{"id":109367,"date":"2023-07-12T21:10:19","date_gmt":"2023-07-12T19:10:19","guid":{"rendered":"https:\/\/prohoster.info\/?p=109367"},"modified":"2023-07-13T09:57:04","modified_gmt":"2023-07-13T07:57:04","slug":"uyazvimosti-v-redis-ghostscript-asterisk-i-parse-server","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-redis-ghostscript-asterisk-i-parse-server","title":{"rendered":"Dob\u00ebsi n\u00eb Redis, Ghostscript, Asterisk dhe Parse Server","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Disa dob\u00ebsi t\u00eb rrezikshme t\u00eb zbuluara s\u00eb fundi:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2022-24834 \u2014 nj\u00eb ndjeshm\u00ebri n\u00eb baz\u00ebn e t\u00eb dh\u00ebnave Redis, e cila lejon q\u00eb t\u00eb ndodh\u00eb mbushja e mbushjes n\u00eb bibliotekat cjson dhe cmsgpack gjat\u00eb ekzekutimit t\u00eb nj\u00eb skripti t\u00eb dizajnuar me kujdes n\u00eb gjuh\u00ebn Lua. Potencialisht, kjo ndjeshm\u00ebri mund t\u00eb \u00e7oj\u00eb n\u00eb ekzekutimin e kodit n\u00eb distanc\u00eb n\u00eb <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sq\/server\/dts-newyork\/\"   title=\"server\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2763\">server<\/a>. Problemi shfaqet duke filluar nga Redis 2.6 dhe \u00ebsht\u00eb korrigjuar n\u00eb versionet 7.0.12, 6.2.13 dhe 6.0.20. Si zgjidhje e p\u00ebrkohshme mbrojt\u00ebse, mund t\u00eb ndaloni p\u00ebrmes ACL q\u00eb p\u00ebrdoruesit e Redis t\u00eb ekzekutojn\u00eb komandat EVAL dhe EVALSHA.\n<li class=\"l\"> CVE-2023-36824 \u2014 dob\u00ebsi n\u00eb DBMS Redis, q\u00eb shkakton tejmbushje t\u00eb buffer-it gjat\u00eb p\u00ebrpunimit t\u00eb emrave t\u00eb \u00e7el\u00ebsave t\u00eb kaluar p\u00ebrmes komand\u00ebs COMMAND GETKEYS ose COMMAND GETKEYSANDFLAGS, si edhe t\u00eb listave t\u00eb \u00e7el\u00ebsave n\u00eb rregullat ACL. Potencialisht, kjo dob\u00ebsi mund t\u00eb \u00e7oj\u00eb n\u00eb ekzekutim t\u00eb kodit n\u00eb distanc\u00eb n\u00eb server. Problemi shfaqet vet\u00ebm n\u00eb deg\u00ebn 7.0.x dhe \u00ebsht\u00eb korrigjuar n\u00eb versionin 7.0.12.\n<li class=\"l\"> CVE-2022-23537 \u2014 nj\u00eb ndjeshm\u00ebri n\u00eb platform\u00ebn e komunikimit Asterisk, e cila \u00e7on n\u00eb mbushje t\u00eb mbushjes gjat\u00eb analiz\u00ebs <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sq\/server\/dts-prohoster\/\"   title=\"server\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"3076\">server<\/a> mesazheve STUN t\u00eb p\u00ebrgatitura posa\u00e7\u00ebrisht, ku specifikohet nj\u00eb atribut i panjohur. Problemi shfaqet kur n\u00eb Asterisk p\u00ebrdoren protokollet ICE ose WebRTC. Dob\u00ebsia \u00ebsht\u00eb korrigjuar n\u00eb versionet 16.30.1, 18.18.1, 19.8.1 dhe 20.3.1.\n<li class=\"l\"> CVE-2023-36664 \u2014 nj\u00eb ndjeshm\u00ebri n\u00eb Ghostscript, nj\u00eb grup mjetesh p\u00ebr p\u00ebrpunimin, konvertimin dhe gjenerimin e dokumenteve n\u00eb formate PostScript dhe PDF, e cila lejon ekzekutimin e kodit t\u00eb rastit gjat\u00eb hapjes s\u00eb dokumenteve t\u00eb dizajnuara me kujdes n\u00eb formatin PostScript. Problemi shkaktohet nga trajtimi i gabuar i emrave t\u00eb skedar\u00ebve q\u00eb fillojn\u00eb me simbolin \u00ab|\u00bb ose prefiksin %pipe%. Ndjeshm\u00ebria \u00ebsht\u00eb rregulluar n\u00eb versionin Ghostscript 10.01.2.\n<p>N\u00eb shum\u00eb mjedise, Ghostscript thirret gjat\u00eb krijimit t\u00eb miniaturave n\u00eb desktop ose gjat\u00eb indeksimit n\u00eb sfond t\u00eb t\u00eb dh\u00ebnave, prandaj p\u00ebr nj\u00eb sulm ndonj\u00ebher\u00eb mjafton thjesht t\u00eb ngarkohet nj\u00eb skedar me exploit ose t\u00eb hapet drejtoria q\u00eb e p\u00ebrmban n\u00eb Nautilus. Sulmi ndaj sistemeve server mund t\u00eb organizohet p\u00ebrmes p\u00ebrpunuesve t\u00eb imazheve t\u00eb bazuar n\u00eb paketat ImageMagick dhe GraphicsMagick, t\u00eb cil\u00ebt th\u00ebrrasin Ghostscript kur u d\u00ebrgohen skedar\u00eb JPEG ose PNG, ku n\u00eb vend t\u00eb figur\u00ebs ndodhet kod PostScript (nj\u00eb skedar i till\u00eb do t\u00eb p\u00ebrpunohet n\u00eb Ghostscript, pasi tipi MIME p\u00ebrcaktohet nga p\u00ebrmbajtja dhe jo nga prapashtesa).    <\/p>\n<li class=\"l\"> CVE-2023-36475 \u2014 nj\u00eb ndjeshm\u00ebri n\u00eb Parse Server, backend p\u00ebr Node.js, q\u00eb punon me framework-un web Express, e cila lejon ekzekutimin e kodit tuaj n\u00eb distanc\u00eb n\u00eb server. Kjo ndjeshm\u00ebri lejon p\u00ebrdorimin e metod\u00ebs s\u00eb ndotjes s\u00eb prototipit t\u00eb objekteve JavaScript (\u00abprototype pollution\u00bb) p\u00ebr t\u00eb ekzekutuar kodin tuaj p\u00ebrmes parser-it BSON t\u00eb MongoDB. Ndjeshm\u00ebris\u00eb i \u00ebsht\u00eb caktuar nj\u00eb nivel rreziku 9.8 nga 10. Problemi \u00ebsht\u00eb rregulluar n\u00eb p\u00ebrdit\u00ebsimet parse-server 5.5.2 dhe 6.2.1.      <\/ul>\n<p>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=59430\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-24834 &#8212; \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0421\u0423\u0411\u0414 Redis, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 cjson \u0438 cmsgpack \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Lua. \u041f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 Redis 2.6 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 7.0.12, 6.2.13 \u0438 6.0.20. \u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0431\u0445\u043e\u0434\u043d\u043e\u0433\u043e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-109367","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-24834 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0421\u0423\u0411\u0414 Redis, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 cjson \u0438 cmsgpack \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-redis-ghostscript-asterisk-i-parse-server\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Redis, Ghostscript, Asterisk \u0438 Parse Server | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-24834 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0421\u0423\u0411\u0414 Redis, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 cjson \u0438 cmsgpack \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-redis-ghostscript-asterisk-i-parse-server\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-07-12T19:10:19+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-07-13T07:57:04+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Cenueshm\u00ebri n\u00eb Redis, Ghostscript, Asterisk dhe Parse Server | ProHoster","description":"Disa cenueshm\u00ebri t\u00eb rrezikshme t\u00eb zbuluara s\u00eb fundmi: CVE-2022-24834 - cenueshm\u00ebri n\u00eb DBMS Redis, q\u00eb mund\u00ebson shkaktimin e nj\u00eb buffer overflow n\u00eb bibliotekat cjson dhe cmsgpack gjat\u00eb ekzekutimit t\u00eb posa\u00e7\u00ebm.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-redis-ghostscript-asterisk-i-parse-server","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Redis, Ghostscript, Asterisk \u0438 Parse Server | ProHoster","og:description":"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-24834 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0421\u0423\u0411\u0414 Redis, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 cjson \u0438 cmsgpack \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-redis-ghostscript-asterisk-i-parse-server","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-07-12T19:10:19+00:00","article:modified_time":"2023-07-13T07:57:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"109367","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:40:03","updated":"2026-02-09 21:46:52","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/109367","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=109367"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/109367\/revisions"}],"predecessor-version":[{"id":160357,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/109367\/revisions\/160357"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=109367"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=109367"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=109367"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}