{"id":109367,"date":"2023-07-12T21:10:19","date_gmt":"2023-07-12T19:10:19","guid":{"rendered":"https:\/\/prohoster.info\/?p=109367"},"modified":"2023-07-13T09:57:04","modified_gmt":"2023-07-13T07:57:04","slug":"uyazvimosti-v-redis-ghostscript-asterisk-i-parse-server","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/uyazvimosti-v-redis-ghostscript-asterisk-i-parse-server","title":{"rendered":"Varnostne luknje v Redis, Ghostscript, Asterisk in Parse Server","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Nekaj nedavno odkritih nevarnih ranljivosti:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2022-24834 \u2014 ranljivost v podatkovni bazi Redis, ki omogo\u010da povzro\u010ditev prelivanja pomnilnika v knji\u017enicah cjson in cmsgpack pri izvajanju posebno oblikovanih skript v jeziku Lua. Potencialno lahko ta ranljivost privede do oddaljenega izvajanja kode na <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sl\/server\/dts-newyork\/\"   title=\"stre\u017enikom\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2763\">stre\u017enikom<\/a>. Te\u017eava se poka\u017ee od Redis 2.6 naprej in je odpravljena v izdajah 7.0.12, 6.2.13 in 6.0.20. Kot obvodno za\u0161\u010dito lahko z ACL onemogo\u010dite uporabnikom Redis izvajanje ukazov EVAL in EVALSHA.\n<li class=\"l\"> CVE-2023-36824 ranljivost v podatkovni bazi Redis, ki povzro\u010da prelivanje pomnilnika pri obdelavi imen klju\u010dev, posredovanih prek ukazov COMMAND GETKEYS ali COMMAND GETKEYSANDFLAGS, prav tako pa tudi seznamov klju\u010dev v pravilih ACL. Potencijalna ranljivost lahko privede do oddaljenega izvajanja kode na stre\u017eniku. Te\u017eava se poka\u017ee samo v veji 7.0.x in je odpravljena v izdaji 7.0.12.\n<li class=\"l\"> CVE-2022-23537 \u2014 ranljivost v komunikacijski platformi Asterisk, ki povzro\u010da prelivanje pomnilnika pri raz\u010dlemanju <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sl\/server\/dts-prohoster\/\"   title=\"serverom\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"3076\">serverom<\/a> posebej oblikovanih sporo\u010dil STUN, v katerih je naveden neznan atribut. Te\u017eava se poka\u017ee pri uporabi protokolov ICE ali WebRTC v Asterisku. Ranljivost je odpravljena v izdajah 16.30.1, 18.18.1, 19.8.1 in 20.3.1.\n<li class=\"l\"> CVE-2023-36664 \u2014 ranljivost v Ghostscriptu, orodju za obdelavo, pretvorbo in generiranje dokumentov v formatih PostScript in PDF, ki omogo\u010da izvajanje poljubne kode ob odpiranju posebej oblikovanih dokumentov v formatu PostScript. Te\u017eavo povzro\u010da nepravilna obdelava imen datotek, ki se za\u010dnejo s simbolom \u00ab|\u00bb ali s predpono %pipe%. Ranljivost je odpravljena v izdaji Ghostscript 10.01.2.\n<p>V mnogih okoljih se Ghostscript kli\u010de pri ustvarjanju miniatur na namizju ali pri indeksiranju podatkov v ozadju, zato je za napad v\u010dasih dovolj zgolj nalaganje datoteke z izkori\u0161\u010danjem ali brskanje po imeniku z njo v Nautilusu. Napad na stre\u017eni\u0161ke sisteme je mogo\u010de izvesti preko obdelovalcev slik, temelje\u010dih na paketih ImageMagick in GraphicsMagick, ki kli\u010deta Ghostscript pri prenosu datotek JPEG ali PNG, v katerih namesto slike obstaja koda PostScript (tak\u0161na datoteka bo obdelana v Ghostscript, saj se MIME-tip prepozna po vsebini, ne pa po kon\u010dnici).    <\/p>\n<li class=\"l\"> CVE-2023-36475 \u2014 ranljivost v Parse Serverju, stre\u017eni\u0161kem sistemu za Node.js, ki deluje s spletnim okvirjem Express, kar omogo\u010da oddaljeno izvajanje lastne kode na stre\u017eniku. Ranljivost omogo\u010da uporabo metode onesna\u017eevanja prototipov JavaScript objektov (\u00abprototype pollution\u00bb) za izvajanje lastne kode preko BSON parserja MongoDB. Ranljivosti je dodeljena stopnja nevarnosti 9.8 od 10. Te\u017eava je odpravljena v posodobitvah parse-server 5.5.2 in 6.2.1.      <\/ul>\n<p>Izvor: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=59430\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-24834 &#8212; \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0421\u0423\u0411\u0414 Redis, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 cjson \u0438 cmsgpack \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Lua. \u041f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 Redis 2.6 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 7.0.12, 6.2.13 \u0438 6.0.20. \u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0431\u0445\u043e\u0434\u043d\u043e\u0433\u043e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-109367","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-24834 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0421\u0423\u0411\u0414 Redis, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 cjson \u0438 cmsgpack \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sl\/blog\/news\/uyazvimosti-v-redis-ghostscript-asterisk-i-parse-server\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sl_SI\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Redis, Ghostscript, Asterisk \u0438 Parse Server | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-24834 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0421\u0423\u0411\u0414 Redis, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 cjson \u0438 cmsgpack \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sl\/blog\/news\/uyazvimosti-v-redis-ghostscript-asterisk-i-parse-server\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-07-12T19:10:19+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-07-13T07:57:04+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ranljivosti v Redis, Ghostscript, Asterisk in Parse Server | ProHoster","description":"Nekatere nedavno odkrite nevarne ranljivosti: CVE-2022-24834 - ranljivost v SGBD Redis, ki omogo\u010da povzro\u010ditev prelivanja v pomnilniku v knji\u017enicah cjson in cmsgpack pri izvajanju posebej oblikovanih zahtev.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/news\/uyazvimosti-v-redis-ghostscript-asterisk-i-parse-server","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Redis, Ghostscript, Asterisk \u0438 Parse Server | ProHoster","og:description":"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-24834 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0421\u0423\u0411\u0414 Redis, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 cjson \u0438 cmsgpack \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e.","og:url":"https:\/\/prohoster.info\/sl\/blog\/news\/uyazvimosti-v-redis-ghostscript-asterisk-i-parse-server","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-07-12T19:10:19+00:00","article:modified_time":"2023-07-13T07:57:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"109367","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:40:03","updated":"2026-02-09 21:46:52","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/109367","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=109367"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/109367\/revisions"}],"predecessor-version":[{"id":160357,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/109367\/revisions\/160357"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=109367"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=109367"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=109367"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}