{"id":99307,"date":"2021-03-02T16:23:36","date_gmt":"2021-03-02T14:23:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/opasnye-uyazvimosti-v-sisteme-upravleniya-konfiguracziej-saltstack"},"modified":"2021-03-02T16:23:36","modified_gmt":"2021-03-02T14:23:36","slug":"opasnye-uyazvimosti-v-sisteme-upravleniya-konfiguracziej-saltstack","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/opasnye-uyazvimosti-v-sisteme-upravleniya-konfiguracziej-saltstack","title":{"rendered":"Dob\u00ebsit\u00eb e rrezikshme n\u00eb sistemin e menaxhimit t\u00eb konfigurimit SaltStack","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb versionet e reja t\u00eb sistemit t\u00eb menaxhimit t\u00eb centralizuar t\u00eb konfiguracionit SaltStack 3002.5, 3001.6 dhe 3000.8 \u00ebsht\u00eb riparuar nj\u00eb cenueshm\u00ebri (CVE-2020-28243) q\u00eb lejon nj\u00eb p\u00ebrdorues lokal t\u00eb pa privilegjuar n\u00eb host t\u00eb rris\u00eb privilegjet e tij n\u00eb sistem. Problemi \u00ebsht\u00eb shkaktuar nga nj\u00eb gabim n\u00eb procesorin salt-minion, i cili p\u00ebrdoret p\u00ebr t\u00eb pranuar komandat nga serveri qendror. Cenuet e zbuluar n\u00eb n\u00ebntor, por u riparua vet\u00ebm tani. <\/p>\n
Kur kryhet operacioni «restartcheck», ekziston mund\u00ebsia p\u00ebr t\u00eb z\u00ebvend\u00ebsuar komandat e rast\u00ebsishme p\u00ebrmes manipulimit me emrin e procesit. N\u00eb ve\u00e7anti, k\u00ebrkesa p\u00ebr pranin\u00eb e paket\u00ebs u b\u00eb p\u00ebrmes ekzekutimit t\u00eb menaxherit t\u00eb paketave me kalimin e argumentit t\u00eb marr\u00eb n\u00eb baz\u00eb t\u00eb emrit t\u00eb procesit. Menaxheri i paketave niset p\u00ebrmes thirrjes s\u00eb funksionit popen n\u00eb modin e nisjes s\u00eb shell, por pa mbrojtjen e simboleve speciale. Duke ndryshuar emrin e procesit dhe duke p\u00ebrdorur simbole t\u00eb ngjashme me «;» dhe «|», mund t\u00eb organizohet ekzekutimi i kodit tuaj. <\/p>\n
CVE-2021-25281 — p\u00ebr shkak t\u00eb munges\u00ebs s\u00eb kontrollit t\u00eb duhur t\u00eb autorizimit, nj\u00eb sulmues i larg\u00ebt mund t\u00eb ekzekutoj\u00eb \u00e7do modul wheel n\u00eb an\u00ebn e serverit master p\u00ebrmes thirrjes n\u00eb SaltAPI dhe t\u00eb komprometoj\u00eb t\u00eb gjith\u00eb infrastruktur\u00ebn.\n
CVE-2021-3197 — problemi n\u00eb modul t\u00eb SSH n\u00eb minion, q\u00eb lejon\u6267\u884ct e komandave shell t\u00eb rast\u00ebsishme p\u00ebrmes z\u00ebvend\u00ebsimit t\u00eb argumentit me konfigurimin «ProxyCommand» ose kalimin e ssh_options p\u00ebrmes API-s\u00eb.\n
CVE-2021-25282 — qasja e paautorizuar n\u00eb wheel_async lejon, p\u00ebrmes thirrjes n\u00eb SaltAPI, t\u00eb rinovosh nj\u00eb sked\u00eb p\u00ebrtej katalogut baz\u00eb dhe t\u00eb ekzekutosh kod t\u00eb rast\u00ebsish\u00ebm n\u00eb sistem.\n
CVE-2021-25283 \u2014 nj\u00eb shkak p\u00ebrtej kufijve t\u00eb katalogut baz\u00eb n\u00eb procesorin wheel.pillar_roots.write n\u00eb SaltAPI lejon shtimin e nj\u00eb model t\u00eb rast\u00ebsish\u00ebm n\u00eb renderer-in jinja.\n