{"id":110912,"date":"2023-10-18T09:10:25","date_gmt":"2023-10-18T07:10:25","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/desyatki-uyazvimostej-v-squid-ne-mogut-ispravit-uzhe-25-goda"},"modified":"2023-10-18T09:10:25","modified_gmt":"2023-10-18T07:10:25","slug":"desyatki-uyazvimostej-v-squid-ne-mogut-ispravit-uzhe-25-goda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/desyatki-uyazvimostej-v-squid-ne-mogut-ispravit-uzhe-25-goda","title":{"rendered":"D\u00ebshmi t\u00eb shumta n\u00eb Squid nuk mund t\u00eb rregullohen p\u00ebr pothuajse 2,5 vjet","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
M\u00eb shum\u00eb se dy vjet kan\u00eb kaluar nga momenti i zbulimit t\u00eb 35 dob\u00ebsive n\u00eb proksin e keqaudit t\u00eb Squid, dhe shumica e tyre ende nuk jan\u00eb zgjidhur, paralajm\u00ebron nj\u00eb ekspert p\u00ebr sigurin\u00eb q\u00eb e raportoi p\u00ebr her\u00eb t\u00eb par\u00eb k\u00ebt\u00eb \u00e7eshtje.<\/p>\n
N\u00eb shkurt t\u00eb vitit 2021, specialisti i siguris\u00eb Joshua Rogers kreu nj\u00eb analiz\u00eb t\u00eb Squid dhe identifikoi 55 dob\u00ebsi n\u00eb kodin e projektit.<\/p>\n
Derisa tani jan\u00eb zgjidhur vet\u00ebm 20 prej tyre. Nj\u00eb pjes\u00eb e madhe e dob\u00ebsive nuk kan\u00eb marr\u00eb ende emra CVE, q\u00eb do t\u00eb thot\u00eb se nuk ka ndonj\u00eb korrigjim apo rekomandim zyrtar p\u00ebr zgjidhjen e tyre. Rogers n\u00eb nj\u00eb let\u00ebr drejtuar komunitetit t\u00eb siguris\u00eb Openwall tha se, pas nj\u00eb pritjeje t\u00eb gjat\u00eb, vendosi t\u00eb publikoj\u00eb k\u00ebt\u00eb informacion.<\/p>\n
Rogers ka detajuar dob\u00ebsit\u00eb n\u00eb faqen e tij, duke theksuar larmishm\u00ebrin\u00eb e problemeve \u2013 p\u00ebrdorim pas lirimit (Use-After-Free), shkarkim t\u00eb memories (memory leak), helmin e kesheve (cache poisoning), d\u00ebshtimin e pohimit (assertion failure) dhe disavantazhe t\u00eb tjera n\u00eb komponente t\u00eb ndryshme. Ai gjithashtu shprehu mir\u00ebkuptim p\u00ebr ekipin e Squid, duke theksuar se shum\u00eb zhvillues t\u00eb projekteve open-source punojn\u00eb n\u00eb m\u00ebnyr\u00eb vullnetarizmi dhe nuk kan\u00eb gjithmon\u00eb mund\u00ebsi t\u00eb p\u00ebrballen shpejt me k\u00ebto probleme.<\/p>\n
D \u00ebsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb theksohet se Squid aktualisht p\u00ebrdoret n\u00eb miliona instanca n\u00eb mbar\u00eb bot\u00ebn.<\/p>\n
Rekomandimet e Rogers synojn\u00eb q\u00eb \u00e7do p\u00ebrdorues t\u00eb vler\u00ebsoj\u00eb vet\u00eb n\u00ebse Squid \u00ebsht\u00eb i p\u00ebrshtatsh\u00ebm p\u00ebr sistemin e tyre. N\u00eb t\u00eb kund\u00ebrt, p\u00ebrdoruesit mund t\u00eb p\u00ebrballen me d\u00ebshtime dhe rreziqe n\u00eb fush\u00ebn e siguris\u00eb informacionit.<\/p>\n
Ky ky\u00e7 ka kujtuar t\u00eb gjith\u00ebve r\u00ebnd\u00ebsin\u00eb e p\u00ebrdit\u00ebsimit t\u00eb rregullt dhe sigurimit t\u00eb siguris\u00eb s\u00eb softuerit. Ndryshe, si\u00e7 thekson Rogers, \"nuk do t\u00eb ket\u00eb asnj\u00eb dobi\".<\/p>\n
Ky episod shqet\u00ebsues ngrit pyetje serioze mbi sigurin\u00eb e projekteve t\u00eb hapura dhe aft\u00ebsin\u00eb e tyre p\u00ebr t'u p\u00ebrballur me fluksin e vazhduesh\u00ebm t\u00eb dob\u00ebsive t\u00eb reja.<\/p>\n
Mbete shpresa q\u00eb pjes\u00ebmarr\u00ebsit e komunitetit dhe zhvilluesit do t\u00eb marrin masa urgjente p\u00ebr t\u00eb adresuar k\u00ebt\u00eb k\u00ebrc\u00ebnim n\u00eb t\u00eb ardhmen.<\/p>\n