{"id":122229,"date":"2025-03-15T14:22:06","date_gmt":"2025-03-15T12:22:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-biblioteke-ruby-saml-privodyashhaya-k-obhodu-autentifikaczii-v-gitlab"},"modified":"2025-03-15T14:22:06","modified_gmt":"2025-03-15T12:22:06","slug":"uyazvimost-v-biblioteke-ruby-saml-privodyashhaya-k-obhodu-autentifikaczii-v-gitlab","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-biblioteke-ruby-saml-privodyashhaya-k-obhodu-autentifikaczii-v-gitlab","title":{"rendered":"Nj\u00eb ndjeshm\u00ebri n\u00eb bibliotek\u00ebn ruby-saml, q\u00eb \u00e7on n\u00eb anashkalimin e autentikimit n\u00eb GitLab","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Jan\u00eb publikuar p\u00ebrdit\u00ebsime korrigjuese p\u00ebr platform\u00ebn e bashk\u00ebpunimit GitLab - 17.9.2, 17.8.5 dhe 17.7.7, n\u00eb t\u00eb cilat \u00ebsht\u00eb eliminuar nj\u00eb vulnerabilitet (CVE-2025-25291, CVE-2025-25292) q\u00eb lejon kalimin e autentifikimit SAML (Security Assertion Markup Language). Vulnerabiliteti \u00ebsht\u00eb prezent n\u00eb bibliotek\u00ebn Ruby ruby-saml, q\u00eb implementon funksione p\u00ebr autorizimin SAML. P\u00ebrve\u00e7 GitLab, vulnerabiliteti prek edhe projekte t\u00eb tjera q\u00eb p\u00ebrdorin k\u00ebt\u00eb bibliotek\u00eb. Problemi \u00ebsht\u00eb zgjidhur n\u00eb p\u00ebrdit\u00ebsimet ruby-saml 1.18.0 dhe 1.12.4. <\/p>\n

Vulnerabiliteti shkaktohet nga ndryshimet n\u00eb parse-imin e dokumenteve XML nga parser-a ReXML dhe Nokogiri, si rezultat, gjat\u00eb p\u00ebrpunimit t\u00eb t\u00eb nj\u00ebjtit dokument XML, krijoheshin dokumente t\u00eb ndryshme n\u00eb struktur\u00eb. Problemi \u00ebsht\u00eb se REXML dhe Nokogiri trajtojn\u00eb ndryshe n\u00ebnshkrimet dixhitale n\u00eb dokumentin XML, gj\u00eb q\u00eb mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb krijuar kushte ku gjat\u00eb verifikimit p\u00ebrdoret nj\u00eb n\u00ebnshkrim, nd\u00ebrsa gjat\u00eb akreditimit t\u00eb p\u00ebrdoruesit nj\u00eb tjet\u00ebr. Kjo mund\u00ebsi i lejon nj\u00eb sulmuesi t\u00eb p\u00ebrdor\u00eb metod\u00ebn e sulmit XSW (XML Signature Wrapping) p\u00ebr t\u00eb falsifikuar p\u00ebrgjigjen SAML p\u00ebr p\u00ebrmbajtje t\u00eb rast\u00ebsishme, duke pasur qasje n\u00eb \u00e7do dokument SAML t\u00eb n\u00ebnshkruar. <\/p>\n

Problemi u identifikua si rezultat i iniciativ\u00ebs nga kompania GitHub, e cila shqyrtonte mund\u00ebsin\u00eb e kalimit n\u00eb p\u00ebrdorimin e k\u00ebsaj biblioteke dhe p\u00ebr t\u00eb kontrolluar sigurin\u00eb organizoi nj\u00eb konkurs (Bug bounty) p\u00ebr t\u00eb thyer ambientin testues, n\u00eb t\u00eb cilin p\u00ebr autentifikimin SAML p\u00ebrdorej biblioteka ruby-saml. Nj\u00eb nga studiuesit e siguris\u00eb vuri re pranin\u00eb e k\u00ebtij vulnerabiliteti. Gjat\u00eb shqyrtimit t\u00eb problemit, nj\u00eb punonj\u00ebs i GitHub zbuloi nj\u00eb m\u00ebnyr\u00eb tjet\u00ebr sulmi t\u00eb bazuar n\u00eb t\u00eb nj\u00ebjtin princip. <\/p>\n

M\u00eb pas, mund\u00ebsia e kryerjes s\u00eb sulmit u konfirmua p\u00ebr GitLab. N\u00eb kontekstin e GitLab, vulnerabiliteti i lejon nj\u00eb sulmuesi, i cili ka qasje n\u00eb \u00e7do dokument SAML t\u00eb n\u00ebnshkruar si\u00e7 duhet, t\u00eb kaloj\u00eb autentifikimin n\u00ebn nj\u00eb p\u00ebrdorues tjet\u00ebr, pra, p\u00ebr t\u00eb kaluar autentifikimin dhe p\u00ebr t'u futur si nj\u00eb p\u00ebrdorues tjet\u00ebr, sulmuesi duhet t\u00eb ket\u00eb akses n\u00eb nj\u00eb nga llogarit\u00eb e pun\u00ebs.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 GitLab — 17.9.2, 17.8.5 \u0438 17.7.7, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-25291, CVE-2025-25292), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043d\u0430 \u0431\u0430\u0437\u0435 SAML (Security Assertion Markup Language). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Ruby-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 ruby-saml, \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u044e\u0449\u0435\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0434\u043b\u044f SAML-\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438. \u041a\u0440\u043e\u043c\u0435 GitLab \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0434\u0430\u043d\u043d\u0443\u044e \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u0445 ruby-saml 1.18.0 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-122229","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabiliteti n\u00eb bibliotek\u00ebn ruby-saml, q\u00eb \u00e7on n\u00eb kalimin e autentifikimit n\u00eb GitLab | ProHoster","description":"Jan\u00eb publikuar p\u00ebrdit\u00ebsime korrigjuese p\u00ebr platform\u00ebn e bashk\u00ebpunimit GitLab - 17.9.2, 17.8.5 dhe 17.7.7, n\u00eb t\u00eb cilat \u00ebsht\u00eb korrigjuar nj\u00eb vulnerabilitet (CVE-2025-25291, CVE-2025-25292) q\u00eb lejon kalimin e autentifikimit q\u00eb bazohet n\u00eb SAML (Security Assertion Markup Language). Vulnerabiliteti \u00ebsht\u00eb n\u00eb bibliotek\u00ebn Ruby ruby-saml, e cila zbatohet p\u00ebr funksione t\u00eb autorizimit SAML. P\u00ebrve\u00e7 GitLab, vulnerabiliteti prek edhe projekte t\u00eb tjera q\u00eb p\u00ebrdorin k\u00ebt\u00eb bibliotek\u00eb. Problemi \u00ebsht\u00eb zgjidhur n\u00eb p\u00ebrdit\u00ebsimet e ruby-saml 1.18.0.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-biblioteke-ruby-saml-privodyashhaya-k-obhodu-autentifikaczii-v-gitlab","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 ruby-saml, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043e\u0431\u0445\u043e\u0434\u0443 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 GitLab | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 GitLab - 17.9.2, 17.8.5 \u0438 17.7.7, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-25291, CVE-2025-25292), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043d\u0430 \u0431\u0430\u0437\u0435 SAML (Security Assertion Markup Language). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 Ruby-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 ruby-saml, \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u044e\u0449\u0435\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0434\u043b\u044f SAML-\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438. \u041a\u0440\u043e\u043c\u0435 GitLab \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0434\u0430\u043d\u043d\u0443\u044e \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u0445 ruby-saml 1.18.0","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-biblioteke-ruby-saml-privodyashhaya-k-obhodu-autentifikaczii-v-gitlab","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-03-15T12:22:06+00:00","article:modified_time":"2025-03-15T12:22:06+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"122229","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 11:09:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 11:09:20","updated":"2026-01-23 11:09:20"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/122229","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=122229"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/122229\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=122229"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=122229"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=122229"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}