{"id":116725,"date":"2024-06-23T03:39:41","date_gmt":"2024-06-23T01:39:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-python-pakete-js2py-zagruzhaemogo-bolee-milliona-raz-v-mesyacz"},"modified":"2024-06-23T03:39:41","modified_gmt":"2024-06-23T01:39:41","slug":"uyazvimost-v-python-pakete-js2py-zagruzhaemogo-bolee-milliona-raz-v-mesyacz","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-python-pakete-js2py-zagruzhaemogo-bolee-milliona-raz-v-mesyacz","title":{"rendered":"Cenueshm\u00ebria n\u00eb paket\u00ebn Python Js2Py, e shkarkuar m\u00eb shum\u00eb se nj\u00eb milion her\u00eb n\u00eb muaj.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb paket\u00ebn Python Js2Py, e cila u shkarkua 1.2 milion her\u00eb gjat\u00eb muajit t\u00eb kaluar, \u00ebsht\u00eb gjetur nj\u00eb dob\u00ebsi (CVE-2024-28397), e cila lejon kalimin e izolimit t\u00eb sandbox-it dhe ekzekutimin e kodit n\u00eb sistem gjat\u00eb p\u00ebrpunimit t\u00eb t\u00eb dh\u00ebnave t\u00eb dizajnuara posa\u00e7\u00ebrisht n\u00eb JavaScript. Kjo dob\u00ebsi mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb sulmuar programet q\u00eb p\u00ebrdorin Js2Py p\u00ebr t\u00eb ekzekutuar kod JavaScript. Nj\u00eb rregullim \u00ebsht\u00eb aktualisht n\u00eb dispozicion vet\u00ebm si patch. P\u00ebr t\u00eb verifikuar mund\u00ebsin\u00eb e sulmit \u00ebsht\u00eb p\u00ebrgatitur nj\u00eb prototip i shfryt\u00ebzuesit.<\/p>\n

Paketa Js2Py zbatohet si nj\u00eb interpretor dhe p\u00ebrkthyes JavaScript, duke lejuar ekzekutimin e kodit JavaScript n\u00eb nj\u00eb ambient t\u00eb izoluar makin\u00ebn virtuale<\/a> ose p\u00ebrkthimin e JavaScript n\u00eb nj\u00eb p\u00ebrfaq\u00ebsim n\u00eb gjuh\u00ebn Python. Projekti \u00ebsht\u00eb shkruar plot\u00ebsisht n\u00eb gjuh\u00ebn Python dhe nuk p\u00ebrdor motor\u00eb t\u00eb jasht\u00ebm JavaScript. N\u00eb praktik\u00eb, \u0431\u0438\u0431\u043b\u0438oteka p\u00ebrdoret n\u00eb indekset e ndryshme t\u00eb web-it, sistemet e shkarkimit dhe analizator\u00ebt e faqeve q\u00eb mb\u00ebshtesin p\u00ebrpunimin e p\u00ebrmbajtjes t\u00eb gjeneruar nga kodi JavaScript. <\/p>\n

Nga aplikacionet q\u00eb preken nga dob\u00ebsia, jan\u00eb t\u00eb evidentuara Lightnovel Crawler (nj\u00eb mjet p\u00ebr shkarkimin e librave nga sh\u00ebrbimet online dhe ruajtjen e tyre n\u00eb formate t\u00eb ndryshme p\u00ebr lexim offline), cloudscraper (n\u00eb m\u00ebnyr\u00eb automatike kalon faqet e mbrojtura nga bot\u00ebt t\u00eb p\u00ebrdorura n\u00eb CDN Cloudflare) dhe pyLoad (menaxher i shkarkimeve q\u00eb mb\u00ebshtet p\u00ebrpunimin e faqeve t\u00eb gjeneruara n\u00eb JavaScript). Gjat\u00eb p\u00ebrpunimit n\u00eb k\u00ebto aplikacione t\u00eb p\u00ebrmbajtjes JavaScript t\u00eb dizajnuar posa\u00e7\u00ebrisht, nj\u00eb sulmues mund t\u00eb arrij\u00eb ekzekutimin e kodit arbitrar n\u00eb nivelin e sistemit.<\/p>\n

Dob\u00ebsia \u00ebsht\u00eb e pranishme n\u00eb implementimin e variabl\u00ebs globale brenda js2py, e cila lejon qasjen n\u00eb objektin Python nga kodi JavaScript q\u00eb ekzekutohet n\u00eb nj\u00eb ambient t\u00eb izoluar, pavar\u00ebsisht nga thirrja e metod\u00ebs js2py.disable_pyimport() p\u00ebr t\u00eb \u00e7aktivizuar importimin e objekteve Python. P\u00ebr t\u00eb ekzekutuar kod arbitrar n\u00eb sistem, nj\u00eb sulmues mund t\u00eb shfryt\u00ebzoj\u00eb dob\u00ebsin\u00eb p\u00ebr t\u00eb fituar akses n\u00eb objektin Popen nga moduli Python subprocess. E r\u00ebnd\u00ebsishme \u00ebsht\u00eb se ndryshimi me eliminimin e dob\u00ebsis\u00eb u d\u00ebrgua n\u00eb projektin Js2Py m\u00eb 1 mars, por pas tre muajsh e gjysm\u00eb nuk \u00ebsht\u00eb pranuar.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 Python-\u043f\u0430\u043a\u0435\u0442\u0435 Js2Py, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u043c\u0435\u0441\u044f\u0446\u0435 1.2 \u043c\u043b\u043d \u0440\u0430\u0437, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-28397), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 sandbox-\u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u043d\u0430 JavaScript. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044e\u0449\u0438\u0435 Js2Py \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f JavaScript-\u043a\u043e\u0434\u0430. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u043e\u043a\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0432\u0438\u0434\u0435 \u043f\u0430\u0442\u0447\u0430. \u0414\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0438 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-116725","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dob\u00ebsia n\u00eb paket\u00ebn Python Js2Py, e shkarkuar m\u00eb shum\u00eb se nj\u00eb milion her\u00eb n\u00eb muaj | ProHoster","description":"N\u00eb paket\u00ebn Python Js2Py, e cila u shkarkua 1.2 milion her\u00eb gjat\u00eb muajit t\u00eb kaluar, \u00ebsht\u00eb gjetur nj\u00eb dob\u00ebsi (CVE-2024-28397), e cila lejon kalimin e izolimit t\u00eb sandbox-it dhe ekzekutimin e kodit n\u00eb sistem gjat\u00eb p\u00ebrpunimit t\u00eb t\u00eb dh\u00ebnave t\u00eb dizajnuara posa\u00e7\u00ebrisht n\u00eb JavaScript. Kjo dob\u00ebsi mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb sulmuar programet q\u00eb p\u00ebrdorin Js2Py p\u00ebr t\u00eb ekzekutuar kod JavaScript. Nj\u00eb rregullim \u00ebsht\u00eb aktualisht n\u00eb dispozicion vet\u00ebm si patch. P\u00ebr t\u00eb verifikuar mund\u00ebsin\u00eb e sulmit \u00ebsht\u00eb p\u00ebrgatitur nj\u00eb prototip","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-python-pakete-js2py-zagruzhaemogo-bolee-milliona-raz-v-mesyacz","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Python-\u043f\u0430\u043a\u0435\u0442\u0435 Js2Py, \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c\u043e\u0433\u043e \u0431\u043e\u043b\u0435\u0435 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u0430 \u0440\u0430\u0437 \u0432 \u043c\u0435\u0441\u044f\u0446 | ProHoster","og:description":"\u0412 Python-\u043f\u0430\u043a\u0435\u0442\u0435 Js2Py, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u043c\u0435\u0441\u044f\u0446\u0435 1.2 \u043c\u043b\u043d \u0440\u0430\u0437, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-28397), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 sandbox-\u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u043d\u0430 JavaScript. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044e\u0449\u0438\u0435 Js2Py \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f JavaScript-\u043a\u043e\u0434\u0430. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u043e\u043a\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0432\u0438\u0434\u0435 \u043f\u0430\u0442\u0447\u0430. \u0414\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0438 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-python-pakete-js2py-zagruzhaemogo-bolee-milliona-raz-v-mesyacz","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-06-23T01:39:41+00:00","article:modified_time":"2024-06-23T01:39:41+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"116725","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 02:44:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 02:44:19","updated":"2026-01-23 02:44:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/116725","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=116725"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/116725\/revisions"}],"predecessor-version":[{"id":164216,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/116725\/revisions\/164216"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=116725"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=116725"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=116725"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}