{"id":52757,"date":"2019-11-16T00:00:00","date_gmt":"2019-11-15T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po"},"modified":"2020-02-18T14:00:33","modified_gmt":"2020-02-18T11:00:33","slug":"github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po","title":{"rendered":"GitHub ka nisur nj\u00eb projekt t\u00eb p\u00ebrbashk\u00ebt p\u00ebr identifikimin e dob\u00ebsive n\u00eb softuerin e hapur","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitHub prezantoj<\/a><\/noindex> me iniciativ\u00ebn GitHub Security Lab<\/a><\/noindex>, e cila \u00ebsht\u00eb fokusuar n\u00eb organizimin e bashk\u00ebpunimit t\u00eb ekspert\u00ebve t\u00eb siguris\u00eb nga kompani dhe organizata t\u00eb ndryshme p\u00ebr identifikimin dhe ndihm\u00ebn n\u00eb elimimin e dob\u00ebsive n\u00eb kodin e projekteve t\u00eb hapura. <\/p>\n

T\u00eb gjitha kompanit\u00eb dhe specialist\u00ebt individual\u00eb n\u00eb fush\u00ebn e siguris\u00eb kompjuterike jan\u00eb t\u00eb ftuar t\u00eb bashkohen me iniciativ\u00ebn. P\u00ebr identifikimin e dob\u00ebsive parashikohet<\/a><\/noindex> nj\u00eb shp\u00ebrblim deri n\u00eb 3000 dollar\u00eb, n\u00eb var\u00ebsi t\u00eb rrezikshm\u00ebris\u00eb s\u00eb problemit dhe cil\u00ebsis\u00eb s\u00eb raportit t\u00eb p\u00ebrgatitur. P\u00ebr t\u00eb raportuar \u00e7\u00ebshtjet, ofrohet nj\u00eb mjet CodeQL<\/a><\/noindex>, q\u00eb lejon krijimin e nj\u00eb shablloni t\u00eb kodit t\u00eb dob\u00ebt p\u00ebr t\u00eb identifikuar pranin\u00eb e nj\u00eb dob\u00ebsie t\u00eb till\u00eb n\u00eb kodin e projekteve t\u00eb tjera (CodeQL mund\u00ebson analiz\u00eb semantike t\u00eb kodit dhe krijimin e pyetjeve p\u00ebr t\u00eb gjetur struktura t\u00eb caktuara).<\/p>\n

Iniciativ\u00ebs i jan\u00eb bashkuar tashm\u00eb ekspert\u00eb t\u00eb siguris\u00eb nga kompani si F5, Google, HackerOne, Intel, IOActive, J.P. Morgan, LinkedIn, Microsoft, Mozilla, NCC Group, Oracle, Trail of Bits, Uber dhe
\nVMWare, t\u00eb cil\u00ebt n\u00eb dy vitet e fundit identifikuan<\/a><\/noindex> dhe kan\u00eb ndihmuar n\u00eb rregullimin e<\/a><\/noindex> 105 dob\u00ebsive n\u00eb projekte si Chromium, libssh2, b\u00ebrthama Linux, Memcached, UBoot, VLC, Apport, HHVM, Exiv2, FFmpeg, Fizz, libav, Ansible, npm, XNU, Ghostscript, Icecast, Apache Struts, strongSwan, Apache Ignite, rsyslog, Apache Geode dhe Hadoop. <\/p>\n

Cikli i propozuar nga GitHub p\u00ebr ruajtjen e siguris\u00eb s\u00eb kodit parashikon q\u00eb an\u00ebtar\u00ebt e GitHub Security Lab do t\u00eb identifikojn\u00eb dob\u00ebsit\u00eb, pas k\u00ebsaj informacioni mbi problemet do t'i dor\u00ebzohet mbajt\u00ebsve dhe zhvilluesve, t\u00eb cil\u00ebt do t\u00eb zhvillojn\u00eb rregullime, do t\u00eb rregullojn\u00eb koh\u00ebn e shp\u00ebrndarjes s\u00eb informacionit p\u00ebr problemin dhe do t'i informojn\u00eb projektet e varura p\u00ebr nevoj\u00ebn e instalimit t\u00eb versioneve q\u00eb eliminojn\u00eb dob\u00ebsit\u00eb. N\u00eb baz\u00eb do t\u00eb vendosen shabllone CodeQL, q\u00eb do t\u00eb parandalojn\u00eb p\u00ebrs\u00ebritjen e problemeve t\u00eb zgjidhura n\u00eb kodet e pranishme n\u00eb GitHub.
\n

\"GitHub<\/a><\/noindex><\/center><\/p>\n

P\u00ebrmes nd\u00ebrfaqes s\u00eb GitHub tani \u00ebsht\u00eb e mundur t\u00eb marrin<\/a><\/noindex> t\u00eb krijoni nj\u00eb identifikues CVE p\u00ebr problemin e identifikuar dhe t\u00eb p\u00ebrgatitni nj\u00eb raport, nd\u00ebrsa GitHub do t\u00eb d\u00ebrgoj\u00eb vet\u00eb njoftimet e nevojshme dhe do t\u00eb organizoj\u00eb rregullimin e koordinuar t\u00eb tyre. M\u00eb shum\u00eb se kaq, pas eliminimit t\u00eb problem, GitHub automatikisht do t\u00eb d\u00ebrgoj\u00eb k\u00ebrkesa pull p\u00ebr p\u00ebrmir\u00ebsimin e var\u00ebsive lidhur me projektin e dob\u00ebt.<\/p>\n

GitHub gjithashtu ka prezantuar nj\u00eb katalog t\u00eb dob\u00ebsive GitHub Advisory Database<\/a><\/noindex>, n\u00eb t\u00eb cilin publikohen informacionet p\u00ebr dob\u00ebsit\u00eb q\u00eb ndodhin n\u00eb projektet n\u00eb GitHub dhe informacione p\u00ebr ndjekjen e pakove dhe repozitor\u00ebve t\u00eb prekur nga problemet. Identifikuesit CVE t\u00eb p\u00ebrmendur n\u00eb komentet n\u00eb GitHub tani automatikisht i referohen informacionit t\u00eb detajuar mbi dob\u00ebsin\u00eb n\u00eb baz\u00ebn e dh\u00ebnash t\u00eb paraqitur. P\u00ebr automatizimin e pun\u00ebs me baz\u00ebn e t\u00eb dh\u00ebnave \u00ebsht\u00eb propozuar nj\u00eb API<\/a><\/noindex>.<\/p>\n

po ashtu raportohet p\u00ebr nj\u00eb p\u00ebrmir\u00ebsim sh\u00ebrbimit<\/a><\/noindex> p\u00ebr mbrojtjen nga shk\u00ebmbimi<\/a><\/noindex> n\u00eb repozitor\u00ebt publik t\u00eb aksesuesh\u00ebm
\nt\u00eb dh\u00ebnave konfidenciale, si\u00e7 jan\u00eb token\u00ebt e autentifikimit dhe \u00e7el\u00ebsat e qasjes. Gjate komitimit, skaneri kontrollon format tipike t\u00eb \u00e7el\u00ebsave dhe token\u00ebve q\u00eb p\u00ebrdoren nga 20 ofruesit dhe sh\u00ebrbimet e cloud<\/a><\/noindex>, duke p\u00ebrfshir\u00eb API-t\u00eb e Alibaba Cloud, Amazon Web Services (AWS), Azure, Google Cloud, Slack dhe Stripe. N\u00eb rast se nj\u00eb token identifikohet, nj\u00eb k\u00ebrkes\u00eb d\u00ebrgohet ofruesit t\u00eb sh\u00ebrbimit p\u00ebr t\u00eb konfirmuar rrjedhjen dhe t\u00eb t\u00ebrhiqen token\u00ebt e kompromentuar. Q\u00eb nga dje, p\u00ebrve\u00e7 formateve t\u00eb mb\u00ebshtetur m\u00eb par\u00eb, \u00ebsht\u00eb shtuar mb\u00ebshtetje p\u00ebr identifikimin e token\u00ebve GoCardless, HashiCorp, Postman dhe Tencent.<\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

GitHub \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b \u0441 \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u043e\u0439 GitHub Security Lab, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044e \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u043e\u0432 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u0441\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044e \u043f\u043e \u0438\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e \u0432 \u043a\u043e\u0434\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432. \u0414\u043b\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u0435 \u043f\u0440\u0438\u0433\u043b\u0430\u0448\u0430\u044e\u0442\u0441\u044f \u0432\u0441\u0435 \u0437\u0430\u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0438 \u0438\u043d\u0434\u0438\u0432\u0438\u0434\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043f\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0417\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0435\u0434\u0443\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u0430 \u0432\u044b\u043f\u043b\u0430\u0442\u0430 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c \u0434\u043e 3000 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":52758,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-52757","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47GitHub nisi nj\u00eb projekt t\u00eb p\u00ebrbashk\u00ebt p\u00ebr identifikimin e dob\u00ebsive n\u00eb softuerin e hapur | ProHoster","description":"GitHub ka propozuar nj\u00eb iniciativ\u00eb","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47GitHub \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u044b\u0439 \u043f\u0440\u043e\u0435\u043a\u0442 \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u041f\u041e | ProHoster","og:description":"GitHub \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b \u0441 \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u043e\u0439","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-15T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52757","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 04:44:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:18:18","updated":"2026-01-24 04:44:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/52757","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=52757"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/52757\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/52758"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=52757"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=52757"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=52757"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}