Uma exhashazwa, lawa maphutha angavumela abahlaseli ukuthi bathole ukufinyelela okungagunyaziwe kulwazi olubucayi noma ngokuvamile babangele izinkinga.
Zimbalwa izinsuku ezedlule, I-GitHub ivuliwe Ngokuthunyelwe kwebhulogi, i- imininingwane mayelana nokuba sengozini okukuvumela ukuthi ufinyelele okuqukethwe kokuguquguquka kwemvelo okuveziwe kuziqukathi ezisetshenziswa kungqalasizinda yakho yokukhiqiza.
Ukuba sengozini kutholwe umhlanganyeli kuhlelo lwe-Bug Bounty, oludizayinelwe ukuthola izinkinga zokuphepha nokuklomelisa abacwaningi ngalokho abakutholile. Le nkinga ithinta kokubili insiza ye-GitHub kanye ekucushweni Iseva ye-GitHub Enterprise (GHES) esebenza kumasistimu wabasebenzisi.
Ukuba sengozini kwezokuvikela, ifakwe kuhlu ngaphansi kwe-CVE-2024-0200 ngesilinganiso esiphezulu se-7.2 (CVSS), akazange axhashazwe emvelweni, Kushiwo ukuthi ngemva kokuhlaziya amarekhodi kanye nokucwaninga ingqalasizinda, abukho ubufakazi bokuxhashazwa kobungozi esikhathini esidlule obutholakele, ngaphandle komsebenzi womcwaningi obike inkinga. Kodwa-ke, njengesinyathelo sokuvimbela, simiselele bonke okhiye bokubethela kanye nemininingwane ebingahle ibe sengozini uma umhlaseli esebenzisa ubungozi.
I-GitHub Enterprise Server (GHES) kuthiwa iyathinteka, kodwa Ukuxhaphaza ubungozi kudinga umsebenzisi ogunyaziwe onendima yomnikazi wenhlangano ngena ku-akhawunti kusibonelo se-GHES, unciphise amathuba okuxhashazwa.
Lobu bungozi bukhona naku-GitHub Enterprise Server (GHES). Nokho, ukuxhaphaza kudinga umsebenzisi ogunyaziwe onendima yoMnikazi Wenhlangano ukuthi angene ku-akhawunti esimweni se-GHES, okuyisethi ebalulekile yezimo ezinciphisa ukuxhashazwa okungaba khona. Isiqeshana siyatholakala namuhla, Januwari 16, 2024, ngezinguqulo ze-GHES 3.8.13, 3.9.8, 3.10.5, kanye no-3.11.3. Sincoma ukuthi amakhasimende e-GHES afake isiqeshana ngokushesha ngangokunokwenzeka.
Ukungena kobufakazi ezinhlelweni zethu zokukhiqiza kubangele uchungechunge lokunqamuka kwesevisi phakathi komhla zingama-27 nomhla zingama-29 kuZibandlela. Siyawubona umthelela ezibe nawo kumakhasimende ethu athembele ku-GitHub futhi athuthukise izinqubo zethu zokuqinisekisa ukuzungezisa ukuze kwehliswe ingcuphe yesikhathi sokuphumula esingahleliwe esikhathini esizayo.
Kuyafaneleka ukusho lokho Ukuba sengozini ku-GitHub kulungisiwe futhi isibuyekezo sesikhishiwe ukukhishwa komkhiqizo we-GHES 3.8.13, 3.9.8, 3.10.5, kanye no-3.11.3, i-GitHub ibonise ubungozi ku-GHES njengesimo "sokusetshenziswa okungaphephile kwe-Reflection," okubeka ubungozi bomjovo wokubonisa kanye nokwenziwa kwekhodi yesilawuli kude (njengoba lezi zinhlobo zobungozi ziholela ekusebenziseni ikhodi noma ezindleleni ezilawulwa umsebenzisi ohlangothini lweseva).
Ukushintshwa kwalaba khiye bangaphakathi kubangele ukuphazamiseka kwamanye amasevisi kusukela ngomhla ka-27 kuya ku-29 Disemba. Abaphathi be-GitHub bazamile ukufunda emaphutheni enziwe ngenkathi bebuyekeza okhiye abathinta amakhasimende.
Phakathi kwezinyathelo ezithathiwe, ibuyekeziwe ukhiye wokusayina we-GitHub GPG wangasese esetshenziselwa ukusayina izibopho ozidalayo ku-GitHub. Lokhu kufaka phakathi izibophezelo ezidalwe kumhleli wewebhu, ngesikhala sekhodi, ngomugqa womyalo endaweni yekhodi, noma ngokusebenza kwesicelo sokudonsa noma nge-Codespace. Ukhiye omdala awusebenzi ngoJanuwari 16 futhi ukhiye omusha uye wasetshenziswa kusukela lapho. Kusukela ngomhlaka-23 Januwari, zonke izibophezelo ezintsha ezisayinwe ngokhiye omdala ngeke zimakwe njengeziqinisekisiwe ku-GitHub. NgoJanuwari 16, okhiye basesidlangalaleni abasetshenziselwa ukubethela idatha yomsebenzisi ethunyelwe nge-API ku-GitHub Actions, GitHub Codespaces, kanye ne-Dependabot nabo babuyekezwa.
Ngaphezu kwakho, Abasebenzisi banconywa ukuthi basebenzise laba khiye basesidlangalaleni abaphethwe yi-GitHub ukuze baqinisekise ukuzinikela endaweni futhi ubethele idatha kwezokuthutha eqinisekisa ukuthi ubuyekeze okhiye bakho be-GitHub GPG ukuze amasistimu akho aqhubeke nokusebenza ngemva kokushintshwa kokhiye.
ekugcineni uma ukhona unentshisekelo yokwazi okwengeziwe ngayo, ungabheka imininingwane Kulesi sixhumanisi esilandelayo.