N\u00eb utilitarin p\u00ebr marrjen dhe d\u00ebrgimin e t\u00eb dh\u00ebnave p\u00ebrmes rrjetit curl dhe bibliotek\u00ebs n\u00eb zhvillim libcurl \u00ebsht\u00eb zbuluar nj\u00eb vulnerabilitet (CVE-2023-38545), i cili mund t\u00eb \u00e7oj\u00eb n\u00eb mbushje t\u00eb tamponit dhe potencialisht n\u00eb ekzekutimin e kodit nga sulmuesi n\u00eb an\u00ebn e klientit gjat\u00eb p\u00ebrdorimit t\u00eb utilitarit curl ose aplikacionit q\u00eb p\u00ebrdor libcurl p\u00ebr t'u lidhur me nj\u00eb server HTTPS, i kontrolluar nga keqb\u00ebr\u00ebsi. Problemi shfaqet vet\u00ebm n\u00eb rastin kur aksesin n\u00eb curl e mund\u00ebson nj\u00eb proxy SOCKS5. N\u00ebse lidhet direkt pa proxy, vulnerabiliteti nuk shfaqet. Vulnerabiliteti \u00ebsht\u00eb eliminuar n\u00eb l\u00ebshimin curl 8.4.0. K\u00ebrkuesi q\u00eb po e hulumton k\u00ebt\u00eb problemi ka marr\u00eb nj\u00eb shp\u00ebrblim prej $4660 n\u00eb kuad\u00ebr t\u00eb iniciativ\u00ebs Internet Bug Bounty n\u00eb Hackerone. <\/p>\n
Vulnerabiliteti \u00ebsht\u00eb shkaktuar nga nj\u00eb gabim n\u00eb kodin e zgjidhjes s\u00eb emrit t\u00eb hostit para se t'i drejtohet proxy SOCKS5. Kur gjat\u00ebsia e emrit t\u00eb hostit arrin deri n\u00eb 256 karaktere, curl e d\u00ebrgon menj\u00ebher\u00eb emrin n\u00eb proxy SOCKS5 p\u00ebr zgjidhje n\u00eb an\u00ebn e tij, nd\u00ebrsa n\u00ebse emri \u00ebsht\u00eb m\u00eb shum\u00eb se 255 karaktere, kalon n\u00eb rezolverin lokal dhe d\u00ebrgon n\u00eb SOCKS5 nj\u00eb adres\u00eb tashm\u00eb t\u00eb caktuar. P\u00ebr shkak t\u00eb nj\u00eb gabimi n\u00eb kod, flaga q\u00eb tregon nevoj\u00ebn p\u00ebr zgjidhje lokale, gjat\u00eb nj\u00eb procesi t\u00eb ngadalt\u00eb t\u00eb pajtimit t\u00eb lidhjes p\u00ebrmes SOCKS5, mund t\u00eb ishte vendosur n\u00eb nj\u00eb vler\u00eb t\u00eb gabuar, duke \u00e7uar n\u00eb shkruarjen e emrit t\u00eb gjat\u00eb t\u00eb hostit n\u00eb tamponin e ndar\u00eb p\u00ebr ruajtje. Adresa IP<\/a> ose emri, q\u00eb nuk e kalon 255 karaktere. <\/p>\n Pronari i faqes, n\u00eb t\u00eb cil\u00ebn curl i drejtohet p\u00ebrmes SOCKS5-proxy, mund t\u00eb inicijoj\u00eb nj\u00eb mbushje t\u00eb buferrit n\u00eb an\u00ebn e klientit, duke kthyer nj\u00eb kod t\u00eb ridrejtimit t\u00eb k\u00ebrkes\u00ebs (HTTP 30x) dhe duke vendosur n\u00eb krye «Location:» nj\u00eb URL me emrin e hostit, p\u00ebrmasat e t\u00eb cilit jan\u00eb n\u00eb intervalin nga 16 deri n\u00eb 64 KB (vlera 16 KB \u00ebsht\u00eb e dikttuar nga madh\u00ebsia minimale e nevojshme p\u00ebr t\u00eb mbushur buferrin e alokuar dhe vlera 65 KB lidhet me gjat\u00ebsi maksimale t\u00eb lejuar t\u00eb emrit t\u00eb hostit n\u00eb URL). N\u00ebse n\u00eb cil\u00ebsimet e libcurl lejohet ridrejtimi i k\u00ebrkesave dhe SOCKS5-proxy i p\u00ebrdorur \u00ebsht\u00eb mjaft i ngadalsh\u00ebm, emri i gjat\u00eb i hostit do t\u00eb shkruhet n\u00eb nj\u00eb buferr t\u00eb vog\u00ebl, me p\u00ebrmasa t\u00eb caktuar m\u00eb t\u00eb vogla. <\/p>\n Vulnerabiliteti kryesisht prek aplikacionet q\u00eb jan\u00eb t\u00eb bazuara n\u00eb libcurl dhe shfaqet n\u00eb utilitarin curl vet\u00ebm kur p\u00ebrdoret opsioni «—limit-rate» me nj\u00eb vler\u00eb m\u00eb t\u00eb vog\u00ebl se 65541 — n\u00eb libcurl p\u00ebr default alokohet nj\u00eb buferr me p\u00ebrmasa 16 KB, nd\u00ebrsa n\u00eb utilitarin curl — 100 KB, por kjo madh\u00ebsi ndryshon n\u00eb var\u00ebsi t\u00eb vler\u00ebs s\u00eb parametrin «—limit-rate». <\/p>\n Daniel Stenberg, autori i projektit, p\u00ebrmendi se vulnerabiliteti kishte kaluar pa u v\u00ebn\u00eb re p\u00ebr 1315 dit\u00eb. Gjithashtu, u tha se 41% e vulnerabiliteteve t\u00eb m\u00ebparshme t\u00eb identifikuara n\u00eb curl ndoshta do t\u00eb ishin shmangur n\u00ebse curl do t\u00eb ishte shkruar n\u00eb nj\u00eb gjuh\u00eb q\u00eb ofron siguri n\u00eb trajtimin e memories, por rikodimi i curl n\u00eb nj\u00eb gjuh\u00eb tjet\u00ebr nuk \u00ebsht\u00eb plakuar p\u00ebr t\u00eb ardhmen e af\u00ebrt. Si masa p\u00ebr t\u00eb p\u00ebrmir\u00ebsuar sigurin\u00eb e kodit, propozohet zgjerimi i mjeteve p\u00ebr testimin e kodit dhe p\u00ebrdorimi m\u00eb aktiv i var\u00ebsive t\u00eb shkruara n\u00eb gjuh\u00eb programimi q\u00eb ofrojn\u00eb siguri n\u00eb trajtimin e memories. Gjithashtu, po shqyrtohet mund\u00ebsia e ndryshimit gradual t\u00eb pjes\u00ebve t\u00eb curl me variante t\u00eb shkruara n\u00eb gjuh\u00eb t\u00eb sigurta, si backend-i eksperimental HTTP Hyper, i realizuar n\u00eb gjuh\u00ebn Rust. \u0412 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e \u0441\u0435\u0442\u0438 curl \u0438 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0439\u0441\u044f \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 libcurl \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-38545), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0443\u0442\u0438\u043b\u0438\u0442\u044b curl \u0438\u043b\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0435\u0433\u043e libcurl, \u043a HTTPS-\u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u043f\u043e\u0434\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0432 curl […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110745","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Mbipopullimi i memories n\u00eb curl dhe libcurl, i shfaqur gjat\u00eb aksesit p\u00ebrmes SOCKS5-proxy | ProHoster","description":"N\u00eb utilitarin p\u00ebr marrjen dhe d\u00ebrgimin e t\u00eb dh\u00ebnave n\u00eb rrjet curl dhe bibliotek\u00ebn zhvillimore libcurl \u00ebsht\u00eb identifikuar nj\u00eb vulnerabilitet (CVE-2023-38545), i cili mund t\u00eb \u00e7oj\u00eb n\u00eb mbipopullim t\u00eb memories dhe potencialisht n\u00eb ekzekutim t\u00eb kodit.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/perepolnenie-bufera-v-curl-i-libcurl-proyavlyayushheesya-pri-obrashhenii-cherez-socks5-proksi","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 curl \u0438 libcurl, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0435\u0435\u0441\u044f \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 SOCKS5-\u043f\u0440\u043e\u043a\u0441\u0438 | ProHoster","og:description":"\u0412 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e \u0441\u0435\u0442\u0438 curl \u0438 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0439\u0441\u044f \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 libcurl \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-38545), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/perepolnenie-bufera-v-curl-i-libcurl-proyavlyayushheesya-pri-obrashhenii-cherez-socks5-proksi","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-11T19:10:17+00:00","article:modified_time":"2023-10-11T19:10:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"110745","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-08 20:24:09","updated":"2026-02-08 20:24:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/110745","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=110745"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/110745\/revisions"}],"predecessor-version":[{"id":157908,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/110745\/revisions\/157908"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=110745"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=110745"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=110745"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"