Iyo OpenSSF (Open Source Security Foundation), yakagadzirwa pasi pehurongwa hweLinux Foundation yekuvandudza kuchengetedzeka kweyakavhurika sosi software, yakayambira nharaunda nezve kuzivikanwa kwechiitiko chine chekuita nekuedza kuwana hutongi pamusoro pezvirongwa zvakakurumbira zvakavhurwa sosi, zvinoyeuchidza maitiro ayo. yezviitwa zvevanorwisa mukugadzirira kuisa backdoor muchirongwa xz. Zvakafanana nekurwiswa kwe xz, vanhu vanokahadzika vaive vasati vapinda zvakadzama mubudiriro vakaedza kushandisa nzira dzeinjiniya dzemagariro kuzadzisa zvinangwa zvavo.
Vapambi vakapinda mukunyorerana tsamba nenhengo dzedare rinotonga reOpenJS Foundation, rinoshanda senzvimbo isina kwayakarerekera yekusimudzira pamwe chete kwemapurojekiti akavhurika eJavaScript akadai seNode.js, jQuery, Appium, Dojo, PEP, Mocha uye webpack. Tsamba iyi, iyo yaisanganisira vagadziri vebato rechitatu vane nhoroondo dzisina kujeka dzekusimudzira sosi, vakaedza kunyengerera manejimendi kudiwa kwekuvandudza imwe yemapurojekiti akakurumbira eJavaScript akachengetedzwa nesangano reOpenJS.
Chikonzero chekuvandudza chakataurwa kuve kudiwa kwekuwedzera "dziviriro kubva kune chero njodzi yakakosha." Nekudaro, hapana ruzivo rwakapihwa nezve kukosha kwekusagadzikana. Kuti aite shanduko, mugadziri aifungira akazvipira kumubatanidza pakati pevanochengetedza chirongwa, mukuvandudza kwaaive angotora chikamu chidiki. Pamusoro pezvo, zvimwe zvakafanana zvinofungirwa zvekuisa kodhi yavo zvakaonekwa mune maviri akakurumbira JavaScript mapurojekiti asina hukama nesangano reOpenJS. Zvinofungidzirwa kuti nyaya hadzina kuparadzaniswa uye vagadziri veakavhurika sosi mapurojekiti vanofanirwa kuramba vakangwarira kana vachigamuchira kodhi uye kubvumidza vatsva vanogadzira.
Zviratidzo zvinogona kuratidza kuita kwakashata zvinosanganisira zvine vavariro yakanaka, asi panguva imwe chete zvine hukasha uye nekushingirira, kuedza kwenhengo dzenharaunda dzisingazivikanwe kusvika kune vanochengeta kana mamaneja epurojekiti nepfungwa yekusimudzira kodhi yavo kana kupa chinzvimbo chemuchengeti. Panofanira kutariswawo pakubuda kweboka retsigiro rakatenderedza pfungwa dziri kusimudzirwa, dzakaumbwa kubva kuvanhu vemanyepo vasina kumbobvira vatora chikamu mubudiriro kana kuti vachangobva kupinda munharaunda.
Paunenge uchigamuchira shanduko, unofanirwa kuona sezviratidzo zvekuedza kusanganisa data yebhinari mukubatanidza zvikumbiro (semuenzaniso, mu xz, backdoor yakaunzwa mudura kuti iedze unpacker) kana kodhi inovhiringa kana yakaoma kunzwisisa. Kutariswa kunofanira kupihwa kukuyedza kwekuchinja kudiki-kukanganisa kuchengetedzwa kwakaunzwa kugeji mhinduro yenharaunda uye kuona kana paine vanhu vari kutevera shanduko (semuenzaniso xz yakatsiva Safe_fprintf basa nefprintf). Kufungidzira kunofanirawo kumutswa nekuchinja kweatypical munzira dzekubatanidza, kuungana uye kutumirwa kweprojekiti, kushandiswa kwezvinhu zvechitatu-bato uye kuwedzera kwekunzwa kwekudiwa kwekukurumidza kutora shanduko.
Source: opennet.ru