{"id":106827,"date":"2023-02-15T18:48:14","date_gmt":"2023-02-15T16:48:14","guid":{"rendered":"https:\/\/prohoster.info\/?p=106827"},"modified":"2023-02-16T11:50:36","modified_gmt":"2023-02-16T09:50:36","slug":"uyazvimosti-v-git-privodyashhaya-k-utechke-i-perezapisi-dannyh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-git-privodyashhaya-k-utechke-i-perezapisi-dannyh","title":{"rendered":"Vulnerabilitetet n\u00eb Git q\u00eb \u00e7ojn\u00eb n\u00eb rrjedhjen dhe rip\u00ebrpunimin e t\u00eb dh\u00ebnave","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Shtypjet korrigjuese p\u00ebr sistemin e shp\u00ebrndar\u00eb t\u00eb menaxhimit t\u00eb teksteve burimore Git 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7 dhe 2.30.8 jan\u00eb publikuar, n\u00eb t\u00eb cilat jan\u00eb eliminuar dy dob\u00ebsi q\u00eb prekin optimizimet gjat\u00eb klonimit lokal dhe komand\u00ebn «git apply». Mund t\u00eb ndiqni publikimet e azhurnimeve t\u00eb paketave n\u00eb distribucionet Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, Arch, FreeBSD. N\u00ebse azhurnimi nuk \u00ebsht\u00eb i mundur, rekomandohet t\u00eb shmangni ekzekutimin e operacionit «git clone» me opsionin «—recurse-submodules» me depo t\u00eb paqena, si dhe t\u00eb mos p\u00ebrdorni komandat «git apply» dhe «git am» me kod t\u00eb paprovuar. <\/p>\n
\n
Vulnerabiliteti CVE-2023-22490 lejon q\u00eb nj\u00eb sulmues q\u00eb kontrollon p\u00ebrmbajtjen e repozitorit t\u00eb klonuar t\u00eb aksesoj\u00eb t\u00eb dh\u00ebna konfidenciale n\u00eb sistemin e p\u00ebrdoruesit. Shfaqja e vulnerabilitetit ndihmohet nga dy mang\u00ebsi:\n
Mungesa e par\u00eb lejon q\u00eb gjat\u00eb pun\u00ebs me nj\u00eb repozitor t\u00eb strukturuar n\u00eb m\u00ebnyr\u00eb speciale t\u00eb arrihet nj\u00eb aplikim i optimizimeve t\u00eb lokalizuara t\u00eb klonimit, edhe kur p\u00ebrdoret nj\u00eb transport q\u00eb ndjek p\u00ebrve\u00e7 sistemeve t\u00eb jashtme. <\/p>\n
Mungesa e dyt\u00eb lejon vendosjen e nj\u00eb lidhjeje simbolike n\u00eb vend t\u00eb katalogut $GIT_DIR\/objects, ngjash\u00ebm me vulnerabilitetin CVE-2022-39253, ku n\u00eb korrigjimin e tij u bllokua vendosja e lidhjeve simbolike n\u00eb katalogun $GIT_DIR\/objects, por nuk u kontrollua fakti q\u00eb katalogu $GIT_DIR\/objects mund t\u00eb jet\u00eb nj\u00eb lidhje simbolike. <\/p>\n
N\u00eb m\u00ebnyr\u00ebn e klonimit lokal, git transferon $GIT_DIR\/objects n\u00eb katalogun e synuar, duke zbatuar dereferencimin e lidhjeve simbolike, gj\u00eb q\u00eb shkakton q\u00eb n\u00eb katalogun e synuar t\u00eb kopjohen drejtp\u00ebrdrejt skedar\u00ebt q\u00eb p\u00ebrshkruhen nga lidhjet. Kalimi n\u00eb aplikimin e optimizimeve lokale t\u00eb klonimit p\u00ebr transportet jo-lokale lejon t\u00eb shfryt\u00ebzohet dob\u00ebsia gjat\u00eb pun\u00ebs me depo t\u00eb jashtme (p\u00ebr shembull, p\u00ebrfshirja rekurzive e submodul\u00ebve me komand\u00ebn «git clone —recurse-submodules» mund t\u00eb \u00e7oj\u00eb n\u00eb klonimin e nj\u00eb depost t\u00eb d\u00ebmsh\u00ebm, i paketuar si submodul n\u00eb nj\u00eb depo tjet\u00ebr). <\/p>\n
Dob\u00ebsia CVE-2023-23946 lejon q\u00eb p\u00ebrmbajtja e skedar\u00ebve jasht\u00eb katalogut t\u00eb pun\u00ebs t\u00eb overwrite-het p\u00ebrmes kalimit t\u00eb nj\u00eb inputi t\u00eb formatizuar n\u00eb komand\u00ebn «git apply». P\u00ebr shembull, nj\u00eb sulm mund t\u00eb kryhet gjat\u00eb p\u00ebrpunimit n\u00eb «git apply» t\u00eb patch-eve t\u00eb p\u00ebrgatitura nga sulmuesi. P\u00ebr t\u00eb bllokuar krijimin e skedar\u00ebve nga patch-et jasht\u00eb kopjes pune, «git apply» bllokon p\u00ebrpunimin e patch-eve q\u00eb p\u00ebrpiqen t\u00eb shkruajn\u00eb skedar\u00eb duke p\u00ebrdorur lidhje simbolike. Por kjo mbrojtje \u00ebsht\u00eb gjetur se mund t\u00eb anashkalohet duke krijuar nj\u00eb lidhje simbolike fillimisht. <\/ul>\n