\u021bii detaliate despre incident, se presupune doar c\u0103 modific\u0103rile au fost ad\u0103ugate \u00een urma unei bre\u0219e de securitate \u00een git.php.net \u0219i nu din compromiterea unor conturi individuale de dezvoltatori. A \u00eenceput analiza depozitului pentru a c\u0103uta alte modific\u0103ri mali\u021bioase \u00een afar\u0103 de problemele identificate. To\u021bi cei interesa\u021bi sunt invita\u021bi s\u0103 participe la revizuire, iar dac\u0103 descoperi\u021bi modific\u0103ri suspecte, ar trebui s\u0103 trimite\u021bi informa\u021biile la security@php.net. <\/p>\n

\u00cen ceea ce prive\u0219te tranzi\u021bia c\u0103tre GitHub, pentru a ob\u021bine acces de scriere la noul repository, participan\u021bii la dezvoltare trebuie s\u0103 fac\u0103 parte din organiza\u021bia PHP. Cei care nu sunt inclu\u0219i printre dezvoltatorii PHP pe GitHub ar trebui s\u0103 contacteze pe Nikita Popov la email nikic@php.net. Printre cerin\u021bele obligatorii se num\u0103r\u0103 activarea autentific\u0103rii cu doi factori. Dup\u0103 ob\u021binerea drepturilor corespunz\u0103toare, pentru a schimba repository-ul este suficient s\u0103 executa\u021bi comanda \u201egit remote set-url origin git@github.com:php\/php-src.git\u201d. De asemenea, se discut\u0103 despre trecerea la semnarea digital\u0103 a commit-urilor de c\u0103tre dezvoltatori. Se propune, de asemenea, interzicerea ad\u0103ug\u0103rii directe de modific\u0103ri care nu au fost revizuite anterior.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0434\u0432\u0443\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 28 \u043c\u0430\u0440\u0442\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 php-src \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0420\u0430\u0441\u043c\u0443\u0441\u0430 \u041b\u0435\u0440\u0434\u043e\u0440\u0444\u0430, \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044f PHP, \u0438 \u041d\u0438\u043a\u0438\u0442\u044b \u041f\u043e\u043f\u043e\u0432\u0430, \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043a\u043b\u044e\u0447\u0435\u0432\u044b\u0445 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 PHP. \u0422\u0430\u043a \u043a\u0430\u043a \u043d\u0435\u0442 \u0443\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0432 \u043d\u0430\u0434\u0451\u0436\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0431\u044b\u043b \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0440\u0435\u0448\u0438\u043b\u0438, \u0447\u0442\u043e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0441\u0432\u043e\u0438\u043c\u0438 \u0441\u0438\u043b\u0430\u043c\u0438 Git-\u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0441\u043e\u0437\u0434\u0430\u0451\u0442 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0440\u0438\u0441\u043a\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99606","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Modific\u0103ri mali\u021bioase identificate \u00een repository-ul Git al proiectului PHP | ProHoster","description":"Dezvoltatorii proiectului PHP au avertizat cu privire la compromiterea repository-ului Git al proiectului \u0219i la descoperirea a dou\u0103 commit-uri mali\u021bioase, ad\u0103ugate pe 28 martie \u00een repository-ul php-src \u00een numele lui Rasmus Lerdorf, fondatorul PHP, \u0219i al lui Nikita.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-git-repozitorii-proekta-php-vyyavleny-vredonosnye-izmeneniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0434\u0432\u0443\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 28 \u043c\u0430\u0440\u0442\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 php-src \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0420\u0430\u0441\u043c\u0443\u0441\u0430 \u041b\u0435\u0440\u0434\u043e\u0440\u0444\u0430, \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044f PHP, \u0438 \u041d\u0438\u043a\u0438\u0442\u044b.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-git-repozitorii-proekta-php-vyyavleny-vredonosnye-izmeneniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-03-29T20:22:34+00:00","article:modified_time":"2021-03-29T20:22:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99606","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-29 20:30:58","updated":"2026-02-22 15:29:48","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/99606","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=99606"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/99606\/revisions"}],"predecessor-version":[{"id":162210,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/99606\/revisions\/162210"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=99606"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=99606"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=99606"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}