Khoutu e mpe e fumanoe ho bareki ba phomolo le liphutheloana tse ling tse 10 tsa Ruby

Ka har'a sephutheloana sa lehakoe se tsebahalang phomolo-mosebetsi, ka kakaretso ea download e limilione tse 113, tsebahatsoa Phetisetso ea khoutu e kotsi (CVE-2019-15224) e khoasollang litaelo tse ka sebetsoang ebe e romella tlhahisoleseling ho moamoheli oa kantle. Tlhaselo e ile ea etsoa ka tenyetseha developer indonesia rest-client ho rubygems.org repository, ka mor'a moo bahlaseli ba ile ba hatisa litokollo tsa 13-14 ka August 1.6.10 le 1.6.13, tse neng li kenyelletsa liphetoho tse mpe. Pele liphetolelo tse mpe li koetsoe, basebelisi ba ka bang sekete ba khonne ho li khoasolla (bahlaseli ba ile ba lokolla lintlafatso tsa liphetolelo tsa khale e le hore ba se ke ba khahla).

Phetoho e mpe e fetisa mokhoa oa "#authenticate" ka phaposing
Identity, ka mor'a moo mohala o mong le o mong o hlahisa lengolo-tsoibila le phasewete tse rometsoeng nakong ea teko ea netefatso e rometsoeng ho moamoheli oa bahlaseli. Ka tsela ena, litekanyo tsa ho kena tsa basebelisi ba ts'ebeletso ba sebelisang sehlopha sa Identity le ho kenya mofuta o tlokotsing oa laeborari ea bareki kaofela lia amoheloa, hlahisa joalo ka ts'epo ea liphutheloana tse ngata tse tsebahalang tsa Ruby, ho kenyeletsoa ast (li-download tse limilione tse 64), oauth (limilione tse 32), fastlane (limilione tse 18), le kubeclient (limilione tse 3.7).

Ntle le moo, ho kenyellelitsoe ka morao ho khoutu, ho lumella khoutu ea Ruby e sa lumellaneng hore e phethoe ka mosebetsi oa eval. Khoutu e fetisoa ka Cookie e netefalitsoeng ke senotlolo sa mohlaseli. Ho tsebisa bahlaseli ka ho kenya sephutheloana se kotsi ho moamoheli oa kantle, URL ea sistimi ea motho ea hlokofalitsoeng le khetho ea tlhahisoleseling mabapi le tikoloho, joalo ka li-password tse bolokiloeng bakeng sa DBMS le lits'ebeletso tsa leru, li romelloa. Boiteko ba ho khoasolla mangolo bakeng sa meepo ea chelete ea crypto bo tlalehiloe ho sebelisoa khoutu e mpe e boletsoeng ka holimo.

Ka mor'a ho ithuta khoutu e khopo e ne e le senotsoehore liphetoho tse tšoanang li teng ho 10 liphutheloana ho Ruby Gems, e neng e sa hapuoe, empa e ne e lokiselitsoe ka ho khetheha ke bahlaseli ba thehiloeng lilaebraring tse ling tse tummeng tse nang le mabitso a tšoanang, moo lebelo le ileng la nkeloa sebaka ke underscore kapa ka tsela e fapaneng (mohlala, e thehiloeng ho cron-parser sephutheloana se kotsi cron_parser se entsoe, 'me se ipapisitse le chelete ea tšepe sephutheloana se kotsi sa lintja). Liphutheloana tsa bothata:

• coin_base: 4.2.2, 4.2.1
• blockchain_wallet: 0.0.6, 0.0.7
• e makatsang-bot: 1.18.0
• chelete ea tšepe ea ntja: 1.0.2
• mebala ea capistrano: 0.5.5
• bitcoin_vanity: 4.3.3
• lita_coin: 0.0.3
• e fihla haufinyane: 0.2.8
• omniauth_amazon: 1.0.1
• cron_parser1.0.12: 1.0.13, 0.1.4

Sephutheloana sa pele se kotsi se tsoang lethathamong lena se ngotsoe ka May 12, empa boholo ba bona bo hlahile ka July. Ka kakaretso, liphutheloana tsena li ile tsa kopitsoa ka makhetlo a ka bang 2500.

Source: opennet.ru