{"id":113130,"date":"2024-01-26T11:28:07","date_gmt":"2024-01-26T09:28:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-gitlab-pozvolyayushhaya-zapisat-fajly-v-proizvolnyj-katalog-na-servere"},"modified":"2024-01-26T11:28:07","modified_gmt":"2024-01-26T09:28:07","slug":"uyazvimost-v-gitlab-pozvolyayushhaya-zapisat-fajly-v-proizvolnyj-katalog-na-servere","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-gitlab-pozvolyayushhaya-zapisat-fajly-v-proizvolnyj-katalog-na-servere","title":{"rendered":"Dob\u00ebsi n\u00eb GitLab q\u00eb lejon shkrimin e skedar\u00ebve n\u00eb nj\u00eb direktori arbitrare n\u00eb server","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Jan\u00eb publikuar p\u00ebrmir\u00ebsime korrektuese p\u00ebr platform\u00ebn e zhvillimit t\u00eb bashk\u00ebpunimit \u2014 GitLab 16.8.1, 16.7.4, 16.6.6 dhe 16.5.8, t\u00eb cilat rregullojn\u00eb 5 vulnerabilitete. Nj\u00eb nga problemet (CVE-2024-0402), e cila shfaqet q\u00eb nga l\u00ebshimi i GitLab 16.0, i \u00ebsht\u00eb caktuar niveli kritik i rrezikshm\u00ebris\u00eb. Vulnerabiliteti lejon q\u00eb nj\u00eb p\u00ebrdorues i autentikuar t\u00eb shkruaj\u00eb skedar\u00eb n\u00eb \u00e7do katalog n\u00eb server, sa her\u00eb q\u00eb t\u00eb lejojn\u00eb t\u00eb drejtat p\u00ebrkat\u00ebse n\u00ebn t\u00eb cilat ekzekutohet nd\u00ebrfaqja web e GitLab. <\/p>\n

Cenueshm\u00ebria shkaktohet nga nj\u00eb gabim n\u00eb implementimin e funksionit p\u00ebr krijimin e hap\u00ebsirave t\u00eb pun\u00ebs (workspace). Gabimi shfaqet gjat\u00eb p\u00ebrpunimit t\u00eb parametrave devfile t\u00eb p\u00ebrcaktuar n\u00eb nj\u00eb format t\u00eb pasakt\u00eb YAML (n\u00eb patch problemi \u00ebsht\u00eb zgjidhur duke konvertuar YAML n\u00eb JSON dhe duke kontrolluar pranin\u00eb e strukturave q\u00eb jan\u00eb t\u00eb vlefshme n\u00eb YAML, por t\u00eb palejueshme n\u00eb JSON p\u00ebr shkak t\u00eb p\u00ebrdorimit t\u00eb disa simboleve Unicode). Informacioni i detajuar p\u00ebr cenueshm\u00ebrin\u00eb planifikohet t\u00eb b\u00ebhet publik 30 dit\u00eb pas publikimit t\u00eb korrigjimit. Cenueshm\u00ebria u zbulua gjat\u00eb nj\u00eb kontrolli t\u00eb brendsh\u00ebm nga nj\u00eb prej punonj\u00ebsve t\u00eb kompanis\u00eb GitLab.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 — GitLab 16.8.1, 16.7.4, 16.6.6 \u0438 16.5.8, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b 5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u041e\u0434\u043d\u043e\u0439 \u0438\u0437 \u043f\u0440\u043e\u0431\u043b\u0435\u043c (CVE-2024-0402), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 GitLab 16.0, \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0432 \u043b\u044e\u0431\u043e\u0439 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435, \u043d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u044d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043f\u0440\u0430\u0432\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u043f\u043e\u0434 \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f web-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-113130","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Cenueshm\u00ebri n\u00eb GitLab q\u00eb lejon shkrimin e skedar\u00ebve n\u00eb nj\u00eb drejtori arbitrare n\u00eb server - ProHoster","description":"Jan\u00eb publikuar p\u00ebrdit\u00ebsime korrigjuese p\u00ebr platform\u00ebn e bashk\u00ebpunimit n\u00eb zhvillim - GitLab 16.8.1, 16.7.4, 16.6.6 dhe 16.5.8, ku jan\u00eb eliminuar 5 cenueshm\u00ebri.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-gitlab-pozvolyayushhaya-zapisat-fajly-v-proizvolnyj-katalog-na-servere","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 GitLab, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0432 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 - GitLab 16.8.1, 16.7.4, 16.6.6 \u0438 16.5.8, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b 5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-gitlab-pozvolyayushhaya-zapisat-fajly-v-proizvolnyj-katalog-na-servere","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-01-26T09:28:07+00:00","article:modified_time":"2024-01-26T09:28:07+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/113130","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=113130"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/113130\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=113130"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=113130"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=113130"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}