{"id":122827,"date":"2025-03-25T04:22:52","date_gmt":"2025-03-25T02:22:52","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse"},"modified":"2025-03-25T04:22:52","modified_gmt":"2025-03-25T02:22:52","slug":"uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse","title":{"rendered":"Dob\u00ebsi n\u00eb Pagure dhe OBS q\u00eb lejonin komprometimin e paketave n\u00eb depot Fedora dhe openSUSE","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>K\u00ebrkuesit e siguris\u00eb nga kompania Fenrisk zbuluan informacione mbi dob\u00ebsit\u00eb n\u00eb mjetet Pagure dhe OBS (Open Build Service), q\u00eb lejonin t\u00eb kompromentoheshin infrastrukturat e formimit t\u00eb paketave t\u00eb distribuimit Fedora dhe openSUSE. K\u00ebrkuesit demonstruan mund\u00ebsin\u00eb e kryerjes s\u00eb nj\u00eb sulmi p\u00ebr t\u00eb ekzekutuar kod t\u00eb rastit n\u00eb server\u00ebt me Pagure dhe OBS, e cila mund t\u00eb p\u00ebrdorej p\u00ebr t\u00eb futur ndryshime n\u00eb paketat n\u00eb repo t\u00eb Fedora dhe openSUSE.     <\/p>\n<p>N\u00eb platform\u00ebn Pagure, e cila p\u00ebrdoret n\u00eb Fedora p\u00ebr bashk\u00ebpunim me kodin dhe metadatat e paketave, jan\u00eb zbuluar 4 dob\u00ebsi. P\u00ebr t\u00eb shfryt\u00ebzuar k\u00ebto probleme \u00ebsht\u00eb e nevojshme t\u00eb ken\u00eb nj\u00eb llogari n\u00eb sh\u00ebrbimin Pagure, q\u00eb mund ta marr\u00eb \u00e7dokush (aktualisht n\u00eb Pagure.io jan\u00eb regjistruar 24899 p\u00ebrdorues). Tre probleme lejojn\u00eb t\u00eb lexohen skedar\u00ebt n\u00eb sistem, nd\u00ebrsa nj\u00eb problem lejon ekzekutimin e kodit t\u00eb tyre n\u00eb <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sq\/server\/dts-newyork\/\"   title=\"server\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2806\">server<\/a>. Problemet jan\u00eb zbuluar m\u00eb 1 janar 2024, jan\u00eb raportuar n\u00ebp\u00ebrmjet bugzilla.redhat.com m\u00eb 25 prill 2024 dhe jan\u00eb zgjidhur n\u00eb Pagure brenda 3 or\u00ebsh.    <\/p>\n<ul>\n<li class=\"l\"> Dob\u00ebsit\u00eb CVE-2024-4981 dhe CVE-2024-47515 shkaktohen nga p\u00ebrpunimi i gabuar i lidhjeve simbolike n\u00eb funksionet e p\u00ebrdit\u00ebsimit t\u00eb skedar\u00ebve dhe krijimit t\u00eb arkivave. Dob\u00ebsit\u00eb lejojn\u00eb t\u00eb lexohen p\u00ebrmbajtjet e skedar\u00ebve lokal\u00eb n\u00eb server, p\u00ebr shembull, mund t\u00eb zbulohet p\u00ebrmbajtja e skedarit me parametrat e sesionit t\u00eb administratorit t\u00eb Pagure dhe t\u00eb arrihet akses n\u00eb t\u00eb drejtat e tij. Shfryt\u00ebzimi i dob\u00ebsis\u00eb n\u00eb funksionin _update_file_in_git() konsiston n\u00eb krijimin e nj\u00eb repozitori n\u00eb Pagure; shtimin e nj\u00eb komiti me nj\u00eb skedar t\u00eb ri, i cili \u00ebsht\u00eb krijuar si nj\u00eb lidhje simbolike n\u00eb skedarin e d\u00ebshiruar t\u00eb sistemit; hapjen e k\u00ebtij skedari p\u00ebr editim n\u00eb web-interface.\n<li class=\"l\"> Vulnerabiliteti (CVE-2024-4982) n\u00eb funksionin view_issue_raw_file() lejon daljen jasht\u00eb katalogut baz\u00eb p\u00ebrmes specifikimit t\u00eb simboleve \u00ab\/..\u00bb n\u00eb parametrat e k\u00ebrkuar t\u00eb Issue. Problemi lejon leximin e skedar\u00ebve n\u00eb sistem, aq sa lejojn\u00eb t\u00eb drejtat e aksesit t\u00eb procesit n\u00ebn t\u00eb cilin ekzekutohet nd\u00ebrfaqja web. P\u00ebr shembull, p\u00ebr t\u00eb par\u00eb skedarin \/etc\/passwd mund t\u00eb hapni faqen \u00abhttp:\/\/pagure.local:5000\/your-repository\/issue\/raw\/....\/....\/....\/....\/....\/....\/....\/etc\/passwd\u00bb.\n<li class=\"l\"> Vulnerabiliteti (CVE-2024-47516) n\u00eb funksionin PagureRepo.log() ofron mund\u00ebsin\u00eb p\u00ebr t\u00eb arritur n\u00eb futjen e komandave t\u00eb tyre dhe ekzekutimin e kodit n\u00eb server. Problemi \u00ebsht\u00eb shkaktuar nga fakti se gjat\u00eb shikimit t\u00eb historis\u00eb s\u00eb ndryshimit t\u00eb skedarit p\u00ebrmes nd\u00ebrfaqes web, ekzekutohet komanda \u00abgit\u00bb me kalimin e identifikuesit t\u00eb deg\u00ebs n\u00eb komand\u00ebn e linj\u00ebs (p.sh., \u00ab\/usr\/bin\/git --pretty=oneline --abbrev-commit  -- README.md\u00bb). Sakt\u00ebsia e identifikuesit nuk kontrollohet, prandaj \u00ebsht\u00eb e mundur t\u00eb kaloni n\u00eb vend t\u00eb tij \u00e7do opsion t\u00eb komand\u00ebs, p.sh., \u00ab--output=\/tmp\/foo.bar\u00bb p\u00ebr t\u00eb ridrejtuar daljen n\u00eb nj\u00eb skedar. Sulmuesi mund t\u00eb tejkaloj\u00eb skedarin n\u00eb sistem p\u00ebrmes d\u00ebrgimit t\u00eb nj\u00eb k\u00ebrkese t\u00eb k\u00ebtij lloji: http:\/\/pagure.local:5000\/test\/history\/README.md?identifier=--output=\/tmp\/foo.bar.\n<p>Pagure ekzekutohet n\u00ebn p\u00ebrdoruesin git, prandaj mund t\u00eb tejkalohen vet\u00ebm skedar\u00ebt e k\u00ebtij p\u00ebrdoruesi. P\u00ebr t\u00eb organizuar ekzekutimin e kodit t\u00eb tij n\u00eb server, mund t\u00eb p\u00ebrdor\u00eb sh\u00ebrbimin p\u00ebr qasje n\u00eb repo p\u00ebrmes SSH, ku gjat\u00eb k\u00ebrkes\u00ebs ekzekutohet komanda \u00abbash -c \/usr\/libexec\/pagure\/aclchecker.py\u00bb. Sulmuesi mund t\u00eb shfryt\u00ebzoj\u00eb vulnerabilitetin p\u00ebr t\u00eb tejkaluar skedarin \u00ab\/srv\/git\/.bashrc\u00bb dhe ky skedar do t\u00eb ekzekutohet nga interpretuese komandash bash gjat\u00eb qasjes n\u00eb repo p\u00ebrmes ssh.      <\/p>\n<p>Sulmi p\u00ebrfshin regjistrimin n\u00eb sistemin Pagure, krijimin e nj\u00eb repo, shtimin e skedarit README.md n\u00eb repo me nj\u00eb sh\u00ebnim commit t\u00eb tilla si \u00ab|| \/bin\/bash\u00bb dhe d\u00ebrgimin e nj\u00eb k\u00ebrkese \u00abhttp:\/\/pagure.local:5000\/test\/history\/README.md?identifier=--output=\/srv\/git\/.bashrc\u00bb. Gjat\u00eb k\u00ebtyre hapave, n\u00eb skedarin \u00ab\/srv\/git\/.bashrc\u00bb do t\u00eb shkruhet nj\u00eb linj\u00eb t\u00eb tilla si \u00ab34a5c43 || \/bin\/bash\u00bb. P\u00ebr t\u00eb aktivizuar skedarin e krijuar \u00ab\/srv\/git\/.bashrc\u00bb, mjafton t\u00eb lidheni me repo p\u00ebrmes SSH me llogarin\u00eb tuaj. Ekzekutimi i kodit me t\u00eb drejtat e p\u00ebrdoruesit git n\u00eb serverin Pagure lejon kontrollin e t\u00eb gjith\u00eb p\u00ebrmbajtjes s\u00eb repo-ve me paketa.    <\/ul>\n<p>    <center><iframe title=\"Pagure\" src=\"https:\/\/player.vimeo.com\/video\/1066145210?h=0716980f9b\" width=\"640\" height=\"360\" frameborder=\"0\" allowfullscreen style =\"max-width: 100%;\" loading=\"lazy\"><\/iframe><\/center>        <\/p>\n<p>N\u00eb platform\u00ebn OBS (Open Build Service), e cila p\u00ebrdoret n\u00eb openSUSE dhe disa distribuera t\u00eb tjera p\u00ebr nd\u00ebrtimin e paketave, \u00ebsht\u00eb identifikuar nj\u00eb vulnerabilitet (CVE-2024-22033) q\u00eb lejon ekzekutimin e kodit t\u00eb vet n\u00eb server. Vulnerabiliteti u identifikua m\u00eb 27 qershor 2024, u njoftua projektit openSUSE m\u00eb 29 qershor dhe u rregullua m\u00eb 10 korrik.    <\/p>\n<p>Vulnerabiliteti \u00ebsht\u00eb i pranish\u00ebm n\u00eb sh\u00ebrbimin &#171;obs-service-download_url&#187;, ku mungonte kontrolli i duhur i URL-s\u00eb q\u00eb p\u00ebrdorej gjat\u00eb ekzekutimit t\u00eb utilitarit wget nga skripti q\u00eb shkarkon kodin burimor n\u00eb OBS. Nj\u00eb sulmues mund t\u00eb specifikoj\u00eb n\u00eb sh\u00ebrbimin OBS konfigurimin e paket\u00ebs q\u00eb krijohet, ku n\u00eb vend t\u00eb URL-s\u00eb p\u00ebr shkarkimin e kodit do t\u00eb ishte specifikuar opsioni i linj\u00ebs s\u00eb komand\u00ebs p\u00ebr wget, p\u00ebr shembull:       &lt;services&gt;     &lt;service name=&#187;download_url&#187;&gt;     &lt;param name=&#187;url&#187;&gt;&#8212;output-document=\\\/tmp\\\/test&lt;\\\/param&gt;     &lt;param name=&#187;download-manifest&#187;&gt;tempfile&lt;\\\/param&gt;     &lt;\\\/service&gt;     &lt;\\\/services&gt;      <\/p>\n<p> P\u00ebr t\u00eb anashkaluar kthimin e gabimit gjat\u00eb p\u00ebrpjekjes p\u00ebr t\u00eb ekzekutuar wget pa URL, n\u00eb shembullin \u00ebsht\u00eb specifikuar opsioni &#171;download-manifest&#187;, q\u00eb lejon t\u00eb shkruhet nj\u00eb list\u00eb URL n\u00eb nj\u00eb skedar t\u00eb ve\u00e7ant\u00eb. Shembulli i m\u00ebsip\u00ebrm do t\u00eb \u00e7oj\u00eb n\u00eb ekzekutimin e komand\u00ebs:       \\\/usr\\\/bin\\\/wget -i \\\/srv\\\/obs\\\/service\\\/XXXXX\\\/src\\\/tempfile -4 &#8212;output-document=\\\/tmp\\\/test    <\/p>\n<p>i cili lejon t\u00eb regjistroj\u00eb n\u00eb skedarin \\\/tmp\\\/test p\u00ebrmbajtjen e shkarkuar nga lidhja q\u00eb \u00ebsht\u00eb shkruar n\u00eb skedarin \\\/srv\\\/obs\\\/service\\\/XXXXX\\\/src\\\/tempfile nga kodi q\u00eb \u00ebsht\u00eb shkarkuar nga sulmuesi n\u00eb OBS p\u00ebrmes nd\u00ebrfaqes build.opensuse.org, q\u00eb lejon regjistrim t\u00eb lir\u00eb. P\u00ebrve\u00e7 rimerit t\u00eb skedarit n\u00eb server, sulmuesi gjithashtu mund t\u00eb d\u00ebrgoj\u00eb \u00e7do skedar p\u00ebr vete duke specifikuar n\u00eb vend t\u00eb &#171;&#8212;output-document&#187; opsionin &#171;&#8212;post-file&#187;, p\u00ebr shembull, &#171;&#8212;post-file=\\\/etc\\\/passwd&#187;. K\u00ebshtu, sulmuesi mund t\u00eb lexoj\u00eb dhe t\u00eb regjistroj\u00eb skedar\u00eb n\u00eb server, sa i lejojn\u00eb t\u00eb drejtat e aksesit n\u00ebn t\u00eb cilat ekzekutohet sh\u00ebrbimi OBS.    <\/p>\n<p>P\u00ebr t\u00eb transformuar mund\u00ebsin\u00eb e regjistrimit n\u00eb skedar n\u00eb ekzekutimin e kodit n\u00eb server, hulumtuesit propozuan nj\u00eb metod\u00eb q\u00eb p\u00ebrb\u00ebhet nga dy faza. Dy faza jan\u00eb t\u00eb nevojshme, pasi sulmuesi mund t\u00eb krijoj\u00eb nj\u00eb skedar &#171;.wgetrc&#187; me konfigurime p\u00ebr wget, por kjo nuk \u00ebsht\u00eb e mjaftueshme p\u00ebr t\u00eb ekzekutuar komandat. Megjithat\u00eb, p\u00ebrmes &#171;.wgetrc&#187; mund t\u00eb krijohen kushte p\u00ebr ekzekutimin e \u00e7do programi n\u00eb sistem, por pa i kaluar atij argumente. P\u00ebr t\u00eb ekzekutuar kodin arbitrar, \u00ebsht\u00eb propozuar q\u00eb t\u00eb ekzekutohet programi &#171;prove&#187;, i cili p\u00ebrpunon skedarin e konfigurimit &#171;.proverc&#187;, q\u00eb lejon specifikimin e opsionit &#171;&#8212;exec&#187; p\u00ebr t\u00eb ekzekutuar \u00e7do kod.     <\/p>\n<p>N\u00eb faz\u00ebn e par\u00eb, p\u00ebrmes manipulimeve t\u00eb p\u00ebrmendura m\u00eb sip\u00ebr me &#171;download-manifest&#187;, n\u00eb katalogun e sht\u00ebpis\u00eb s\u00eb p\u00ebrdoruesit &#171;obsservicerun&#187; krijohet nj\u00eb skedar &#171;.proverc&#187;, q\u00eb p\u00ebrfshin komandat q\u00eb do t\u00eb ekzekutohen gjat\u00eb nisjes s\u00eb procesit &#171;prove&#187;. N\u00eb faz\u00ebn e dyt\u00eb krijohet skedari .wgetrc&#187; me parametrin &#171;use-askpass=\\usr\\bin\\prove&#187;, i cili, rezulton n\u00eb thirrjen e &#171;prove&#187;. Pas shfaqjes s\u00eb k\u00ebtyre skedar\u00ebve, \u00ebsht\u00eb mjaft t\u00eb krijohen kushte p\u00ebr shkarkimin e \u00e7do lloj t\u00eb dh\u00ebne p\u00ebrmes wget dhe kjo do t\u00eb \u00e7oj\u00eb n\u00eb nisjen e kodit t\u00eb sulmuesit n\u00eb server me t\u00eb drejtat e p\u00ebrdoruesit &#171;obsservicerun&#187;. T\u00eb drejtat e p\u00ebrdoruesit &#171;obsservicerun&#187; jan\u00eb t\u00eb mjaftueshme p\u00ebr t\u00eb nxjerr\u00eb nga repositor\u00ebt \u00e7el\u00ebsat q\u00eb p\u00ebrdoren nga p\u00ebrdoruesit e OBS p\u00ebr t\u00eb certifikuar paketat.     <center>  <iframe title=\"Open Build Service\" src=\"https:\/\/player.vimeo.com\/video\/1066093605?h=d7a210d719\" width=\"640\" height=\"360\" frameborder=\"0\" allowfullscreen style =\"max-width: 100%;\" loading=\"lazy\"><\/iframe><\/center>    <\/p>\n<p>Shtes\u00eb: Ekipi i Siguris\u00eb s\u00eb Produkteve n\u00eb SUSE beson se rreziku nga dob\u00ebsia n\u00eb OBS \u00ebsht\u00eb i ekzagjeruar dhe deklarata e k\u00ebrkuesve se problemi lejon t\u00eb kompromentohen t\u00eb gjitha paketat n\u00eb distribucionin openSUSE nuk \u00ebsht\u00eb e sakt\u00eb. \u00cbsht\u00eb e v\u00ebrejtur se sh\u00ebrbimet n\u00eb infrastruktur\u00ebn build.opensuse.org ekzekutohen duke p\u00ebrdorur kontejner\u00eb t\u00eb izoluar, t\u00eb rinj-krijuar dhe t\u00eb cil\u00ebt nuk p\u00ebrmbajn\u00eb informacione kritike. Dob\u00ebsia e zbuluar \u00ebsht\u00eb vler\u00ebsuar si e rrezikshme, por jo e mjaftueshme p\u00ebr t\u00eb kompromentuar infrastruktur\u00ebn e nd\u00ebrtimit t\u00eb openSUSE dhe pakot e formuara. P\u00ebr m\u00eb tep\u00ebr, \u00ebsht\u00eb theksuar se veprimet n\u00eb nd\u00ebrfaqen OBS, t\u00eb p\u00ebrshkruara n\u00eb shembullin e sulmit, mund t\u00eb ishin kryer vet\u00ebm n\u00eb variantin OBS, i instaluar lokal n\u00eb stacionin e pun\u00ebs t\u00eb zhvilluesit.<br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=62928\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Fenrisk \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 Pagure \u0438 OBS (Open Build Service), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0445 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 Fedora \u0438 openSUSE. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0441 Pagure \u0438 OBS, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 Fedora \u0438 openSUSE. [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-122827","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Fenrisk \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 Pagure \u0438 OBS (Open Build Service), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0445 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Pagure \u0438 OBS, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u0432\u0448\u0438\u0435 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 Fedora \u0438 openSUSE | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Fenrisk \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 Pagure \u0438 OBS (Open Build Service), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0445 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-03-25T02:22:52+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2025-03-25T02:22:52+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dob\u00ebsit\u00eb n\u00eb Pagure dhe OBS, q\u00eb lejonin kompromentimin e pakove n\u00eb repositor\u00ebt Fedora dhe openSUSE | ProHoster","description":"K\u00ebrkuesit e siguris\u00eb nga kompania Fenrisk zbuluan informacion rreth dob\u00ebsive n\u00eb mjetet Pagure dhe OBS (Open Build Service), t\u00eb cilat lejonin t\u00eb kompromentoheshin infrastrukturat e nd\u00ebrtimit t\u00eb paketave t\u00eb distribucioneve.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Pagure \u0438 OBS, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u0432\u0448\u0438\u0435 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 Fedora \u0438 openSUSE | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Fenrisk \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 Pagure \u0438 OBS (Open Build Service), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0445 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-03-25T02:22:52+00:00","article:modified_time":"2025-03-25T02:22:52+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"122827","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:07:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 11:32:22","updated":"2026-02-09 22:07:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/122827","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=122827"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/122827\/revisions"}],"predecessor-version":[{"id":160086,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/122827\/revisions\/160086"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=122827"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=122827"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=122827"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}