{"id":146043,"date":"2025-10-21T23:12:42","date_gmt":"2025-10-21T21:12:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-rust-bibliotekah-dlya-formata-tar-privodyashhaya-k-raspakovke-fajlov-iz-vlozhennogo-arhiva"},"modified":"2025-10-21T23:12:42","modified_gmt":"2025-10-21T21:12:43","slug":"uyazvimost-v-rust-bibliotekah-dlya-formata-tar-privodyashhaya-k-raspakovke-fajlov-iz-vlozhennogo-arhiva","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-rust-bibliotekah-dlya-formata-tar-privodyashhaya-k-raspakovke-fajlov-iz-vlozhennogo-arhiva","title":{"rendered":"Cenueshm\u00ebri n\u00eb bibliotekat Rust p\u00ebr formatin TAR, q\u00eb \u00e7on n\u00eb shpaketimin e skedar\u00ebve nga nj\u00eb arkiv i brendsh\u00ebm","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb bibliotek\u00ebn async-tar t\u00eb shkruar n\u00eb gjuh\u00ebn Rust, e cila ofron funksione p\u00ebr t\u00eb lexuar dhe shkruar arkiva tar, \u00ebsht\u00eb zbuluar nj\u00eb cenueshm\u00ebri (CVE-2025-62518, emri kodik TARmageddon), e cila lejon q\u00eb gjat\u00eb shkrirjes s\u00eb nj\u00eb arkivi tar t\u00eb dizajnuar n\u00eb m\u00ebnyr\u00eb speciale t\u00eb nxirren jo vet\u00ebm skedar\u00ebt e vendosur brenda tij, por edhe skedar\u00ebt q\u00eb ndodhen n\u00eb nj\u00eb arkiv tar t\u00eb brendsh\u00ebm. Kjo cenueshm\u00ebri mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb anashkaluar sistemet e verifikimit t\u00eb arkivave dhe p\u00ebr t\u00eb shkruar skedar\u00eb p\u00ebr t\u00eb cil\u00ebt nuk \u00ebsht\u00eb kryer kontrolli. <\/p>\n
Vulnerabiliteti shfaqet gjithashtu n\u00eb fork-\u00ebt e bibliotek\u00ebs async-tar, si tokio-tar, krata-tokio-tar dhe astral-tokio-tar, si dhe n\u00eb utilitat e bazuara n\u00eb to, p\u00ebr shembull, menaxheri i paketave uv, i zhvilluar si nj\u00eb z\u00ebvend\u00ebsim me performanc\u00eb t\u00eb lart\u00eb p\u00ebr \"pip\" p\u00ebr projektet n\u00eb gjuh\u00ebn Python. Nga projektet popullore q\u00eb p\u00ebrdorin bibliotekat e prekura, p\u00ebrmenden gjithashtu instrumentet testcontainers p\u00ebr t\u00eb ekzekutuar kontejner\u00ebt docker dhe runtime WebAssembly wasmCloud. N\u00eb depozit\u00ebn crates.is, gjat\u00eb 90 dit\u00ebve t\u00eb fundit, biblioteka async-tar ka pasur 1.3 milion shkarkime, tokio-tar - 2.2 milion, testcontainers - 2.9 milion. <\/p>\n
Vulnerabiliteti shkaktohet nga nj\u00eb zgjedhje e gabuar e pozicionit gjat\u00eb analiz\u00ebs s\u00eb vlerave t\u00eb ndryshme t\u00eb madh\u00ebsis\u00eb n\u00eb titujt ustar dhe PAX. N\u00eb arkivat tar n\u00eb formatin PAX, p\u00ebr \u00e7do file brenda arkivave p\u00ebrcaktohen dy tituj - klasik ustar dhe t\u00eb zgjeruar PAX. Problemi shkaktohet nga fakti se bibliotekat e prekura gjat\u00eb hapjes s\u00eb skedar\u00ebve, n\u00eb vend q\u00eb t\u00eb llogarisin offset-in n\u00eb baz\u00eb t\u00eb madh\u00ebsis\u00eb nga titulli i zgjeruar PAX, merrnin madh\u00ebsin\u00eb nga titulli i vjet\u00ebr ustar. Me nj\u00eb vler\u00eb zero t\u00eb madh\u00ebsis\u00eb n\u00eb titullin ustar, p\u00ebrmbajtja q\u00eb pason merrej si nj\u00eb bllok i sakt\u00eb TAR-titujsh p\u00ebr skedarin tjet\u00ebr.
<\/center>
<\/center> <\/p>\n
P\u00ebr t\u00eb kryer nj\u00eb sulm, mjafton t\u00eb krijohet nj\u00eb arkiv TAR, n\u00eb t\u00eb cilin n\u00eb ba\u015fin ustar \u00ebsht\u00eb e specifikuar nj\u00eb madh\u00ebsi zero, dhe n\u00eb ba\u015fin p\u00ebr formatin PAX, madh\u00ebsia aktuale, \u00e7ka b\u00ebn q\u00eb p\u00ebrmbajtja e skedarit me nj\u00eb arkiv tjet\u00ebr tar t\u00eb trajtohet si pjes\u00eb e arkivit kryesor. Nj\u00eb shembull kodi p\u00ebr krijimin e arkivave t\u00eb tilla \u00ebsht\u00eb publikuar n\u00eb GitHub. Cenueshm\u00ebria \u00ebsht\u00eb eliminuar n\u00eb l\u00ebshimet tokio-tar 0.5.6 dhe uv 0.9.5. P\u00ebr bibliotekat e tjera, rregullimet ende nuk jan\u00eb publikuar, por p\u00ebr astral-tokio-tar, async-tar dhe krata-tokio-tar jan\u00eb p\u00ebrgatitur patch-e ve\u00e7an\u00ebrisht. <\/p>\n
Vulnerabilitetet n\u00eb bibliotekat jan\u00eb vler\u00ebsuar me nivel rreziku 8.1 nga 10, pasi problemi mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb riparuar skedar\u00ebt e shkarkuesh\u00ebm (n\u00eb implementimet e cenueshme do t\u00eb shkarkohen skedar\u00eb t\u00eb ndrysh\u00ebm nga ata q\u00eb ishin t\u00eb duksh\u00ebm n\u00eb arkiv). N\u00eb k\u00ebt\u00eb rast, vulnerabiliteti n\u00eb menaxherin e paketave uv \u00ebsht\u00eb sh\u00ebnuar si i sigurt, pasi n\u00ebse sulmuesi mund t\u00eb ndikoj\u00eb n\u00eb p\u00ebrmbajtjen e arkivit origjinal, nuk ka kuptim t\u00eb komplikohet sulmi dhe t\u00eb shfryt\u00ebzohet vulnerabiliteti p\u00ebrmes arkivave t\u00eb t\u00eb hapura, kur mund t\u00eb arrihet ekzekutimi i kodit p\u00ebrmes skripteve ndihm\u00ebse n\u00eb arkivin kryesor. <\/p>\n
Shkenc\u00ebtar\u00ebt q\u00eb zbuluan vulnerabilitetin propozuan disa skenar\u00eb hipotetik\u00eb sulmi q\u00eb lejojn\u00eb kalimin e verifikimeve t\u00eb siguris\u00eb dhe arritjen e ekzekutimit t\u00eb kodit p\u00ebrmes z\u00ebvend\u00ebsimit t\u00eb skedar\u00ebve t\u00eb konfigurimit ose nd\u00ebrhyrjes n\u00eb procesin e nd\u00ebrtimit. Supozohet se arkivi i d\u00ebrguar do t\u00eb kaloj\u00eb verifikimin automatizuar nga skaneri i siguris\u00eb dhe auditi manual, gjat\u00eb t\u00eb cilit kontrolluesi nuk do t\u00eb v\u00ebrehet ndonj\u00eb arkiv t\u00eb \u00e7uditsh\u00ebm t\u00eb hapur me skedar\u00eb t\u00eb tjer\u00eb, pas s\u00eb cil\u00ebs gjat\u00eb shkarkimit me bibliotekat Rust do t\u00eb nxjerr\u00eb p\u00ebrmbajtje t\u00eb ndryshme nga ajo q\u00eb pritej. <\/p>\n
P\u00ebr shembull, sulmuesi mund t\u00eb ngarkoj\u00eb nj\u00eb arkiv t\u00eb modifikuar n\u00eb repositorin PyPI, i cili do t\u00eb kaloj\u00eb verifikimin bazuar n\u00eb analiz\u00ebn e p\u00ebrmbajtjes s\u00eb arkivit kryesor, q\u00eb p\u00ebrmban skedarin legjitim pyproject.toml. Gjat\u00eb p\u00ebrpunimit t\u00eb k\u00ebtij paketi me ndihm\u00ebn e utilitarit uv, pyproject.toml legjitim do t\u00eb z\u00ebvend\u00ebsohet me nj\u00eb version t\u00eb d\u00ebmsh\u00ebm nga arkivi i hapur, q\u00eb p\u00ebrmban komanda q\u00eb do t\u00eb ekzekutohen gjat\u00eb nd\u00ebrtimit n\u00eb kompjuterin e zhvilluesit ose n\u00eb sistemin e integrimit t\u00eb vazhduesh\u00ebm. Gjithashtu, \u00ebsht\u00eb e mundur t\u00eb organizohet z\u00ebvend\u00ebsimi i skedar\u00ebve t\u00eb kontejnerit gjat\u00eb nxjerrjes s\u00eb imazhit t\u00eb kontejnerit me ndihm\u00ebn e instrumenteve testcontainers. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Cenueshm\u00ebri](\"\/wp-content\/uploads\/2025\/10\/7de5eeee8420b77faa0bca075f275700.png\")
<\/center> ![\"Cenueshm\u00ebri](\"\/wp-content\/uploads\/2025\/10\/538645342d5a4408b327ffd87c659c4f.png\")
<\/center> <\/p>\n