{"id":110912,"date":"2023-10-18T09:10:25","date_gmt":"2023-10-18T07:10:25","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/desyatki-uyazvimostej-v-squid-ne-mogut-ispravit-uzhe-25-goda"},"modified":"2023-10-18T09:10:25","modified_gmt":"2023-10-18T07:10:25","slug":"desyatki-uyazvimostej-v-squid-ne-mogut-ispravit-uzhe-25-goda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/desyatki-uyazvimostej-v-squid-ne-mogut-ispravit-uzhe-25-goda","title":{"rendered":"Dhjet\u00ebra vulnerabilitete n\u00eb Squid nuk mund t\u00eb rregullohen prej 2.5 vitesh.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
M\u00eb shum\u00eb se dy vjet kan\u00eb kaluar nga zbulimi i 35 dob\u00ebsive n\u00eb proxy-n e caching-ut Squid, dhe shumica e tyre ende nuk jan\u00eb korrigjuar, paralajm\u00ebron nj\u00eb ekspert t\u00eb siguris\u00eb, i cili s\u00eb pari raportoi p\u00ebr k\u00ebto probleme.<\/p>\n
N\u00eb shkurt 2021, specialisti i siguris\u00eb Joshua Rogers b\u00ebri nj\u00eb analiz\u00eb t\u00eb Squid dhe identifikoi 55 dob\u00ebsi n\u00eb kodin e projektit.<\/p>\n
Deriko tani jan\u00eb korrigjuar vet\u00ebm 20 prej tyre. Pjesa m\u00eb e madhe e dob\u00ebsive nuk ka marr\u00eb identifikime CVE, q\u00eb do t\u00eb thot\u00eb se nuk ka ndreqje ose rekomandime zyrtare p\u00ebr ta eliminuar. Rogers, n\u00eb nj\u00eb let\u00ebr drejtuar komunitetit t\u00eb siguris\u00eb Openwall, tha se pas nj\u00eb pritje t\u00eb gjat\u00eb, ai vendosi t\u00eb publikoj\u00eb k\u00ebto informacione.<\/p>\n
Rogers detajoi dob\u00ebsit\u00eb n\u00eb faqen e tij, duke theksuar diversitetin e problemeve \u2013 p\u00ebrdorimi pas lirimit (Use-After-Free), rrjedhja e memories (memory leak), helmimi i caches (cache poisoning), d\u00ebshtimi i pretendimeve (assertion failure) dhe mang\u00ebsi t\u00eb tjera n\u00eb komponente t\u00eb ndryshme. N\u00eb k\u00ebt\u00eb kontekst, specialisti shprehu kuptimin p\u00ebr ekipin e Squid, duke theksuar se shum\u00eb zhvillues t\u00eb projekteve open-source punojn\u00eb n\u00eb baz\u00eb vullnetarizmi dhe nuk gjithmon\u00eb mund t\u00eb reagojn\u00eb shpejt ndaj k\u00ebtyre problemeve.<\/p>\n
\u00cbsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb theksohet se Squid aktualisht p\u00ebrdoret n\u00eb miliona instanca n\u00eb mbar\u00eb bot\u00ebn.<\/p>\n
Rekomandimet e Rogers n\u00ebnkuptojn\u00eb se \u00e7do p\u00ebrdorues duhet t\u00eb vler\u00ebsoj\u00eb vet\u00eb n\u00ebse Squid \u00ebsht\u00eb i p\u00ebrshtatsh\u00ebm p\u00ebr sistemin e tij. N\u00eb t\u00eb kund\u00ebrt, p\u00ebrdoruesit mund t\u00eb p\u00ebrballen me d\u00ebshtime dhe rreziqe n\u00eb fush\u00ebn e siguris\u00eb t\u00eb informacionit.<\/p>\n
Kjo situat\u00eb na kujton t\u00eb gjith\u00ebve p\u00ebr r\u00ebnd\u00ebsin\u00eb e p\u00ebrdit\u00ebsimit t\u00eb rregullt dhe sigurimin e siguris\u00eb s\u00eb programeve. N\u00eb t\u00eb kund\u00ebrt, si\u00e7 thekson Rogers, \"nuk do t\u00eb ket\u00eb asnj\u00eb dobi\".<\/p>\n
Ky episod shqet\u00ebsues ngre pyetje serioze n\u00eb lidhje me sigurin\u00eb e projekteve t\u00eb hapura dhe aft\u00ebsin\u00eb e tyre p\u00ebr t\u00eb p\u00ebrballuar nj\u00eb fluks t\u00eb vazhduesh\u00ebm t\u00eb dob\u00ebsive t\u00eb reja.<\/p>\n
Shpresojm\u00eb q\u00eb an\u00ebtar\u00ebt e komunitetit dhe zhvilluesit t\u00eb marrin masa t\u00eb menj\u00ebhershme p\u00ebr t\u00eb eliminuar k\u00ebt\u00eb k\u00ebrc\u00ebnim n\u00eb t\u00eb ardhmen.<\/p>\n