Umba wokhuseleko (i-CVE-2021-41077) ichongiwe kwinkonzo yokudibanisa eqhubekayo yeTravis CI, eyenzelwe ukuvavanya nokwakha iiprojekthi eziphuhliswe kwi-GitHub kunye ne-Bitbucket, evumela imixholo yezinto eziguquguqukayo zokusingqongileyo zeendawo zokugcina zikawonke-wonke usebenzisa iTravis CI ukuba ibonakaliswe. . Phakathi kwezinye izinto, ubuthathaka bukuvumela ukuba ufumane izitshixo ezisetyenziswe kwiTravis CI yokuvelisa iisignesha zedijithali, izitshixo zokufikelela kunye namathokheni okufikelela kwi-API.
Ingxaki yayikhona kwiTravis CI ukususela ngoSeptemba 3 ukuya kuSeptemba 10. Kuyaphawuleka ukuba ulwazi malunga nobungozi ludluliselwe kubaphuhlisi ngoSeptemba 7, kodwa ekuphenduleni bafumana impendulo kuphela ngesiphakamiso sokusebenzisa ukujikeleza okubalulekileyo. Ekubeni bengafumananga ingxelo eyaneleyo, abaphandi banxibelelana ne-GitHub kwaye bacebise ukufakwa kuluhlu olumnyama lweTravis. Ingxaki yalungiswa kuphela ngoSeptemba 10 emva kwenani elikhulu lezikhalazo ezifunyenwe kwiiprojekthi ezahlukeneyo. Emva kwesiganeko, ingxelo engaphezulu engaqhelekanga malunga nengxaki yapapashwa kwiwebhusayithi yeTravis CI, leyo, endaweni yokwazisa malunga nokulungiswa kobuthathaka, iqulethe kuphela isincomo esingaphandle komxholo wokutshintsha izitshixo zokufikelela ngebhayisekile.
Ukulandela isikhalo malunga nokugqunywa kweeprojekthi ezininzi ezinkulu, ingxelo eneenkcukacha ngakumbi yapapashwa kwiforum yenkxaso yeTravis CI, ilumkisa ukuba umnini wefolokhwe yayo nayiphi na indawo yokugcina uluntu, ngokungenisa isicelo sokutsalwa, ukuqalisa inkqubo yokwakha kunye nokuzuza. ufikelelo olungagunyaziswanga kwizinto eziguquguqukayo zemo engqongileyo ezinovakalelo lwendawo yokugcina yokugcina. Ezo ziguquguqukayo zigcinwa kwifom entsonkothileyo kwaye zikhutshiwe kuphela ngexesha lokudityaniswa. Ingxaki ichaphazele kuphela oovimba abafikeleleka kuluntu abaneefolokhwe (oovimba babucala abakhuselekanga ukuba bahlaselwe).
umthombo: opennet.ru