Kusagadzikana kwakanyanya (CVE-2024-27322) kwakaonekwa mukuitwa kukuru kwemutauro weR programming, iyo ine chinangwa chekugadzirisa matambudziko ehuwandu hwekugadzirisa, kuongorora uye kuona kwedata, zvichitungamira mukutevedzwa kwekodhi kana deerial data isina kusimbiswa. Kusadzikama kunogona kushandiswa kana uchigadzira mafaera akagadzirwa muRDS (R Data Serialization) uye RDX mafomati, anoshandiswa kuchinjanisa data pakati pemaapplication. Nyaya inogadziriswa muR 4.4.0 kusunungurwa. Unogona kuteedzera kuburitswa kwepakeji zvigadziriso mukugovera pamapeji eDebian, Ubuntu, RHEL, SUSE/openSUSE, Fedora, Arch, FreeBSD.
Kusagadzikana kunokonzerwa nebasa rereadRDS, rinoshandiswa kurodha mafaera muRDS neRDX mafomati, ayo anobvumira serialized R zvinhu kuti zvifambiswe kuti zvigadziriswe pane imwe system. Serialization inoita kuti zvikwanise kutora nyika uye kuchinjanisa seti yedata pakati pezvirongwa. Iyo RDS fomati inobvumidza iwe kuchengetedza nyika nezve chinhu chimwe, uye iyo RDX fomati yakasanganiswa neRDB mafaera inoita kuti zvikwanise kuendesa ruzivo nezve akati wandei zvinhu. Dambudziko nderekuti iyo RDS fomati inotsigira PROMSXP chinhu kodhi yakabatana neiyo Promise mhando, iyo inoshandiswa kutsanangura mataurirwo anonzi asynchronously kana hunhu hwawo hwakabatana huchishandiswa.
Munguva ye deerialization, zvikamu zvitatu zvinoshandiswa kutsanangura Chipikirwa chinhu - Chipikirwa kukosha, kutaura, uye nharaunda. Kana iyo Promise type isina pre-computed value, inoverengerwa panguva ye deerialization nekuita chirevo uchishandisa "eval" basa. Nenzira iyi, munhu anorwisa anogona kuita kuti R kodhi iite zvekupokana nekuitsiva nekutaura kune hukama husingaverengeki muRDS kana RDX mafaera.
Source: opennet.ru
