{"id":101282,"date":"2021-09-17T04:22:36","date_gmt":"2021-09-17T02:22:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-travis-ci-privodyashhaya-k-utechke-klyuchej-publichnyh-repozitoriev"},"modified":"2021-09-17T04:22:36","modified_gmt":"2021-09-17T02:22:36","slug":"uyazvimost-v-travis-ci-privodyashhaya-k-utechke-klyuchej-publichnyh-repozitoriev","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-travis-ci-privodyashhaya-k-utechke-klyuchej-publichnyh-repozitoriev","title":{"rendered":"Nj\u00eb dob\u00ebsi n\u00eb Travis CI q\u00eb \u00e7on n\u00eb rrjedhjen e \u00e7el\u00ebsave t\u00eb depozitave publike","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb sh\u00ebrbimin e integrimit t\u00eb vazhduesh\u00ebm Travis CI, i nd\u00ebrtuar p\u00ebr testimin dhe nd\u00ebrtimin e projekteve t\u00eb zhvilluara n\u00eb GitHub dhe Bitbucket, \u00ebsht\u00eb identifikuar nj\u00eb problem sigurie (CVE-2021-41077) q\u00eb mund\u00ebson zbardhjen e p\u00ebrmbajtjes s\u00eb variablave konfidencial\u00eb t\u00eb mjedisit n\u00eb depozit\u00eb publike q\u00eb p\u00ebrdorin Travis CI. Kjo dob\u00ebsi gjithashtu lejon zbardhjen e \u00e7el\u00ebsave t\u00eb p\u00ebrdorur n\u00eb Travis CI p\u00ebr formimin e n\u00ebnshkrimeve digjitale, \u00e7el\u00ebsave t\u00eb qasjes dhe tokeneve p\u00ebr akses n\u00eb API. <\/p>\n
Problemi ka qen\u00eb i pranish\u00ebm n\u00eb Travis CI nga 3 deri m\u00eb 10 Shtator. E ve\u00e7ant\u00eb \u00ebsht\u00eb se informacioni mbi vulnerabilitetin iu kalua zhvilluesve m\u00eb 7 Shtator, por p\u00ebrgjigjja e marr\u00eb ishte vet\u00ebm nj\u00eb rekomandim p\u00ebr t\u00eb p\u00ebrdorur rotacionin e \u00e7el\u00ebsave. Pas mospranimit t\u00eb nj\u00eb p\u00ebrgjigjeje t\u00eb qart\u00eb, hulumtuesit kontaktuan GitHub-in dhe propozuan q\u00eb Travis t\u00eb vihej n\u00eb bllok. Problemi u zgjidh vet\u00ebm m\u00eb 10 Shtator pas nj\u00eb numri t\u00eb madh ankesash nga projekte t\u00eb ndryshme. Pas incidentit, n\u00eb sitin e kompanis\u00eb Travis CI u publikua nj\u00eb raport m\u00eb shum\u00eb se i \u00e7uditsh\u00ebm mbi problemin, i cili n\u00eb vend q\u00eb t\u00eb informonte p\u00ebr rregullimin e vulnerabilitetit, p\u00ebrmbante vet\u00ebm rekomandimin e dh\u00ebn\u00eb jasht\u00eb kontekstit p\u00ebr t\u00eb ndryshuar ciklikisht \u00e7el\u00ebsat e aksesit. <\/p>\n
Pas shqet\u00ebsimit p\u00ebr fshehjen e informacionit, t\u00eb shprehur nga disa projekte t\u00eb m\u00ebdha, n\u00eb forumet e suportit t\u00eb Travis CI u publikua nj\u00eb raport m\u00eb i detajuar, i cili paralajm\u00ebronte se pronari i forkut t\u00eb \u00e7do depoje publike, p\u00ebrmes d\u00ebrgimit t\u00eb nj\u00eb pull-request, mund t\u00eb inicionte procesin e nd\u00ebrtimit dhe t\u00eb merrte qasje t\u00eb paautorizuar n\u00eb variablat konfidencial\u00eb t\u00eb mjedisit t\u00eb depozit\u00ebs origjinale, t\u00eb ekspozuar gjat\u00eb nd\u00ebrtimit n\u00eb p\u00ebrputhje me fushat nga skedari «.travis.yml» ose t\u00eb p\u00ebrcaktuara p\u00ebrmes nd\u00ebrfaqes web t\u00eb Travis CI. K\u00ebto variabla ruhen n\u00eb form\u00eb t\u00eb koduar dhe dekodohen vet\u00ebm gjat\u00eb nd\u00ebrtimit. Problemi preku vet\u00ebm depozitat publike q\u00eb kishin fork\u00eb (depozitat private nuk ishin t\u00eb ekspozuara ndaj sulmit). \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"