{"id":99606,"date":"2021-03-29T22:22:34","date_gmt":"2021-03-29T20:22:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-git-repozitorii-proekta-php-vyyavleny-vredonosnye-izmeneniya"},"modified":"2021-03-29T22:22:34","modified_gmt":"2021-03-29T20:22:34","slug":"v-git-repozitorii-proekta-php-vyyavleny-vredonosnye-izmeneniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/v-git-repozitorii-proekta-php-vyyavleny-vredonosnye-izmeneniya","title":{"rendered":"V Git repozit\u00e1ri projektu PHP boli zisten\u00e9 \u0161kodliv\u00e9 zmeny.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdvoj\u00e1ri projektu PHP upozornili na kompromit\u00e1ciu Git repozit\u00e1ra projektu a zistenie dvoch \u0161kodliv\u00fdch commitov, pridan\u00fdch 28. marca do repozit\u00e1ra php-src menom Rasmusa Lerdorfa, zakladate\u013ea PHP, a Nikitu Popova, jedn\u00e9ho z k\u013e\u00fa\u010dov\u00fdch v\u00fdvoj\u00e1rov PHP. <\/p>\n

Ke\u010f\u017ee niet istoty v spo\u013eahlivosti servera, na ktorom bol umiestnen\u00fd Git repozit\u00e1r, v\u00fdvoj\u00e1ri sa rozhodli, \u017ee udr\u017eiavanie Git infra\u0161trukt\u00fary z vlastn\u00fdch s\u00edl predstavuje dodato\u010dn\u00e9 bezpe\u010dnostn\u00e9 rizik\u00e1 a presunuli referen\u010dn\u00fd repozit\u00e1r na platformu GitHub, ktor\u00fa je odpor\u00fa\u010dan\u00e9 pou\u017e\u00edva\u0165 ako prim\u00e1rnu. V\u0161etky zmeny by sa odteraz mali posiela\u0165 na GitHub, nie na git.php.net, vr\u00e1tane toho, \u017ee pri v\u00fdvoji je teraz mo\u017en\u00e9 vyu\u017e\u00edva\u0165 webov\u00e9 rozhranie GitHub. <\/p>\n

V prvom \u0161kodlivom commite pod z\u00e1mienkou opravy preklepu v s\u00fabore ext\/zlib\/zlib.c bola vykonan\u00e1 zmena, ktor\u00e1 sp\u00fa\u0161\u0165a PHP k\u00f3d zaslan\u00fd v HTTP hlavi\u010dke User Agent, ak je obsah za\u010d\u00ednaj\u00faci slovom \u201ezerodium\u201c. Po tom, ako si v\u00fdvoj\u00e1ri v\u0161imli \u0161kodliv\u00fa zmenu a zru\u0161ili ju, v repozit\u00e1ri sa objavil druh\u00fd commit, ktor\u00fd zru\u0161il akciu v\u00fdvoj\u00e1rov PHP a vr\u00e1til \u0161kodliv\u00fa zmenu. <\/p>\n

V pridanom k\u00f3de sa nach\u00e1dza riadok \u201eREMOVETHIS: sold to zerodium, mid 2017\u201c, ktor\u00fd m\u00f4\u017ee nazna\u010dova\u0165, \u017ee od roku 2017 sa v k\u00f3de nach\u00e1dza in\u00e1, kvalitne zakamuflovan\u00e1, \u0161kodliv\u00e1 zmena, alebo neopravite\u013en\u00e1 zranite\u013enos\u0165, predan\u00e1 spolo\u010dnosti Zerodium, ktor\u00e1 sa zaober\u00e1 n\u00e1kupom 0-day zranite\u013enost\u00ed (spolo\u010dnos\u0165 Zerodium odpovedala, \u017ee nez\u00edskala inform\u00e1cie o zranite\u013enosti v PHP). <\/p>\n

V s\u00fa\u010dasnosti zatia\u013e nie s\u00fa podrobn\u00e9 inform\u00e1cie o incidente, predpoklad\u00e1 sa len, \u017ee zmeny boli pridan\u00e9 v d\u00f4sledku hackersk\u00e9ho \u00fatoku na git.php.net, a nie kompromit\u00e1cie jednotliv\u00fdch \u00fa\u010dtov v\u00fdvoj\u00e1rov. Za\u010dala sa anal\u00fdza repozit\u00e1ra na pr\u00edtomnos\u0165 \u010fal\u0161\u00edch \u0161kodliv\u00fdch zmien okrem zisten\u00fdch probl\u00e9mov. Na recenzovanie s\u00fa pozvan\u00ed v\u0161etci z\u00e1ujemcovia, pri zisten\u00ed podozriv\u00fdch zmien je potrebn\u00e9 zasla\u0165 inform\u00e1cie na security@php.net. servera<\/a> git.php.net, a nie kompromit\u00e1cie jednotliv\u00fdch \u00fa\u010dtov v\u00fdvoj\u00e1rov. Za\u010dala sa anal\u00fdza repozit\u00e1ra na pr\u00edtomnos\u0165 \u010fal\u0161\u00edch \u0161kodliv\u00fdch zmien okrem zisten\u00fdch probl\u00e9mov. Na recenzovanie s\u00fa pozvan\u00ed v\u0161etci z\u00e1ujemcovia, pri zisten\u00ed podozriv\u00fdch zmien je potrebn\u00e9 zasla\u0165 inform\u00e1cie na security@php.net. <\/p>\n

Pokia\u013e ide o prechod na GitHub, na z\u00edskanie pr\u00edstupu na z\u00e1pis do nov\u00e9ho repozit\u00e1ra musia \u00fa\u010dastn\u00edci v\u00fdvoja patri\u0165 do organiz\u00e1cie PHP. T\u00ed, ktor\u00ed nie s\u00fa zapojen\u00ed do t\u00edmu v\u00fdvoj\u00e1rov PHP na GitHub, by sa mali kontaktova\u0165 s Nikitom Popovom na email nikic@php.net. Pre pridanie je povinn\u00e1 dvojfaktorov\u00e1 autentifik\u00e1cia. Po z\u00edskan\u00ed potrebn\u00fdch pr\u00e1v je na zmenu repozit\u00e1ra sta\u010d\u00ed vykona\u0165 pr\u00edkaz \u201egit remote set-url origin git@github.com:php\/php-src.git\u201c. Taktie\u017e sa zva\u017euje zavedenie povinn\u00e9ho overovania commitov digit\u00e1lnym podpisom v\u00fdvoj\u00e1ra. Okrem toho sa navrhuje zak\u00e1za\u0165 priame prid\u00e1vanie zmien, ktor\u00e9 nepre\u0161li predbe\u017en\u00fdm presk\u00faman\u00edm.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0434\u0432\u0443\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 28 \u043c\u0430\u0440\u0442\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 php-src \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0420\u0430\u0441\u043c\u0443\u0441\u0430 \u041b\u0435\u0440\u0434\u043e\u0440\u0444\u0430, \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044f PHP, \u0438 \u041d\u0438\u043a\u0438\u0442\u044b \u041f\u043e\u043f\u043e\u0432\u0430, \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043a\u043b\u044e\u0447\u0435\u0432\u044b\u0445 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 PHP. \u0422\u0430\u043a \u043a\u0430\u043a \u043d\u0435\u0442 \u0443\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0432 \u043d\u0430\u0434\u0451\u0436\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0431\u044b\u043b \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0440\u0435\u0448\u0438\u043b\u0438, \u0447\u0442\u043e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0441\u0432\u043e\u0438\u043c\u0438 \u0441\u0438\u043b\u0430\u043c\u0438 Git-\u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0441\u043e\u0437\u0434\u0430\u0451\u0442 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0440\u0438\u0441\u043a\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99606","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47V Git-repozit\u00e1ri projektu PHP boli zisten\u00e9 \u0161kodliv\u00e9 zmeny | ProHoster","description":"V\u00fdvoj\u00e1ri projektu PHP varovali pred kompromitovan\u00edm Git-repozit\u00e1ra projektu a zaobstarali si dva \u0161kodliv\u00e9 commity, ktor\u00e9 boli pridan\u00e9 28. marca do repozit\u00e1ra php-src menom Rasmusa Lerdorfa, zakladate\u013ea PHP, a Nikitu.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/v-git-repozitorii-proekta-php-vyyavleny-vredonosnye-izmeneniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0434\u0432\u0443\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 28 \u043c\u0430\u0440\u0442\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 php-src \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0420\u0430\u0441\u043c\u0443\u0441\u0430 \u041b\u0435\u0440\u0434\u043e\u0440\u0444\u0430, \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044f PHP, \u0438 \u041d\u0438\u043a\u0438\u0442\u044b.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/v-git-repozitorii-proekta-php-vyyavleny-vredonosnye-izmeneniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-03-29T20:22:34+00:00","article:modified_time":"2021-03-29T20:22:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99606","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-29 20:30:58","updated":"2026-02-22 15:29:48","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/99606","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=99606"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/99606\/revisions"}],"predecessor-version":[{"id":162210,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/99606\/revisions\/162210"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=99606"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=99606"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=99606"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}