Inkinga yezokuphepha (CVE-2021-41077) ikhonjwe kusevisi eqhubekayo yokuhlanganisa ye-Travis CI, eyenzelwe ukuhlola nokwakha amaphrojekthi athuthukiswe ku-GitHub ne-Bitbucket, okuvumela okuqukethwe okuguquguqukayo kwemvelo okubucayi kwamaqoqo omphakathi asebenzisa i-Travis CI ukuthi kwembulwe. . Phakathi kwezinye izinto, ukuba sengozini kukuvumela ukuthi uthole okhiye abasetshenziswa ku-Travis CI ukuze ukhiqize amasiginesha edijithali, okhiye bokufinyelela namathokheni okufinyelela i-API.
Inkinga yayikhona kuTravis CI kusukela ngoSepthemba 3 kuya kuSepthemba 10. Kuyaphawuleka ukuthi ulwazi olumayelana nokuba sengozini ludluliselwe konjiniyela ngo-Septhemba 7, kodwa ekuphenduleni bathole impendulo enezincomo zokusebenzisa ukuzungezisa ukhiye. Njengoba bengayitholanga impendulo eyanele, abacwaningi baxhumane ne-GitHub futhi bahlongoza ukuvinjwa kwe-Travis. Inkinga yalungiswa ngoSepthemba 10 kuphela ngemuva kwenqwaba yezikhalo ezatholwa ezinhlelweni ezahlukene. Ngemuva kwalesi sigameko, umbiko ongaphezu kokuxakile mayelana nenkinga washicilelwa kuwebhusayithi ye-Travis CI, okuthi, esikhundleni sokwazisa mayelana nokulungiswa kokuba sengozini, okuqukethe kuphela isincomo esingaphandle kokuqukethwe sokushintsha okhiye bokufinyelela ngomjikelezo.
Kulandela ukukhala ngokufihlwa kwamaphrojekthi amaningana amakhulu, umbiko onemininingwane eyengeziwe washicilelwa esithangamini sokusekela iTravis CI, uxwayisa ngokuthi umnikazi wemfoloko yanoma iyiphi indawo yokugcina umphakathi angakwazi, ngokuthumela isicelo sokudonsa, avuse inqubo yokwakha futhi azuze. ukufinyelela okungagunyaziwe kokuguquguquka kwemvelo okubucayi kwekhosombe lokuqala. , okusethwe phakathi nokuhlanganiswa ngokusekelwe ezinkambini ezisuka kufayela elithi β.travis.ymlβ noma kuchazwe ngohlelo lwewebhu lwe-Travis CI. Okuguquguqukayo okunjalo kugcinwa ngendlela ebethelwe futhi kususwe ukubethela kuphela ngesikhathi sokuhlanganisa. Inkinga ithinte kuphela amakhosombe afinyeleleka esidlangalaleni anezimfoloko (amakhosombe angasese awakwazi ukuhlaselwa).
Source: opennet.ru