{"id":52757,"date":"2019-11-16T00:00:00","date_gmt":"2019-11-15T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po"},"modified":"2020-02-18T14:00:33","modified_gmt":"2020-02-18T11:00:33","slug":"github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po","title":{"rendered":"GitHub ka nisur nj\u00eb projekt t\u00eb p\u00ebrbashk\u00ebt p\u00ebr identifikimin e vulnerabiliteteve n\u00eb softuerin e hapur","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitHub u angazhuar<\/a><\/noindex> me iniciativ\u00ebn GitHub Security Lab<\/a><\/noindex>, e cila ka si q\u00ebllim organizimin e bashk\u00ebpunimit t\u00eb ekspert\u00ebve t\u00eb siguris\u00eb nga kompani dhe organizata t\u00eb ndryshme p\u00ebr identifikimin e dob\u00ebsive dhe ndihm\u00ebn p\u00ebr eliminimin e tyre n\u00eb kodin e projekteve t\u00eb hapura. <\/p>\n

T\u00eb gjitha kompanit\u00eb e interesuara dhe specialist\u00ebt individual\u00eb t\u00eb siguris\u00eb kompjuterike ftohen p\u00ebr t'u bashkuar me iniciativ\u00ebn. P\u00ebr identifikimin e dob\u00ebsis\u00eb \u00ebsht\u00eb parapar\u00eb<\/a><\/noindex> pagesa e nj\u00eb shp\u00ebrblimi deri n\u00eb 3000 dollar\u00eb, n\u00eb var\u00ebsi t\u00eb rrezikshm\u00ebris\u00eb s\u00eb problemit dhe cil\u00ebsis\u00eb s\u00eb raportit t\u00eb p\u00ebrgatitur. P\u00ebr d\u00ebrgimin e informacioneve mbi problemet, ofrohet p\u00ebrdorimi i mjetit CodeQL<\/a><\/noindex>, i cili lejon formimin e nj\u00eb modeli t\u00eb kodit t\u00eb dob\u00ebt p\u00ebr identifikimin e prania s\u00eb till\u00eb t\u00eb dob\u00ebsive n\u00eb kodin e projekteve t\u00eb tjera (CodeQL ofron mund\u00ebsin\u00eb p\u00ebr t\u00eb kryer analiz\u00eb semantike t\u00eb kodit dhe p\u00ebr t\u00eb formuar pyetje p\u00ebr k\u00ebrkimin e strukturave t\u00eb caktuara).<\/p>\n

Iniciativ\u00ebs i jan\u00eb bashkuar tashm\u00eb hulumtues t\u00eb siguris\u00eb nga kompanit\u00eb F5, Google, HackerOne, Intel, IOActive, J.P. Morgan, LinkedIn, Microsoft, Mozilla, NCC Group, Oracle, Trail of Bits, Uber dhe
\nVMWare, t\u00eb cil\u00ebt n\u00eb dy vitet e fundit identifikuan<\/a><\/noindex> dhe kan\u00eb ndihmuar p\u00ebr t\u00eb korrigjuar<\/a><\/noindex> 105 dob\u00ebsi n\u00eb projekte si Chromium, libssh2, b\u00ebrthama Linux, Memcached, UBoot, VLC, Apport, HHVM, Exiv2, FFmpeg, Fizz, libav, Ansible, npm, XNU, Ghostscript, Icecast, Apache Struts, strongSwan, Apache Ignite, rsyslog, Apache Geode dhe Hadoop. <\/p>\n

Cikli i jet\u00ebs s\u00eb siguris\u00eb s\u00eb kodit t\u00eb propozuar n\u00eb GitHub parashikon q\u00eb pjes\u00ebmarr\u00ebsit e GitHub Security Lab do t\u00eb identifikojn\u00eb dob\u00ebsit\u00eb, pas s\u00eb cil\u00ebs informacioni mbi problemet do t'u d\u00ebrgohet mbik\u00ebqyr\u00ebsve dhe zhvilluesve, t\u00eb cil\u00ebt do t\u00eb hartojn\u00eb rregullime, do t\u00eb koordinonin koh\u00ebn e publikimit t\u00eb informacionit mbi problemin dhe do t\u00eb informonin projektet e varura p\u00ebr nevoj\u00ebn e instalimit t\u00eb versionit me k\u00ebto rregullime. N\u00eb baz\u00eb do t\u00eb publikohen modele CodeQL q\u00eb do t\u00eb ndihmojn\u00eb n\u00eb parandalimin e rikthimit t\u00eb problemeve t\u00eb zgjidhura n\u00eb kodin e pranish\u00ebm n\u00eb GitHub.
\n

\"GitHub<\/a><\/noindex><\/center><\/p>\n

P\u00ebrmes nd\u00ebrfaqes s\u00eb GitHub tani \u00ebsht\u00eb e mundur t\u00eb merrni<\/a><\/noindex> identifikatorin CVE p\u00ebr problemin e identifikuar dhe t\u00eb p\u00ebrgatitni nj\u00eb raport, nd\u00ebrsa GitHub vet\u00eb do t\u00eb d\u00ebrgoj\u00eb njoftimet e nevojshme dhe do t\u00eb organizoj\u00eb korrigjimin e tyre n\u00ebn koordinim. M\u00eb tej, pas rregullimit t\u00eb problemit, GitHub automatikisht do t\u00eb d\u00ebrgoj\u00eb k\u00ebrkesat p\u00ebr t\u00eb p\u00ebrdit\u00ebsuar var\u00ebsit\u00eb e lidhura me projektin e dob\u00ebt.<\/p>\n

GitHub gjithashtu ka shtuar n\u00eb k\u00ebt\u00eb katalog dob\u00ebsish GitHub Advisory Database<\/a><\/noindex>, n\u00eb t\u00eb cilin publikohen informacione mbi dob\u00ebsit\u00eb q\u00eb prekin projektet n\u00eb GitHub dhe informacione p\u00ebr t\u00eb ndjekur paketat dhe depozit\u00eb e prekura nga problemet. Identifikuesit CVE t\u00eb p\u00ebrmendur n\u00eb komentet n\u00eb GitHub tani automatikisht referohen n\u00eb informacionin e detajuar mbi dob\u00ebsin\u00eb n\u00eb baz\u00ebn e t\u00eb dh\u00ebnave t\u00eb paraqitur. P\u00ebr automatizimin e pun\u00ebs me baz\u00ebn e t\u00eb dh\u00ebnave \u00ebsht\u00eb propozuar nj\u00eb ndihm\u00ebs i ve\u00e7ant\u00eb API<\/a><\/noindex>.<\/p>\n

Po ashtu raportohet p\u00ebr p\u00ebrmir\u00ebsimin t\u00eb sh\u00ebrbimit<\/a><\/noindex> p\u00ebr mbrojtjen nga komprometimi<\/a><\/noindex> i t\u00eb dh\u00ebnave konfidenciale, si\u00e7 jan\u00eb token\u00ebt e autentikimit dhe \u00e7el\u00ebsat e aksesit, n\u00eb depo t\u00eb hapura p\u00ebr publikun. Gjat\u00eb komitimit, skaner\u00ebt kontrollojn\u00eb format tipike t\u00eb \u00e7el\u00ebsave dhe token\u00ebve q\u00eb p\u00ebrdoren
\nnga 20 ofrues t\u00eb sh\u00ebrbimeve dhe platformave , p\u00ebrfshir\u00eb API-t\u00eb e Alibaba Cloud, Amazon Web Services (AWS), Azure, Google Cloud, Slack dhe Stripe. N\u00eb rast se identifikohet nj\u00eb token, d\u00ebrgohet nj\u00eb k\u00ebrkes\u00eb tek ofruesi i sh\u00ebrbimit p\u00ebr t\u00eb konfirmuar rrjedhjen dhe p\u00ebr t\u00eb t\u00ebrhequr token\u00ebt e komprometuar. Q\u00eb nga dje, p\u00ebrve\u00e7 formateve t\u00eb mb\u00ebshtetura m\u00eb par\u00eb, \u00ebsht\u00eb shtuar mb\u00ebshtetje p\u00ebr identifikimin e token\u00ebve GoCardless, HashiCorp, Postman dhe Tencent.<\/a><\/noindex>Analiza e pagave n\u00eb sektorin e TI n\u00eb Armeni p\u00ebrve\u00e7 vendeve t\u00eb hapura n\u00eb 10 kompanit\u00eb m\u00eb t\u00eb mira t\u00eb TI<\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

GitHub \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b \u0441 \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u043e\u0439 GitHub Security Lab, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044e \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u043e\u0432 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u0441\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044e \u043f\u043e \u0438\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e \u0432 \u043a\u043e\u0434\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432. \u0414\u043b\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u0435 \u043f\u0440\u0438\u0433\u043b\u0430\u0448\u0430\u044e\u0442\u0441\u044f \u0432\u0441\u0435 \u0437\u0430\u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0438 \u0438\u043d\u0434\u0438\u0432\u0438\u0434\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043f\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0417\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0435\u0434\u0443\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u0430 \u0432\u044b\u043f\u043b\u0430\u0442\u0430 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c \u0434\u043e 3000 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":52758,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-52757","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47GitHub lan\u00e7oi nj\u00eb projekt t\u00eb p\u00ebrbashk\u00ebt p\u00ebr identifikimin e dob\u00ebsive n\u00eb softuerin e hapur | ProHoster","description":"\ud83e\udd47GitHub lan\u00e7oi nj\u00eb projekt t\u00eb p\u00ebrbashk\u00ebt p\u00ebr identifikimin e dob\u00ebsive n\u00eb softuerin e hapur | ProHoster","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47GitHub \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u044b\u0439 \u043f\u0440\u043e\u0435\u043a\u0442 \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u041f\u041e | ProHoster","og:description":"GitHub \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b \u0441 \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u043e\u0439","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-15T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52757","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 04:44:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:18:18","updated":"2026-01-24 04:44:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/52757","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=52757"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/52757\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/52758"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=52757"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=52757"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=52757"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}