{"id":105101,"date":"2022-09-15T09:36:58","date_gmt":"2022-09-15T07:36:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-paketnom-menedzhere-cargo-primenyaemom-dlya-proektov-na-yazyke-rust"},"modified":"2022-09-15T09:36:58","modified_gmt":"2022-09-15T07:36:58","slug":"uyazvimosti-v-paketnom-menedzhere-cargo-primenyaemom-dlya-proektov-na-yazyke-rust","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-paketnom-menedzhere-cargo-primenyaemom-dlya-proektov-na-yazyke-rust","title":{"rendered":"Do vunerabilitete n\u00eb menaxherin e paketave Cargo, i p\u00ebrdorur p\u00ebr projektet n\u00eb gjuh\u00ebn Rust","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb menaxherin e paketave Cargo, i p\u00ebrdorur p\u00ebr menaxhimin e paketeve dhe nd\u00ebrtimin e projekteve n\u00eb gjuh\u00ebn Rust, jan\u00eb identifikuar dy vulnerabilitete, t\u00eb cilat mund t\u00eb shfryt\u00ebzohen gjat\u00eb shkarkimit t\u00eb paketimeve t\u00eb formuara ve\u00e7mas nga depo t\u00eb jashtme (pretendohet se problemi nuk ka prekur p\u00ebrdoruesit e depozitat zyrtare crates.io). Vulnerabiliteti i par\u00eb (CVE-2022-36113) lejon q\u00eb t\u00eb shkruhen dy bajta t\u00eb par\u00eb n\u00eb \u00e7do skedare, sa i lejojn\u00eb t\u00eb drejtat aktuale t\u00eb aksesit. Vulnerabiliteti i dyt\u00eb (CVE-2022-36114) mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb shpenzuar hap\u00ebsir\u00ebn e lir\u00eb n\u00eb disk. <\/p>\n
Vulnerabilitetet do t\u00eb rregullohen n\u00eb versionin e Rust 1.64, i cili \u00ebsht\u00eb planifikuar p\u00ebr 22 Shtator. Vulnerabiliteteve u \u00ebsht\u00eb caktuar nj\u00eb nivel i ul\u00ebt rreziku, pasi nj\u00eb d\u00ebm i ngjash\u00ebm mund t\u00eb shkaktohet nga p\u00ebrdorimi i paketimeve t\u00eb pabesueshme nga depo t\u00eb jashtme p\u00ebrmes mund\u00ebsive standarde t\u00eb ekzekutimit t\u00eb trajtuesve t\u00eb vet nga skriptet e nd\u00ebrtimit ose makro procedurale t\u00eb p\u00ebrfshira n\u00eb paket\u00eb. Megjithat\u00eb, problemet e sh\u00ebnuara m\u00eb sip\u00ebr dallohen nga fakti se shfryt\u00ebzimi i tyre b\u00ebhet n\u00eb faz\u00ebn e zbuluar t\u00eb paket\u00ebs pas shkarkimit (pa nd\u00ebrtim). <\/p>\n
Specifikisht, pas ngarkimit, paketa cargo e \u00e7monton p\u00ebrmbajtjen e saj n\u00eb katalogun ~\/.cargo dhe ruan shenj\u00ebn e suksesit t\u00eb \u00e7montimit n\u00eb skedarin .cargo-ok. Thelbi i shkeljes s\u00eb par\u00eb \u00ebsht\u00eb se krijuesi i paket\u00ebs mund t\u00eb vendos\u00eb brenda nj\u00eb lidhjeje simbolike me emrin .cargo-ok, e cila do t\u00eb \u00e7oj\u00eb n\u00eb shkrimin e tekstit \"ok\" n\u00eb skedarin n\u00eb t\u00eb cilin e drejton lidhja. <\/p>\n
Shkelja e dyt\u00eb shkaktohet nga mungesa e nj\u00eb kufiri n\u00eb madh\u00ebsin\u00eb e t\u00eb dh\u00ebnave q\u00eb nxirren nga arkivat, t\u00eb cilat mund t\u00eb p\u00ebrdoren p\u00ebr t\u00eb krijuar \"zip-bomba\" (n\u00eb arkiv mund t\u00eb p\u00ebrfshihen t\u00eb dh\u00ebna q\u00eb lejojn\u00eb arritjen e nj\u00eb shkalle maksimale kompresimi p\u00ebr formatin zip \u2014 rreth 28 milion her\u00eb, n\u00eb k\u00ebt\u00eb rast, p\u00ebr shembull, nj\u00eb skedar zip i p\u00ebrgatitur ve\u00e7mas me nj\u00eb madh\u00ebsi prej 10 MB do t\u00eb \u00e7onte n\u00eb \u00e7montimin e rreth 281 TB t\u00eb dh\u00ebnash). \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"