{"id":122827,"date":"2025-03-25T04:22:52","date_gmt":"2025-03-25T02:22:52","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse"},"modified":"2025-03-25T04:22:52","modified_gmt":"2025-03-25T02:22:52","slug":"uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse","title":{"rendered":"Vulnerabilitetet n\u00eb Pagure dhe OBS, t\u00eb cilat mund\u00ebsuan komprometimin e paketave n\u00eb depozit\u00eb t\u00eb Fedora dhe openSUSE.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>K\u00ebrkuesit e siguris\u00eb nga kompania Fenrisk zbuluan informacion mbi dob\u00ebsit\u00eb n\u00eb veglat Pagure dhe OBS (Open Build Service), t\u00eb cilat lejuan kompromentimin e infrastruktur\u00ebs p\u00ebr nd\u00ebrtimin e paketave t\u00eb distribuimeve Fedora dhe openSUSE. K\u00ebrkuesit demonstruan mund\u00ebsin\u00eb e realizimit t\u00eb nj\u00eb sulmi p\u00ebr t\u00eb ekzekutuar kod t\u00eb rast\u00ebsish\u00ebm n\u00eb server\u00ebt me Pagure dhe OBS, gj\u00eb q\u00eb mund t\u00eb p\u00ebrdorej p\u00ebr t\u00eb vendosur ndryshime n\u00eb paketa n\u00eb depozit\u00eb t\u00eb Fedora dhe openSUSE.     <\/p>\n<p>N\u00eb platform\u00ebn Pagure, e p\u00ebrdorur n\u00eb Fedora p\u00ebr bashk\u00ebpunim me kodin dhe metadatat e paketave, jan\u00eb zbuluar 4 dob\u00ebsi. P\u00ebr t\u00eb shfryt\u00ebzuar k\u00ebto probleme, nevojitet t\u00eb ket\u00eb nj\u00eb llogari n\u00eb sh\u00ebrbimin Pagure, t\u00eb cilin mund ta marr\u00eb \u00e7do d\u00ebshiron (aktualisht n\u00eb Pagure.io jan\u00eb regjistruar 24899 p\u00ebrdorues). Tre nga problemet lejojn\u00eb leximin e skedareve n\u00eb sistem, nd\u00ebrsa nj\u00eb problem lejon ekzekutimin e kodeve t\u00eb veta n\u00eb. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sq\/server\/dts-newyork\/\"   title=\"serveri\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2806\">serveri<\/a>. Problemet jan\u00eb identifikuar m\u00eb 1 janar 2024, raportuar n\u00ebp\u00ebrmjet bugzilla.redhat.com m\u00eb 25 prill 2024 dhe adresuar n\u00eb Pagure brenda 3 or\u00ebve.    <\/p>\n<ul>\n<li class=\"l\"> Dob\u00ebsit\u00eb CVE-2024-4981 dhe CVE-2024-47515 shkaktohen nga p\u00ebrpunimi i pap\u00ebrshtatsh\u00ebm i lidhjeve simbolike n\u00eb funksionet e p\u00ebrdit\u00ebsimit t\u00eb skedarit dhe gjenerimit t\u00eb arkivave. Dob\u00ebsit\u00eb lejojn\u00eb leximin e p\u00ebrmbajtjes s\u00eb skedareve lokale n\u00eb server, p\u00ebr shembull, \u00ebsht\u00eb e mundur t\u00eb dihet p\u00ebrmbajtja e skedarit me parametrat e sesionit t\u00eb administratorit n\u00eb Pagure dhe t\u00eb merret qasje me t\u00eb drejtat e tij. Shfryt\u00ebzimi i dob\u00ebsis\u00eb n\u00eb funksionin _update_file_in_git() p\u00ebrfshin krijimin e nj\u00eb depoje n\u00eb Pagure; shtimin e nj\u00eb komiti me nj\u00eb skedar t\u00eb ri, i cili \u00ebsht\u00eb krijuar si lidhje simbolike me skedarin e d\u00ebshiruar t\u00eb sistemit; hapjen e k\u00ebtij skedari p\u00ebr editim n\u00eb nd\u00ebrfaqen web.\n<li class=\"l\"> Dob\u00ebsia (CVE-2024-4982) n\u00eb funksionin view_issue_raw_file() lejon daljen p\u00ebrtej katalogut baz\u00eb p\u00ebrmes caktimit t\u00eb shenjave \u00ab\/..\u00bb n\u00eb parametrat e \u00e7\u00ebshtjes s\u00eb k\u00ebrkuar. Problemi lejon leximin e skedareve n\u00eb sistem, n\u00eb p\u00ebrputhje me t\u00eb drejtat e aksesit t\u00eb procesit n\u00ebn t\u00eb cilin ekzekutohet nd\u00ebrfaqja web. P\u00ebr shembull, p\u00ebr t\u00eb par\u00eb skedarin \/etc\/passwd mund t\u00eb hapet faqja \u00abhttp:\/\/pagure.local:5000\/your-repository\/issue\/raw\/....\/....\/....\/....\/....\/....\/....\/etc\/passwd\u00bb.\n<li class=\"l\"> Dob\u00ebsia (CVE-2024-47516) n\u00eb funksionin PagureRepo.log(), ofron mund\u00ebsin\u00eb p\u00ebr t\u00eb vendosur komandat e tij dhe p\u00ebr t\u00eb ekzekutuar kod n\u00eb server. Problemi \u00ebsht\u00eb shkaktuar nga fakti q\u00eb gjat\u00eb shikimit t\u00eb historikut t\u00eb ndryshimit t\u00eb skedarit n\u00ebp\u00ebrmjet nd\u00ebrfaqes web, thirret komanda \u00abgit\u00bb me kalimin e identifikatorit t\u00eb deg\u00ebs n\u00eb linj\u00ebn e komand\u00ebs (p\u00ebr shembull, \u00ab\/usr\/bin\/git --pretty=oneline --abbrev-commit  -- README.md\u00bb). Korrigjimi i identifikatorit nuk kontrollohet, k\u00ebshtu q\u00eb mund t\u00eb kaloni \u00e7do opsion t\u00eb linj\u00ebs s\u00eb komand\u00ebs n\u00eb vend t\u00eb tij, p\u00ebr shembull, \u00ab--output=\/tmp\/foo.bar\u00bb p\u00ebr t\u00eb ridrejtuar daljen n\u00eb nj\u00eb skedar. Aggresori mund t\u00eb tejkaloj\u00eb skedarin n\u00eb sistem duke d\u00ebrguar nj\u00eb k\u00ebrkes\u00eb si kjo: http:\/\/pagure.local:5000\/test\/history\/README.md?identifier=--output=\/tmp\/foo.bar.\n<p>Pagure ekzekutohet n\u00ebn p\u00ebrdoruesin git, prandaj do t\u00eb mund t\u00eb tekej vet\u00ebm skedar\u00ebt e k\u00ebtij p\u00ebrdoruesi. P\u00ebr t\u00eb organizuar ekzekutimin e kodit t\u00eb tij n\u00eb server, mund t\u00eb p\u00ebrdorni sh\u00ebrbimin p\u00ebr qasje n\u00eb depo n\u00ebp\u00ebrmjet SSH, kurse gjat\u00eb aksesit ekzekutohet komanda \u00abbash -c \/usr\/libexec\/pagure\/aclchecker.py\u00bb. Aggresori mund ta shfryt\u00ebzoj\u00eb dob\u00ebsin\u00eb p\u00ebr t\u00eb tejkaluar skedarin \u00ab\/srv\/git\/.bashrc\u00bb dhe ky skedar do t\u00eb executehet nga interpreti i komandave bash gjat\u00eb qasjes n\u00eb depo p\u00ebrmes SSH.      <\/p>\n<p>Sulmi p\u00ebrfshin regjistrimin n\u00eb sistemin Pagure, krijimin e nj\u00eb depoje, shtimin n\u00eb depo t\u00eb skedarit README.md me nj\u00eb sh\u00ebnim komiti t\u00eb k\u00ebsaj natyre \u00ab|| \/bin\/bash\u00bb dhe d\u00ebrgimin e k\u00ebrkes\u00ebs \u00abhttp:\/\/pagure.local:5000\/test\/history\/README.md?identifier=--output=\/srv\/git\/.bashrc\u00bb. N\u00eb k\u00ebto hapa, n\u00eb skedarin \u00ab\/srv\/git\/.bashrc\u00bb do t\u00eb shkruhet nj\u00eb linj\u00eb si \u00ab34\u04305\u044143 || \/bin\/bash\u00bb. P\u00ebr t\u00eb ekzekutuar skedarin e krijuar \u00ab\/srv\/git\/.bashrc\u00bb, mjafton t\u00eb lidheni me depo p\u00ebrmes SSH me llogarin\u00eb tuaj. Ekzekutimi i kodit me t\u00eb drejtat e p\u00ebrdoruesit git n\u00eb serverin Pagure lejon kontrollin mbi t\u00eb gjith\u00eb p\u00ebrmbajtjen e depozitave me paketa.    <\/ul>\n<p>    <center><iframe title=\"Pagure\" src=\"https:\/\/player.vimeo.com\/video\/1066145210?h=0716980f9b\" width=\"640\" height=\"360\" frameborder=\"0\" allowfullscreen style =\"max-width: 100%;\" loading=\"lazy\"><\/iframe><\/center>        <\/p>\n<p>N\u00eb platform\u00ebn OBS (Open Build Service), e p\u00ebrdorur n\u00eb openSUSE dhe disa distribuime t\u00eb tjera p\u00ebr nd\u00ebrtimin e paketave, \u00ebsht\u00eb zbuluar nj\u00eb dob\u00ebsi (CVE-2024-22033), q\u00eb lejon ekzekutimin e kodit t\u00eb tij n\u00eb server. Dob\u00ebsia \u00ebsht\u00eb zbuluar m\u00eb 27 qershor 2024, raportuar n\u00eb projektin openSUSE m\u00eb 29 qershor dhe adresuar m\u00eb 10 korrik.    <\/p>\n<p>Dob\u00ebsia ekziston n\u00eb sh\u00ebrbimin \u00abobs-service-download_url\u00bb, ku mungonte nj\u00eb verifikim i duhur t\u00eb URL-s\u00eb, e cila p\u00ebrdoret kur ekzekutohet utilitarja wget nga skripti q\u00eb realizon shkarkimin e p\u00ebrmbajtjes n\u00eb OBS. Aggresori mund t\u00eb caktosh n\u00eb sh\u00ebrbimin OBS konfigurimin e paket\u00ebs s\u00eb nd\u00ebrtuar, ku n\u00eb vend t\u00eb URL-s\u00eb p\u00ebr shkarkimin e kodit do t\u00eb caktosh nj\u00eb opsion t\u00eb komand\u00ebs p\u00ebr wget, p\u00ebr shembull:   --output-document=\/tmp\/test tempfile      <\/p>\n<p> P\u00ebr t\u00eb shmangur kthimin e nj\u00eb gabimi kur p\u00ebrpiqeni t\u00eb ekzekutoni wget pa URL-n\u00eb, n\u00eb shembullin \u00ebsht\u00eb e specifikuar opsioni \u00abdownload-manifest\u00bb, i cili lejon t\u00eb jepni nj\u00eb list\u00eb URL-sh n\u00eb nj\u00eb sked\u00eb t\u00eb ve\u00e7ant\u00eb. Shembulli m\u00eb sip\u00ebr do t\u00eb \u00e7oj\u00eb n\u00eb ekzekutimin e komand\u00ebs: \/usr\/bin\/wget -i \/srv\/obs\/service\/XXXXX\/src\/tempfile -4 --output-document=\/tmp\/test    <\/p>\n<p>i cili lejon t\u00eb shkruani n\u00eb sked\u00ebn \/tmp\/test p\u00ebrmbajtjen e ngarkuar nga lidhja e specifikuar n\u00eb sked\u00ebn \/srv\/obs\/service\/XXXXX\/src\/tempfile nga kodi i ngarkuar nga sulmuesi n\u00eb OBS p\u00ebrmes nd\u00ebrfaqes build.opensuse.org, e cila lejon regjistrim t\u00eb lir\u00eb. P\u00ebrve\u00e7 rikthimit t\u00eb sked\u00ebs n\u00eb server, sulmuesi gjithashtu mund t\u00eb d\u00ebrgoj\u00eb \u00e7do sked\u00eb p\u00ebr vete duke specifikuar n\u00eb vend t\u00eb \u00ab--output-document\u00bb opsionin \u00ab--post-file\u00bb, p\u00ebr shembull, \u00ab--post-file=\/etc\/passwd\u00bb. K\u00ebshtu, sulmuesi mund t\u00eb lexoj\u00eb dhe shkruaj\u00eb skeda n\u00eb server, n\u00eb p\u00ebrputhje me t\u00eb drejtat e aksesit t\u00eb cilat ka sh\u00ebrbimi OBS.    <\/p>\n<p>P\u00ebr t\u00eb kthyer mund\u00ebsin\u00eb e shkruarjes n\u00eb sked\u00eb n\u00eb ekzekutimin e kodit n\u00eb server, k\u00ebrkuesit sugjeruan nj\u00eb metod\u00eb t\u00eb p\u00ebrb\u00ebr\u00eb nga dy faza. T\u00eb dyja fazat jan\u00eb t\u00eb nevojshme sepse sulmuesi mund t\u00eb krijoj\u00eb nj\u00eb sked\u00eb \u00ab.wgetrc\u00bb me konfigurime p\u00ebr wget, por kjo nuk \u00ebsht\u00eb e mjaftueshme p\u00ebr t\u00eb ekzekutuar komandat. Megjithat\u00eb, p\u00ebrmes \u00ab.wgetrc\u00bb, \u00ebsht\u00eb e mundur t\u00eb krijosh kushte p\u00ebr ekzekutimin n\u00eb sistem t\u00eb \u00e7do programi, por pa i kaluar asaj argumente. P\u00ebr t\u00eb ekzekutuar kod t\u00eb rast\u00ebsish\u00ebm, \u00ebsht\u00eb propozuar t\u00eb ekzekutohet programa \u00abprove\u00bb, e cila p\u00ebrpunon sked\u00ebn e konfigurimit \u00ab.proverc\u00bb, e cila lejon specifikimin e opsionit \u00ab--exec\u00bb p\u00ebr t\u00eb ekzekutuar \u00e7do kod.     <\/p>\n<p>N\u00eb faz\u00ebn e par\u00eb, p\u00ebrmes manipulimeve t\u00eb p\u00ebrmendura m\u00eb lart me \u00abdownload-manifest\u00bb n\u00eb katalogun e p\u00ebrdoruesit \u00abobsservicerun\u00bb krijohet skeda \u00ab.proverc\u00bb, e cila p\u00ebrfshin komandat q\u00eb do t\u00eb ekzekutohen kur procesi \u00abprove\u00bb fillon. N\u00eb faz\u00ebn e dyt\u00eb, krijohet skeda \u00ab.wgetrc\u00bb me parametrin \u00abuse-askpass=\/usr\/bin\/prove\u00bb, q\u00eb \u00e7on n\u00eb thirrjen e \u00abprove\u00bb. Pas krijimit t\u00eb k\u00ebtyre skedave, mjafton t\u00eb krijoni kushte p\u00ebr ngarkimin e \u00e7do t\u00eb dh\u00ebne p\u00ebrmes wget dhe kjo do t\u00eb \u00e7oj\u00eb n\u00eb ekzekutimin e kodit t\u00eb sulmuesit n\u00eb server me t\u00eb drejtat e p\u00ebrdoruesit \u00abobsservicerun\u00bb. T\u00eb drejtat e p\u00ebrdoruesit \u00abobsservicerun\u00bb jan\u00eb t\u00eb mjaftueshme p\u00ebr t\u00eb nxjerr\u00eb \u00e7el\u00ebsat nga repository q\u00eb p\u00ebrdorin p\u00ebrdoruesit e OBS p\u00ebr t\u00eb vulosur paketat.     <center>  <iframe title=\"Open Build Service\" src=\"https:\/\/player.vimeo.com\/video\/1066093605?h=d7a210d719\" width=\"640\" height=\"360\" frameborder=\"0\" allowfullscreen style =\"max-width: 100%;\" loading=\"lazy\"><\/iframe><\/center>    <\/p>\n<p>Shtes\u00eb: Ekipi i Siguris\u00eb s\u00eb Produktit SUSE beson se rreziku i k\u00ebtij vulnerabliteti n\u00eb OBS \u00ebsht\u00eb i tepruar dhe deklarata e k\u00ebrkuesve se problemi lejon t\u00eb komprometohen t\u00eb gjitha paketat n\u00eb distribucionin openSUSE nuk \u00ebsht\u00eb e sakt\u00eb. Theksohet se sh\u00ebrbimet n\u00eb infrastruktur\u00ebn build.opensuse.org ekzekutohen duke p\u00ebrdorur konteiner\u00eb t\u00eb izoluar, t\u00eb rinovuar dhe q\u00eb nuk p\u00ebrmbajn\u00eb informacione kritike. Vulneshimi i identifikuar \u00ebsht\u00eb vler\u00ebsuar si rreziksh\u00ebm, por jo i mjaftuesh\u00ebm p\u00ebr t\u00eb komprometuar infrastruktur\u00ebn e nd\u00ebrtimit openSUSE dhe paketat e formuara. Gjithashtu, \u00ebsht\u00eb th\u00ebn\u00eb se veprimet n\u00eb nd\u00ebrfaqen OBS, t\u00eb p\u00ebrshkruara n\u00eb shembullin e sulmit, mund t\u00eb ishin realizuar vet\u00ebm n\u00eb variantin e OBS q\u00eb ishte instaluar lokal n\u00eb stacionin e pun\u00ebs s\u00eb zhvilluesit.<br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=62928\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Fenrisk \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 Pagure \u0438 OBS (Open Build Service), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0445 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 Fedora \u0438 openSUSE. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0441 Pagure \u0438 OBS, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 Fedora \u0438 openSUSE. [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-122827","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Fenrisk \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 Pagure \u0438 OBS (Open Build Service), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0445 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 Fedora \u0438 openSUSE. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0441 Pagure \u0438 OBS, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 Fedora \u0438 openSUSE.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Pagure \u0438 OBS, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u0432\u0448\u0438\u0435 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 Fedora \u0438 openSUSE | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Fenrisk \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 Pagure \u0438 OBS (Open Build Service), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0445 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 Fedora \u0438 openSUSE. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0441 Pagure \u0438 OBS, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 Fedora \u0438 openSUSE.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-03-25T02:22:52+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2025-03-25T02:22:52+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitetet n\u00eb Pagure dhe OBS q\u00eb lejonin komprometimin e paketave n\u00eb depozitat Fedora dhe openSUSE | ProHoster","description":"K\u00ebrkuesit e siguris\u00eb nga kompania Fenrisk zbuluan informacion mbi dob\u00ebsit\u00eb n\u00eb veglat Pagure dhe OBS (Open Build Service), t\u00eb cilat lejuan kompromentimin e infrastruktur\u00ebs p\u00ebr nd\u00ebrtimin e paketave t\u00eb distribuimeve Fedora dhe openSUSE. K\u00ebrkuesit demonstruan mund\u00ebsin\u00eb e realizimit t\u00eb nj\u00eb sulmi p\u00ebr t\u00eb ekzekutuar kod t\u00eb rast\u00ebsish\u00ebm n\u00eb server\u00ebt me Pagure dhe OBS, gj\u00eb q\u00eb mund t\u00eb p\u00ebrdorej p\u00ebr t\u00eb vendosur ndryshime n\u00eb paketa n\u00eb depozit\u00eb t\u00eb Fedora dhe openSUSE.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Pagure \u0438 OBS, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u0432\u0448\u0438\u0435 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 Fedora \u0438 openSUSE | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Fenrisk \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 Pagure \u0438 OBS (Open Build Service), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0445 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 Fedora \u0438 openSUSE. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0441 Pagure \u0438 OBS, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 Fedora \u0438 openSUSE.","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-03-25T02:22:52+00:00","article:modified_time":"2025-03-25T02:22:52+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"122827","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:07:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 11:32:22","updated":"2026-02-09 22:07:19"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/122827","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=122827"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/122827\/revisions"}],"predecessor-version":[{"id":160086,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/122827\/revisions\/160086"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=122827"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=122827"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=122827"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}