{"id":146043,"date":"2025-10-21T23:12:42","date_gmt":"2025-10-21T21:12:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-rust-bibliotekah-dlya-formata-tar-privodyashhaya-k-raspakovke-fajlov-iz-vlozhennogo-arhiva"},"modified":"2025-10-21T23:12:42","modified_gmt":"2025-10-21T21:12:43","slug":"uyazvimost-v-rust-bibliotekah-dlya-formata-tar-privodyashhaya-k-raspakovke-fajlov-iz-vlozhennogo-arhiva","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-rust-bibliotekah-dlya-formata-tar-privodyashhaya-k-raspakovke-fajlov-iz-vlozhennogo-arhiva","title":{"rendered":"Dob\u00ebsia n\u00eb bibliotekat Rust p\u00ebr formatin TAR, e cila \u00e7on n\u00eb nxjerrjen e skedar\u00ebve nga nj\u00eb arkiv i ngjitur.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb bibliotek\u00ebn e shkruar n\u00eb gjuh\u00ebn Rust, async-tar, e cila ofron funksione p\u00ebr t\u00eb lexuar dhe shkruar arkiva tar, \u00ebsht\u00eb gjetur nj\u00eb dob\u00ebsi (CVE-2025-62518, emri i kodit TARmageddon) q\u00eb lejon, gjat\u00eb shp\u00ebrndarjes s\u00eb nj\u00eb arkivi tar t\u00eb formuar ve\u00e7mas, jo vet\u00ebm nxjerrjen e skedareve q\u00eb ndodhen n\u00eb t\u00eb, por gjithashtu skedaret e p\u00ebrmbajtura n\u00eb nj\u00eb arkiv tar t\u00eb n\u00ebnshkruar. Kjo dob\u00ebsi mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb anashkaluar sistemet e verifikimit t\u00eb arkivave dhe p\u00ebr t\u00eb nxjerr\u00eb skedare p\u00ebr t\u00eb cilat nuk ishte b\u00ebr\u00eb verifikimi. <\/p>\n
Pika e siguris\u00eb shfaqet gjithashtu n\u00eb forcat e bibliotek\u00ebs async-tar, t\u00eb tilla si tokio-tar, krata-tokio-tar dhe astral-tokio-tar, si dhe n\u00eb utilitaret e bazuara mbi to, p\u00ebr shembull, menaxheri i paketave uv, i zhvilluar si nj\u00eb z\u00ebvend\u00ebsim me performanc\u00eb t\u00eb lart\u00eb p\u00ebr 'pip' p\u00ebr projektet n\u00eb gjuh\u00ebn Python. Nga projektet e njohura q\u00eb p\u00ebrdorin bibliotekat me pika t\u00eb dob\u00ebta, p\u00ebrmenden gjithashtu mjetet testcontainers p\u00ebr t\u00eb ekzekutuar kontejner\u00eb docker dhe runtime WebAssembly wasmCloud. N\u00eb depozitat crates.is, gjat\u00eb 90 dit\u00ebve t\u00eb fundit, biblioteka async-tar num\u00ebron 1.3 milion shkarkime, tokio-tar - 2.2 milion, testcontainers - 2.9 milion. <\/p>\n
Pika e siguris\u00eb shkaktohet nga nj\u00eb zgjedhje e pasakt\u00eb e pozicionit gjat\u00eb analizimit t\u00eb vlerave t\u00eb ndryshme t\u00eb madh\u00ebsis\u00eb n\u00eb titujt ustar dhe PAX. N\u00eb arkivat tar n\u00eb formatin PAX, p\u00ebr secil\u00ebn skedar brenda arkivit, tregohen dy tituj - klasik ustar dhe t\u00eb zgjeruar PAX. Problemi \u00ebsht\u00eb i lidhur me faktin se bibliotekat me pika t\u00eb dob\u00ebta, kur nxjerrin skedar\u00ebt, n\u00eb vend q\u00eb t\u00eb llogarisin offsetin n\u00eb baz\u00eb t\u00eb madh\u00ebsis\u00eb nga titulli i zgjeruar PAX, merrnin madh\u00ebsin\u00eb nga titulli i vjet\u00ebruar ustar. Kur vlera e madh\u00ebsis\u00eb \u00ebsht\u00eb zero n\u00eb titullin ustar, p\u00ebrmbajtja q\u00eb vjen pas tij trajtohet si nj\u00eb bllok i sakt\u00eb titujsh TAR p\u00ebr skedarin tjet\u00ebr.
<\/center>
<\/center> <\/p>\n
P\u00ebr t\u00eb realizuar nj\u00eb sulm, mjafton t\u00eb krijosh nj\u00eb arkiv TAR, n\u00eb t\u00eb cilin titulli i ustar tregon nj\u00eb madh\u00ebsi zero, nd\u00ebrsa n\u00eb titullin p\u00ebr formatin PAX tregohet madh\u00ebsia aktuale, \u00e7ka b\u00ebn q\u00eb p\u00ebrmbajtja e skedarit me nj\u00eb arkiv tar tjet\u00ebr t\u00eb trajtohet si pjes\u00eb e arkivit kryesor. Nj\u00eb shembull kodi p\u00ebr krijimin e arkivave t\u00eb till\u00eb \u00ebsht\u00eb postuar n\u00eb GitHub. Dob\u00ebsia \u00ebsht\u00eb adresuar n\u00eb daljet tokio-tar 0.5.6 dhe uv 0.9.5. P\u00ebr bibliotekat e tjera, korrigjimet nuk jan\u00eb publikuar ende, por p\u00ebr astral-tokio-tar, async-tar dhe krata-tokio-tar jan\u00eb p\u00ebrgatitur patches t\u00eb ve\u00e7anta. <\/p>\n
Dob\u00ebsive n\u00eb biblioteka u \u00ebsht\u00eb caktuar nj\u00eb nivel rreziku prej 8.1 nga 10, pasi problemi mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb mbivendosur skedar\u00ebt q\u00eb po nxirren (n\u00eb implementimet e prekura, do t\u00eb nxirren skedar\u00eb q\u00eb nuk ishin t\u00eb duksh\u00ebm n\u00eb arkiv). N\u00eb k\u00ebt\u00eb rast, dob\u00ebsia n\u00eb menaxherin e paketave uv \u00ebsht\u00eb identifikuar si jo e rrezikshme, pasi n\u00ebse sulmuesi mund t\u00eb ndikoj\u00eb n\u00eb p\u00ebrmbajtjen e arkivit origjinal, nuk ka kuptim t\u00eb komplikohet sulmi dhe t\u00eb shfryt\u00ebzohet dob\u00ebsia p\u00ebrmes nj\u00eb arkivi t\u00eb n\u00ebnshkruar, kur mund t\u00eb arrihet ekzekutimi i kodit p\u00ebrmes skenar\u00ebve t\u00eb nd\u00ebrtimit n\u00eb arkivin kryesor. <\/p>\n
Hulumtuesit q\u00eb zbuluan dob\u00ebsin\u00eb propozojn\u00eb disa skenar\u00eb hipotez\u00eb sulmi q\u00eb mund t\u00eb anashkalojn\u00eb kontrollat e siguris\u00eb dhe t\u00eb arrijn\u00eb ekzekutimin e kodit p\u00ebrmes z\u00ebvend\u00ebsimit t\u00eb skedar\u00ebve t\u00eb konfigurimit ose nd\u00ebrhyrjeve n\u00eb procesin e nd\u00ebrtimit. N\u00ebnkuptohet se arkivi i d\u00ebrguar do t\u00eb kaloj\u00eb verifikimin automatizuar me skanerin e siguris\u00eb dhe auditin manual, gjat\u00eb t\u00eb cilit kontrolluesi nuk do t\u00eb kushtoj\u00eb v\u00ebmendje arkivit t\u00eb \u00e7uditsh\u00ebm t\u00eb n\u00ebnshkruar me skedar\u00eb t\u00eb tjer\u00eb, pas t\u00eb cilit gjat\u00eb shp\u00ebrndarjes me bibliotekat Rust do t\u00eb nxirret nj\u00eb p\u00ebrmbajtje tjet\u00ebr nga arkivi sesa ishte pritur. <\/p>\n
P\u00ebr shembull, sulmuesi mund t\u00eb ngrej\u00eb nj\u00eb arkiv t\u00eb modifikuar n\u00eb depozit\u00ebn PyPI, i cili do t\u00eb kaloj\u00eb verifikimin mbi baz\u00ebn e analiz\u00ebs s\u00eb p\u00ebrmbajtjes s\u00eb arkivit kryesor, q\u00eb p\u00ebrmban skedarin legjitim pyproject.toml. Kur ky paket\u00eb t\u00eb p\u00ebrpunohen me utilitarin uv, skedari legjitim pyproject.toml do t\u00eb z\u00ebvend\u00ebsohet me nj\u00eb version t\u00eb d\u00ebmsh\u00ebm nga arkivi i n\u00ebnshkruar, p\u00ebrmbajtja e t\u00eb cilit do t\u00eb p\u00ebrmbaj\u00eb komanda q\u00eb do t\u00eb ekzekutohen gjat\u00eb nd\u00ebrtimit n\u00eb kompjuterin e zhvilluesit apo n\u00eb sistemin e integrimit t\u00eb vazhduesh\u00ebm. Po ashtu, \u00ebsht\u00eb e mundur t\u00eb organizohet mbivendosja e skedar\u00ebve t\u00eb konteinerit kur nxirren imazhet e konteinerit duke p\u00ebrdorur mjetin testcontainers. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Dob\u00ebsia](\"\/wp-content\/uploads\/2025\/10\/7de5eeee8420b77faa0bca075f275700.png\")
<\/center> ![\"Dob\u00ebsia](\"\/wp-content\/uploads\/2025\/10\/538645342d5a4408b327ffd87c659c4f.png\")
<\/center> <\/p>\n