nyowani nezve kubiwa kwezvivakwa zveiyo decentralized messaging platform Matrix, pamusoro payo pamangwanani. Iyo inonetsa yekubatanidza iyo varwisi vakapinda nayo yaive Jenkins inoenderera mberi yekubatanidza sisitimu, iyo yakabiwa munaKurume 13. Zvadaro, pane sevha yeJenkins, kupinda kwemumwe wevatariri, kwakatungamirirwa neSSH mumiririri, kwakagamuchirwa, uye musi waApril 4, vapambi vakawana mukana kune mamwe maseva ezvivakwa.
Munguva yekurwisa kwechipiri, matrix.org webhusaiti yakadzoserwa kune imwe sevha (matrixnotorg.github.io) nekushandura DNS parameters, uchishandisa kiyi ye Cloudflare content delivery system API yakabatwa panguva yekutanga kurwisa. Pakuvakazve zviri mukati mesevha mushure mekubira kwekutanga, Matrix maneja anongovandudza makiyi emunhu uye akapotsa kuvandudza kiyi kuCloudflare.
Munguva yekurwiswa kwechipiri, maseva eMatrix akaramba asina kubatwa; shanduko dzaingogumira pakutsiva kero muDNS. Kana mushandisi atochinja password mushure mekurwisa kwekutanga, hapana chikonzero chekuchinja kechipiri. Asi kana iyo password isati yashandurwa, inoda kuvandudzwa nekukurumidza, sezvo kuvuza kwedhatabhesi ine password hashes yakasimbiswa. Urongwa hwazvino ndehwekutanga kumanikidzwa password reset process nguva inotevera paunopinda.
Pamusoro pekudonha kwemapassword, zvakasimbiswawo kuti makiyi eGPG anoshandiswa kugadzira masiginecha edhijitari emapakeji muDebian Synapse repository uye Riot/Webhu kuburitswa kwawira mumaoko evanorwisa. Makiyi aive akachengetedzwa nepassword. Makiyi akatobviswa kare panguva ino. Makiyi akabatwa musi waApril 4, kubvira ipapo hapana Synapse updates yakaburitswa, asi Riot/Web client 1.0.7 yakaburitswa (cheki yekutanga yakaratidza kuti haina kukanganiswa).
Murwi akatumira akateedzana mishumo paGitHub ine ruzivo rwekurwiswa uye matipi ekuwedzera dziviriro, asi dzakadzimwa. Nekudaro, iyo yakachengetwa inoshuma .
Semuyenzaniso, murwi akashuma kuti Vagadziri veMatrix vanofanira mbiri-chinhu chechokwadi kana kuti kwete kushandisa SSH mumiriri redirection ("ForwardAgent hongu"), ipapo kupinda mukati mezvivakwa kwaizovharwa. Kuwedzera kwekurwisa kwaigonawo kumiswa nekupa vanogadzira chete maropafadzo anodiwa, kwete pamaseva ese.
Pamusoro pezvo, tsika yekuchengeta makiyi ekugadzira masiginecha edhijitari pamaseva ekugadzira yakashoropodzwa; imwe yakaparadzana yakasarudzika inofanirwa kugoverwa nekuda kwezvinangwa zvakadaro. Ndichiri kurwisa , kuti dai Vagadziri veMatrix vaigara vachiongorora matanda uye nekuongorora zvisizvo, vangadai vakatoona maratidziro ehutsotsi pakutanga (iyo CI hack yakaenda isingaonekwe kwemwedzi). Rimwe dambudziko kuchengetedza mafaera ese ekugadzirisa muGit, izvo zvakaita kuti zvikwanise kuongorora marongero emamwe mauto kana imwe yacho yakabiwa. Svika kuburikidza neSSH kune maseva ezvivakwa yakaganhurirwa kune yakachengeteka yemukati network, iyo yakaita kuti zvibvire kubatana navo kubva kune chero kero yekunze.
Chinhuopennet.ru
[: en]nyowani nezve kubiwa kwezvivakwa zveiyo decentralized messaging platform Matrix, pamusoro payo pamangwanani. Iyo inonetsa yekubatanidza iyo varwisi vakapinda nayo yaive Jenkins inoenderera mberi yekubatanidza sisitimu, iyo yakabiwa munaKurume 13. Zvadaro, pane sevha yeJenkins, kupinda kwemumwe wevatariri, kwakatungamirirwa neSSH mumiririri, kwakagamuchirwa, uye musi waApril 4, vapambi vakawana mukana kune mamwe maseva ezvivakwa.
Munguva yekurwisa kwechipiri, matrix.org webhusaiti yakadzoserwa kune imwe sevha (matrixnotorg.github.io) nekushandura DNS parameters, uchishandisa kiyi ye Cloudflare content delivery system API yakabatwa panguva yekutanga kurwisa. Pakuvakazve zviri mukati mesevha mushure mekubira kwekutanga, Matrix maneja anongovandudza makiyi emunhu uye akapotsa kuvandudza kiyi kuCloudflare.
Munguva yekurwiswa kwechipiri, maseva eMatrix akaramba asina kubatwa; shanduko dzaingogumira pakutsiva kero muDNS. Kana mushandisi atochinja password mushure mekurwisa kwekutanga, hapana chikonzero chekuchinja kechipiri. Asi kana iyo password isati yashandurwa, inoda kuvandudzwa nekukurumidza, sezvo kuvuza kwedhatabhesi ine password hashes yakasimbiswa. Urongwa hwazvino ndehwekutanga kumanikidzwa password reset process nguva inotevera paunopinda.
Pamusoro pekudonha kwemapassword, zvakasimbiswawo kuti makiyi eGPG anoshandiswa kugadzira masiginecha edhijitari emapakeji muDebian Synapse repository uye Riot/Webhu kuburitswa kwawira mumaoko evanorwisa. Makiyi aive akachengetedzwa nepassword. Makiyi akatobviswa kare panguva ino. Makiyi akabatwa musi waApril 4, kubvira ipapo hapana Synapse updates yakaburitswa, asi Riot/Web client 1.0.7 yakaburitswa (cheki yekutanga yakaratidza kuti haina kukanganiswa).
Murwi akatumira akateedzana mishumo paGitHub ine ruzivo rwekurwiswa uye matipi ekuwedzera dziviriro, asi dzakadzimwa. Nekudaro, iyo yakachengetwa inoshuma .
Semuyenzaniso, murwi akashuma kuti Vagadziri veMatrix vanofanira mbiri-chinhu chechokwadi kana kuti kwete kushandisa SSH mumiriri redirection ("ForwardAgent hongu"), ipapo kupinda mukati mezvivakwa kwaizovharwa. Kuwedzera kwekurwisa kwaigonawo kumiswa nekupa vanogadzira chete maropafadzo anodiwa, kwete pamaseva ese.
Pamusoro pezvo, tsika yekuchengeta makiyi ekugadzira masiginecha edhijitari pamaseva ekugadzira yakashoropodzwa; imwe yakaparadzana yakasarudzika inofanirwa kugoverwa nekuda kwezvinangwa zvakadaro. Ndichiri kurwisa , kuti dai Vagadziri veMatrix vaigara vachiongorora matanda uye nekuongorora zvisizvo, vangadai vakatoona maratidziro ehutsotsi pakutanga (iyo CI hack yakaenda isingaonekwe kwemwedzi). Rimwe dambudziko kuchengetedza mafaera ese ekugadzirisa muGit, izvo zvakaita kuti zvikwanise kuongorora marongero emamwe mauto kana imwe yacho yakabiwa. Svika kuburikidza neSSH kune maseva ezvivakwa yakaganhurirwa kune yakachengeteka yemukati network, iyo yakaita kuti zvibvire kubatana navo kubva kune chero kero yekunze.
Source: opennet.ru
[:]