V slu\u017ebe kontinu\u00e1lnej integr\u00e1cie Travis CI, ur\u010den\u00e9 na testovanie a zostavovanie projektov vyv\u00edjan\u00fdch na GitHub a Bitbucket, bola zisten\u00e1 bezpe\u010dnostn\u00e1 chyba (CVE-2021-41077), ktor\u00e1 umo\u017e\u0148uje z\u00edska\u0165 obsah d\u00f4vern\u00fdch premenn\u00fdch prostredia verejn\u00fdch repozit\u00e1rov pou\u017e\u00edvaj\u00facich Travis CI. Medzi in\u00fdm, zranite\u013enos\u0165 umo\u017e\u0148uje z\u00edska\u0165 k\u013e\u00fa\u010de pou\u017e\u00edvan\u00e9 v Travis CI na vytv\u00e1ranie digit\u00e1lnych podpisov, pr\u00edstupov\u00e9 k\u013e\u00fa\u010de a tokeny na volanie API. <\/p>\n
Probl\u00e9m pretrv\u00e1val v Travis CI od 3. do 10. septembra. Zauj\u00edmav\u00e9 je, \u017ee inform\u00e1cie o zranite\u013enosti boli odovzdan\u00e9 v\u00fdvoj\u00e1rom 7. septembra, ale namiesto toho pri\u0161la len odpove\u010f s odpor\u00fa\u010dan\u00edm na rot\u00e1ciu k\u013e\u00fa\u010dov. Nedost\u00e1vaj\u00fac adekv\u00e1tnu sp\u00e4tn\u00fa v\u00e4zbu, v\u00fdskumn\u00edci kontaktovali GitHub a navrhli zaradenie Travisu na \u010diernu listinu. Probl\u00e9m bol odstr\u00e1nen\u00fd a\u017e 10. septembra po mno\u017estve s\u0165a\u017enost\u00ed od r\u00f4znych projektov. Po incidente bola na str\u00e1nke spolo\u010dnosti Travis CI zverejnen\u00e1 viac ne\u017e podivn\u00e1 spr\u00e1va o probl\u00e9me, v ktorej namiesto informovania o oprave zranite\u013enosti, bola uveden\u00e1 len odpor\u00fa\u010dan\u00e1 cyklick\u00e1 zmena pr\u00edstupov\u00fdch k\u013e\u00fa\u010dov bez kontextu. <\/p>\n
Po vzru\u0161en\u00ed sp\u00f4sobenom utajovan\u00edm inform\u00e1ci\u00ed, ktor\u00e9 vyjadrili niektor\u00e9 ve\u013ek\u00e9 projekty, bol na podpore f\u00f3ra Travis CI zverejnen\u00fd podrobnej\u0161\u00ed spravodaj, v ktorom sa varovalo, \u017ee vlastn\u00edk forku ak\u00e9hoko\u013evek verejn\u00e9ho repozit\u00e1ra mohol zaslan\u00edm pull-requestu iniciova\u0165 proces zostavovania a z\u00edska\u0165 neopr\u00e1vnen\u00fd pr\u00edstup k d\u00f4vern\u00fdm premenn\u00fdm prostredia p\u00f4vodn\u00e9ho repozit\u00e1ra, ktor\u00e9 s\u00fa vystaven\u00e9 po\u010das zostavovania na z\u00e1klade pol\u00ed s\u00faboru .travis.yml<\/span> alebo definovan\u00fdch prostredn\u00edctvom webov\u00e9ho rozhrania Travis CI. Tak\u00e9to premenn\u00e9 s\u00fa ulo\u017een\u00e9 v za\u0161ifrovanej forme a de\u0161ifruj\u00fa sa len po\u010das zostavovania. Probl\u00e9m sa t\u00fdkal iba verejne pr\u00edstupn\u00fdch repozit\u00e1rov, ktor\u00e9 maj\u00fa forky (s\u00fakromn\u00e9 repozit\u00e1re nie s\u00fa zranite\u013en\u00e9). \u0412 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 \u043d\u0435\u043f\u0440\u0435\u0440\u044b\u0432\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 Travis CI, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u043c \u0434\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0440\u0430\u0437\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u043c\u044b\u0445 \u043d\u0430 GitHub \u0438 Bitbucket, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e (CVE-2021-41077), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0437\u043d\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 Travis CI. \u0412 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0437\u043d\u0430\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0435 \u0432 Travis CI \u043a\u043b\u044e\u0447\u0438 \u0434\u043b\u044f \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439, \u043a\u043b\u044e\u0447\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u0442\u043e\u043a\u0435\u043d\u044b \u0434\u043b\u044f \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101282","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranite\u013enos\u0165 v Travis CI ved\u00faca k \u00faniku k\u013e\u00fa\u010dov verejn\u00fdch repozit\u00e1rov | ProHoster","description":"V slu\u017ebe kontinu\u00e1lnej integr\u00e1cie Travis CI, ur\u010den\u00e9 na testovanie a zostavovanie projektov vyv\u00edjan\u00fdch na GitHub a Bitbucket, bola zisten\u00e1 bezpe\u010dnostn\u00e1 chyba (CVE-2021-41077), ktor\u00e1 umo\u017e\u0148uje z\u00edska\u0165 obsah.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-travis-ci-privodyashhaya-k-utechke-klyuchej-publichnyh-repozitoriev","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Travis CI, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u043a\u043b\u044e\u0447\u0435\u0439 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 | ProHoster","og:description":"\u0412 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 \u043d\u0435\u043f\u0440\u0435\u0440\u044b\u0432\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 Travis CI, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u043c \u0434\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0440\u0430\u0437\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u043c\u044b\u0445 \u043d\u0430 GitHub \u0438 Bitbucket, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e (CVE-2021-41077), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0437\u043d\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-travis-ci-privodyashhaya-k-utechke-klyuchej-publichnyh-repozitoriev","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-17T02:22:36+00:00","article:modified_time":"2021-09-17T02:22:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101282","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-17 02:23:32","updated":"2022-09-29 06:14:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/101282","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=101282"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/101282\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=101282"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=101282"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=101282"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"