{"id":113646,"date":"2024-02-16T22:02:41","date_gmt":"2024-02-16T20:02:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-node-js-i-libuv"},"modified":"2024-02-16T22:02:41","modified_gmt":"2024-02-16T20:02:41","slug":"uyazvimosti-v-node-js-i-libuv","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-node-js-i-libuv","title":{"rendered":"Dob\u00ebsit\u00eb n\u00eb Node.js dhe libuv","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb dispozicion jan\u00eb l\u00ebshime korrigjuese p\u00ebr platform\u00ebn serverike Node.js 21.6.2, 20.11.1, 18.19.1, ku jan\u00eb rregulluar 8 dob\u00ebsi, prej t\u00eb cilave 4 u jan\u00eb caktuar nivel t\u00eb lart\u00eb rreziku: <\/p>\n
\n
CVE-2024-21892 \u2014 mund\u00ebsia p\u00ebr nj\u00eb p\u00ebrdorues pa privilegje t\u00eb fus\u00eb kod q\u00eb trash\u00ebgon privilegje t\u00eb zgjeruara me t\u00eb cilat ekzekutohet procesi. Kjo vulnerabilitet shkaktohet nga nj\u00eb gabim n\u00eb implementimin e p\u00ebrjashtimeve, q\u00eb lejon p\u00ebrpunimin e variablave t\u00eb mjedisit t\u00eb vendosur nga nj\u00eb p\u00ebrdorues pa privilegje gjat\u00eb procesit me privilegje t\u00eb zgjeruara. P\u00ebrjashtimi duheshin ofruar vet\u00ebm p\u00ebr autorizimet CAP_NET_BIND_SERVICE, por p\u00ebr shkak t\u00eb gabimit, ai aplikohej edhe p\u00ebr disa autorizime t\u00eb tjera (capabilities).\n
CVE-2024-22019 \u2014 sh\u00ebrbimi i refuzuar p\u00ebr shkak t\u00eb shterimit t\u00eb burimeve t\u00eb disponueshme (ngarkes\u00eb n\u00eb CPU dhe shpenzim i band\u00ebs) gjat\u00eb p\u00ebrpunimit t\u00eb k\u00ebrkesave chunked t\u00eb dizajnuara ve\u00e7an\u00ebrisht nga HTTP serveri i integruar, q\u00eb \u00e7on n\u00eb leximin e nj\u00eb sasie t\u00eb pakufizuar bajt\u00ebsh n\u00eb nj\u00eb lidhje.\n
CVE-2024-21896 \u2014 kalimi p\u00ebrtej kufijve t\u00eb direktoris\u00eb baz\u00eb n\u00eb rrug\u00ebt e skedar\u00ebve. Kjo vulnerabilitet lejon anashkalimin e normalizimit t\u00eb rrug\u00ebve t\u00eb skedar\u00ebve p\u00ebrmes path.resolve() n\u00eb rastin e kalimit t\u00eb nj\u00eb rruge duke p\u00ebrdorur klas\u00ebn Buffer. P\u00ebr t\u00eb marr\u00eb nj\u00eb rrug\u00eb t\u00eb till\u00eb pas verifikimit, thirret metoda Buffer.from(), por aplikacioni mund t\u00eb p\u00ebrdor\u00eb thirrjen Buffer.prototype.utf8Write, duke \u00e7uar n\u00eb z\u00ebvend\u00ebsimin e p\u00ebrmbajtjes pas ekzekutimit t\u00eb path.resolve() dhe krijimin e vulnerabilitetit.\n
CVE-2024-22017 \u2014 thirrja e setuid() nuk hiqte t\u00eb gjitha privilegjet. N\u00eb ve\u00e7anti, setuid() nuk ka ndikim n\u00eb operacionet io_uring, q\u00eb p\u00ebrdoren n\u00eb libuv, n\u00ebse ato jan\u00eb inicializuar para thirrjes s\u00eb setuid().\n
CVE-2023-46809 \u2014 vulnerabilitet n\u00eb API privateDecrypt(), q\u00eb lejon aplikimin e nj\u00eb sulmi Marvin p\u00ebr t\u00eb dekriptuar RSA dukeu bazuar n\u00eb matjen e koh\u00ebs s\u00eb operacioneve.\n
CVE-2024-21890 \u2014 p\u00ebrpunimi i gabuar i maskave n\u00eb parametrat \u00ab\u2014allow-fs-read\u00bb dhe \u00ab\u2014allow-fs-write\u00bb. P\u00ebr shembull, \u00ab\u2014allow-fs-read=\/home\/node\/.ssh\/*.pub\u00bb do t\u00eb \u00e7onte n\u00eb dh\u00ebnien e aksesit n\u00eb t\u00eb gjith\u00eb p\u00ebrmbajtjen e \u00ab.ssh\/\u00bb, dhe jo vet\u00ebm n\u00eb skedar\u00ebt me zgjerimin \u00ab.pub\u00bb, pasi maska \u00ab*\u00bb p\u00ebrpunoset si elementi i fundit t\u00eb rrug\u00ebs.\n