curl 7.71.0 e lokollotsoe, e lokisa mefokolo e 'meli

E fumaneha mofuta o mocha oa ts'ebeliso ea ho amohela le ho romella data ka marang-rang - curl 7.71.0, e fanang ka bokhoni ba ho etsa kopo ka mokhoa o bonolo ka ho totobatsa lintlha tse kang cookie, user_agent, referer le lihlooho tse ling. cURL e tšehetsa HTTP, HTTPS, HTTP/2.0, HTTP/3, SMTP, IMAP, POP3, Telnet, FTP, LDAP, RTSP, RTMP le liprothokholo tse ling tsa marang-rang. Ka nako e ts'oanang, ho ile ha lokolloa tlhahiso bakeng sa laeborari ea libcurl, e ntseng e ntlafatsoa ka mokhoa o ts'oanang, e fana ka API bakeng sa ho sebelisa mesebetsi eohle ea li-curl mananeong a lipuo tse kang C, Perl, PHP, Python.

Phatlalatso e ncha e kenyelletsa khetho ea "-retry-all-errors" ho leka ts'ebetso hape haeba ho hlaha liphoso le ho lokisa mefokolo e 'meli:

  • Ho ba tlokotsing CVE-2020-8177 e o lumella ho hlakola faele ea lehae ka har'a sistimi ha o fihlella seva e laoloang ke mohlaseli. Bothata bo hlaha feela ha likhetho tsa “-J” (“–remote-header-name”) le “-i” (“—head”) li sebelisoa ka nako e le ’ngoe. Khetho ea "-J" e u lumella ho boloka faele ka lebitso le boletsoeng sehloohong
    "Tlhaloso ea Likahare". Haeba faele e nang le lebitso le le leng e se e ntse e le teng, lenaneo la curl hangata le hana ho ngola, empa haeba khetho ea "-i" e le teng, mohopolo oa ho hlahloba o robehile mme faele e ngotsoe holimo (chelete e etsoa sethaleng. ea ho amohela 'mele oa karabo, empa ka khetho ea "-i" lihlooho tsa HTTP li bonts'oa pele 'me li na le nako ea ho bolokoa pele 'mele oa karabo o qala ho sebetsa). Ke lihlooho tsa HTTP feela tse ngotsoeng faeleng, empa seva se ka romela lintlha tse sa lumellaneng ho e-na le lihlooho 'me li tla ngoloa.

  • Ho ba tlokotsing CVE-2020-8169 e ka lebisa ho dutla ho seva ea DNS ea li-password tsa phihlello ea sebaka sa marang-rang (Basic, Digest, NTLM, joalo-joalo). Ka ho sebelisa lets'oao la "@" ho password, e sebelisoang hape e le senotlolo sa password ho URL, ha HTTP redirect e qala, curl e tla romella karolo ea senotlolo ka mor'a letšoao la "@" hammoho le sebaka seo u lokelang ho se rarolla. lebitso. Mohlala, haeba u fana ka phasewete "passw@rd123" le lebitso la mosebelisi "dan", curl e tla hlahisa URL "https://dan:passw@[imeile e sirelelitsoe]/ tsela" sebakeng sa "https://dan:passw%[imeile e sirelelitsoe]/ tsela" mme o tla romella kopo ea ho rarolla moamoheli "[imeile e sirelelitsoe]" sebakeng sa "example.com".

    Bothata bo hlaha ha ts'ehetso ea li-redirector tsa HTTP e lumelletsoe (e emisitsoe ka CURLOPT_FOLLOWLOCATION). Haeba DNS ea setso e sebelisoa, tlhahisoleseling mabapi le karolo ea password e ka fumanoa ke mofani oa DNS le mohlaseli ea nang le bokhoni ba ho thibela sephethephethe sa marang-rang (le haeba kopo ea mantlha e ne e le ka HTTPS, kaha sephethephethe sa DNS ha sea ngolisoa). Ha DNS-over-HTTPS (DoH) e sebelisoa, ho lutla ho lekanyetsoa ho opareitara ea DoH.

Source: opennet.ru

Eketsa ka tlhaloso