{"id":112853,"date":"2024-01-12T15:10:23","date_gmt":"2024-01-12T13:10:23","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-gitlab-pozvolyayushhie-zahvatit-uchyotnuyu-zapis-i-vypolnit-komandy-pod-drugim-polzovatelem"},"modified":"2024-01-12T15:10:23","modified_gmt":"2024-01-12T13:10:23","slug":"uyazvimosti-v-gitlab-pozvolyayushhie-zahvatit-uchyotnuyu-zapis-i-vypolnit-komandy-pod-drugim-polzovatelem","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-gitlab-pozvolyayushhie-zahvatit-uchyotnuyu-zapis-i-vypolnit-komandy-pod-drugim-polzovatelem","title":{"rendered":"Dob\u00ebsi n\u00eb GitLab q\u00eb lejojn\u00eb marrjen e llogaris\u00eb dhe ekzekutimin e komandave si nj\u00eb p\u00ebrdorues tjet\u00ebr","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Jan\u00eb publikuar p\u00ebrdit\u00ebsime korrigjuese p\u00ebr platform\u00ebn e bashk\u00ebpunimit n\u00eb zhvillim \u2014 GitLab 16.7.2, 16.6.4 dhe 16.5.6, ku jan\u00eb zgjidhur dy vulnerabilitete kritike. Vulnerabiliteti i par\u00eb (CVE-2023-7028), i caktuar me nivelin maksimal t\u00eb rrezikut (10 nga 10), lejon kapjen e llogaris\u00eb s\u00eb huaj p\u00ebrmes manipulimeve me formularin e rikuperimit t\u00eb fjal\u00ebkalimit t\u00eb harruar. Ky vulnerabilitet shkaktohet nga mund\u00ebsia e d\u00ebrgimit t\u00eb nj\u00eb email-i me kodin p\u00ebr rivendosjen e fjal\u00ebkalimit n\u00eb adresat e email-it t\u00eb pa konfirmuara. Problemi shfaqet q\u00eb nga versioni GitLab 16.1.0, n\u00eb t\u00eb cilin \u00ebsht\u00eb e mundur d\u00ebrgimi i kodit t\u00eb rikuperimit t\u00eb fjal\u00ebkalimit n\u00eb nj\u00eb adres\u00eb email-i t\u00eb pav\u00ebrtetuar. <\/p>\n
P\u00ebr verifikimin e faktit t\u00eb komprometimit t\u00eb sistemeve, sugjerohet t\u00eb shqyrtohet n\u00eb regjistrin gitlab-rails\/production_json.log pranin\u00eb e k\u00ebrkesave HTTP drejt trajtuesit \/users\/password me nj\u00eb array t\u00eb disa email-eve n\u00eb parametrin \"params.value.email\". Gjithashtu, sugjerohet t\u00eb kontrollohet n\u00eb regjistrin gitlab-rails\/audit_json.log pranin\u00eb e sh\u00ebnimeve me vler\u00ebn PasswordsController#create n\u00eb meta.caller.id dhe p\u00ebrfshirjen e nj\u00eb array t\u00eb disa adresave n\u00eb bllokun target_details. Sulmi nuk mund t\u00eb realizohet deri n\u00eb fund n\u00ebse p\u00ebrdoruesi ka aktivizuar autentifikimin me dy faktor\u00eb. <\/p>\n
Vulnerabiliteti i dyt\u00eb CVE-2023-5356 \u00ebsht\u00eb i pranish\u00ebm n\u00eb kodin p\u00ebr integrimin me sh\u00ebrbimet Slack dhe Mattermost, dhe lejon ekzekutimin e komandave \/- n\u00eb em\u00ebr t\u00eb nj\u00eb p\u00ebrdoruesi tjet\u00ebr p\u00ebr shkak t\u00eb munges\u00ebs s\u00eb nj\u00eb verifikimi t\u00eb p\u00ebrshtatsh\u00ebm t\u00eb autorizimit. Problemi i \u00ebsht\u00eb dh\u00ebn\u00eb nj\u00eb nivel rrezikshm\u00ebrie 9.6 nga 10. N\u00eb versionet e reja \u00ebsht\u00eb eliminuar gjithashtu nj\u00eb vulnerabilitet m\u00eb pak t\u00eb rreziksh\u00ebm (7.6 nga 10) (CVE-2023-4812), q\u00eb lejon kalimin e konfirmimit t\u00eb CODEOWNERS p\u00ebrmes shtimit t\u00eb ndryshimeve n\u00eb nj\u00eb k\u00ebrkes\u00eb p\u00ebr bashkimin e miratuar m\u00eb par\u00eb. <\/p>\n
Informacione m\u00eb t\u00eb detajuara n\u00eb lidhje me vulnerabilitetet e identifikuara planifikohet t\u00eb publikohen pas 30 dit\u00ebsh nga publikimi i korrigjimit. Informacioni p\u00ebr vulnerabilitetet \u00ebsht\u00eb d\u00ebrguar n\u00eb GitLab n\u00eb kuad\u00ebr t\u00eb programit t\u00eb shp\u00ebrblimeve p\u00ebr zbulesat e vulnerabiliteteve, q\u00eb \u00ebsht\u00eb n\u00eb fuqi n\u00eb HackerOne. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"