[B! security][oss] shoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

sho id:sho

securityã¨ossã«é–¢ã™ã‚‹shoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (7)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

xzãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã«ä»•è¾¼ã¾ã‚ŒãŸ3å¹´ãŒã‹ã‚Šã®ãƒãƒƒã‚¯ãƒ‰ã‚¢ã€ã‚¹ã‚±ãƒ¼ãƒ«ç›´å‰ã«è¦‹ã¤ã‘ãŸã®ã¯Microsoftã®é–‹ç™ºè€… | gihyo.jp
Linux Daily Topics xzãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã«ä»•è¾¼ã¾ã‚ŒãŸ3å¹´ãŒã‹ã‚Šã®ãƒãƒƒã‚¯ãƒ‰ã‚¢â â ã€ã‚¹ã‚±ãƒ¼ãƒ«ç›´å‰ã«è¦‹ã¤ã‘ãŸã®ã¯Microsoftã®é–‹ç™ºè€… â€œã‚¢ãƒƒãƒ—ã‚¹ãƒˆãƒªãƒ¼ãƒ ã®xzãƒªãƒã‚¸ãƒˆãƒªã¨xz tarballsã¯ãƒãƒƒã‚¯ãƒ‰ã‚¢åŒ–ã•ã‚Œã¦ã„ã‚‹ï¼ˆThe upstream xz repository and the xz tarballs have been backdooredï¼‰â â€â€•2024å¹´3æœˆ29æ—¥ã€Microsoftã«æ‰€å±žã™ã‚‹é–‹ç™ºè€… Andres FreundãŒã€ŒOpenwall.comã€ãƒ¡ãƒ¼ãƒªãƒ³ã‚°ãƒªã‚¹ãƒˆã«æŠ•ç¨¿ã—ãŸãƒã‚¹ãƒˆã¯ä¸–ç•Œä¸ã®ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹é–¢ä¿‚è€…ã«è¡æ’ƒã‚’ä¸ŽãˆãŸã€‚ backdoor in upstream xz/liblzma leading to ssh server compromise -oss-security ä¸»è¦ãªLinuxãƒ‡ã‚£ã‚¹ãƒˆãƒªãƒ“ãƒ¥ãƒ¼ã‚·ãƒ§ãƒ³ã«ã¯ã»ã¼å«ã¾ã‚Œã¦ã„ã‚‹ãƒ‡ãƒ¼ã‚¿åœ§ç¸®ãƒ—ãƒã‚°ãƒ©
sho 2024/04/03
å¥‡è·¡ã¨ã—ã‹è¨€ã„ã‚ˆã†ãŒãªã„ã€‚ã“ã®ä»–ã«è¦‹é€ƒã•ã‚Œã¦ã„ã‚‹ã€ã„ã£ãã†å·§å¦™ãªã‚‚ã®ãŒãŸãã•ã‚“ã‚ã‚‹ã®ã‚‚é–“é•ã„ãªã„ã‚ã‘ã§ã€é ãŒç—›ã„

security

xz

oss
ãƒªãƒ³ã‚¯
Getting to know the Open Source Vulnerability (OSV) format â€“ Open Source Security Foundation
sho 2023/05/03
dependabotã®ã‚½ãƒ¼ã‚¹ãªã©ã«åˆ©ç”¨ã•ã‚Œã¦ã„ã‚‹ã€OSSç”¨ã®è„†å¼±æ€§ç®¡ç†ãƒ•ã‚©ãƒ¼ãƒžãƒƒãƒˆOSVã®å„ç¨®ãƒã‚¤ãƒ³ã‚¿

security

oss

dependabot
ãƒªãƒ³ã‚¯
è‡ªå •è½ãªæŠ€è¡“è€…ã®æ—¥è¨˜ : jsrsasignã®å¯„ä»˜é‡‘ã‚’å‹Ÿã‚‹ã“ã¨ã«ã—ã¦ã¿ã¾ã—ãŸ(ã‚„ã‚ŠãŒã„ã£ã¦ä½•ã ã£ã‘ï¼Ÿ) - livedoor Blogï¼ˆãƒ–ãƒã‚°ï¼‰
ç§ã¯jsrsasignã¨ã„ã†JavaScriptã®ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹æš—å·ã€PKIãƒ©ã‚¤ãƒ–ãƒ©ãƒªã‚’å€‹äººçš„ãªè¶£å‘³ã§é–‹ç™ºã—å…¬é–‹ã—ã¦ã„ã¾ã™ã€‚ã¨ã“ã‚ãŒæœ€è¿‘ã€npmãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã®ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ãŒæœˆé–“60ï½ž70ä¸‡ä»¶ã¨ã€ç•°å¸¸ã«ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‚‚å¢—ãˆã€è£½å“ã§ã‚‚ä½¿ã‚ã‚Œå§‹ã‚ã€ã¡ã‚‡ã£ã¨åŽ„ä»‹ãªã“ã¨ã«ãªã£ã¦ãŠã‚Šã€ã„ã‚ã„ã‚æ‚©ã‚“ã æŒ™ã’å¥ã€ã“ã‚ŒãŒæ£è§£ãªã®ã‹ã‚‚ã‚ã‹ã‚Šã¾ã›ã‚“ãŒã€ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã®ç¶æŒã®ãŸã‚ã«å¯„ä»˜é‡‘ã‚’å‹Ÿã‚‹ã“ã¨ã«ã—ãŸæ¬¡ç¬¬ã§ã™ã€‚ä»Šæ—¥ã¯ã€å¿ƒã®åéœ²ã‚’ã¤ã‚‰ã¤ã‚‰æ›¸ã„ã¦ã„ãã“ã¨ã«ã—ã¾ã™ã€‚ jsrsasignã¨ã¯ 2010å¹´ã”ã‚ã€ã‚¹ã‚¿ãƒ³ãƒ•ã‚©ãƒ¼ãƒ‰ã®å¦ç”Ÿã•ã‚“ã§ã‚ã‚‹Tom Wooã•ã‚“ã¨ã„ã†äººã®JavaScriptã§RSAæš—å·åŒ–ã§ãã‚‹ã‚³ãƒ¼ãƒ‰ã‚’è¦‹ã¤ã‘ã€è‡ªåˆ†ã¯PKIã‚„é›»åç½²åã‚’å°‚é–€ã«ã—ã¦ã„ãŸã®ã§ã€ŒJavaScriptã§RSAç½²åã§ããŸã‚‰é¢ç™½ã„ãªã€ã¨æ€ã„ã€2010å¹´6æœˆã«ã€ã»ã‚“ã®RSAç½²åå˜æ©Ÿèƒ½ã®ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã¨ã—ã¦å…¬é–‹ã—ãŸã®ãŒ jsrsasign ã§ã™ã€‚å½“æ™‚ã®ã¯ã—ã‚ƒãŽã£
sho 2020/07/22
oss

security
ãƒªãƒ³ã‚¯
IPAã€ä¸»è¦ãªã‚µãƒ¼ãƒå‘ã‘OSSã®â€œæ›´æ–°ã¾ã¨ã‚â€ã‚’é–‹è¨
å°åˆ·ã™ã‚‹ ãƒ¡ãƒ¼ãƒ«ã§é€ã‚‹ ãƒ†ã‚ã‚¹ãƒˆ HTML é›»åæ›¸ç± PDF ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ ãƒ†ã‚ã‚¹ãƒˆ é›»åæ›¸ç± PDF ã‚¯ãƒªãƒƒãƒ—ã—ãŸè¨˜äº‹ã‚’Myãƒšãƒ¼ã‚¸ã‹ã‚‰èªã‚€ã“ã¨ãŒã§ãã¾ã™ æƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹ï¼ˆIPAï¼‰ã¯6æœˆ27æ—¥ã€ä¸»è¦ãªã‚µãƒ¼ãƒå‘ã‘ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ï¼ˆOSSï¼‰ã®æ›´æ–°ã‚„ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«é–¢ã™ã‚‹æƒ…å ±ã‚’é›†ç´„ã—ã¦é…ä¿¡ã™ã‚‹ã‚¦ã‚§ãƒ–ãƒšãƒ¼ã‚¸ã‚’é–‹è¨ã—ãŸã€‚ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã®é‹å–¶è€…ã‚„æ§‹ç¯‰è€…ï¼ˆSIerãªã©ï¼‰ã€çµ„ç¹”å†…ã®ã‚·ã‚¹ãƒ†ãƒ ç®¡ç†è€…å‘ã‘ã«æƒ…å ±æä¾›ã™ã‚‹ã€‚ æä¾›å¯¾è±¡ã®OSSã¯ã€Apache HTTP Serverã€Apache Strutsã€Apache Tomcatã€ISC Bindã€Joomla!ã€OpenSSLã€WordPressã€‚é–‹ç™ºè€…ã‚„ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ãƒšãƒ¼ã‚¸ã€è„†å¼±æ€§ãªã©ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£é–¢é€£ã€æœ€æ–°ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã®æƒ…å ±ã¨æ³¨æ„å–šèµ·ãªã©ã®å‚è€ƒæƒ…å ±ã‚’ä¸€è¦§ã§è¡¨ç¤ºã—ã€è©³ç´°æƒ…å ±ã‚’æŽ²è¼‰ã—ã¦ã„ã‚‹ã‚³ãƒŸãƒ¥ãƒ‹ãƒ†ã‚£ãƒ¼ãƒšãƒ¼ã‚¸ãªã©ã¸ã®ãƒªãƒ³ã‚¯ã‚‚æä¾›ã™ã‚‹ã€‚ ã“ã‚Œã‚‰ã®OSSã¯
sho 2018/06/28
ãƒªã‚¹ãƒˆã®ã€Œä¸€æ˜”å‰æ„Ÿã€ã‚ˆã€‚ã‚‚ã¡ã‚ã‚“æ•°ãŒå¤šã„(ã—ã‹ã‚‚æ”¾ç½®ã•ã‚ŒãŒã¡)ã®ã¯ã‚ã‹ã‚‹ãŒã€‚

security

oss
ãƒªãƒ³ã‚¯
ã€ŒLinux Mintã€ã«ãƒãƒƒã‚¯ãƒ‰ã‚¢ã‚’ä»•è¾¼ã‚“ã ãƒãƒƒã‚«ãƒ¼ã€æ‰‹å£ã¨ç›®çš„ã‚’èªžã‚‹
å¤šæ•°ã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‚’é¨™ã—ã¦ã€ãƒãƒƒã‚¯ãƒ‰ã‚¢ãŒä»•è¾¼ã¾ã‚ŒãŸãƒãƒ¼ã‚¸ãƒ§ãƒ³ã®Linuxã‚’ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã•ã›ãŸä¸€åŒ¹ç‹¼ã®ãƒãƒƒã‚«ãƒ¼ æœ¬äººãŒã€å–æã§ãã®æ‰‹å£ã‚’æ˜Žã‚‰ã‹ã«ã—ãŸã€‚ ç±³å›½æ™‚é–“2æœˆ20æ—¥ã€ã€ŒLinux Mintã€ã®ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆãŒãƒãƒƒã‚ãƒ³ã‚°ã•ã‚Œã€ä¸¸1æ—¥ã«ã‚ãŸã£ã¦ã€æ‚ªæ„ã‚’æŒã£ã¦ã€Œãƒãƒƒã‚¯ãƒ‰ã‚¢ã€ãŒä»•è¾¼ã¾ã‚ŒãŸãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ãƒ•ã‚¡ã‚¤ãƒ«ã‚’ãƒ¦ãƒ¼ã‚¶ãƒ¼ã«æä¾›ã—ã¦ã„ãŸã¨ã„ã†ãƒ‹ãƒ¥ãƒ¼ã‚¹ãŒåºƒã¾ã£ãŸã€‚Linux Mintã¯ã€Linuxãƒ‡ã‚£ã‚¹ãƒˆãƒªãƒ“ãƒ¥ãƒ¼ã‚·ãƒ§ãƒ³ã¨ã—ã¦3ç•ªç›®ã«äººæ°—ãŒã‚ã‚‹ã¨è¨€ã‚ã‚Œã¦ã„ã‚‹ã€‚ ã“ã®ãƒ‹ãƒ¥ãƒ¼ã‚¹ã¯ã€åŒæ—¥ã«Linux Mintãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã®ãƒªãƒ¼ãƒ€ãƒ¼Clement Lefebvreæ°ã«ã‚ˆã£ã¦ç™ºè¡¨ã•ã‚ŒãŸã€‚ Lefebvreæ°ã¯ç™ºè¡¨ã‚’è¡Œã£ãŸãƒ–ãƒã‚°è¨˜äº‹ã§ã€å•é¡ŒãŒã‚ã‚‹ã®ã¯2æœˆ20æ—¥ä¸ã«ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã•ã‚ŒãŸã‚‚ã®ã ã‘ã§ã‚ã‚Šã€ã“ã®äº‹æ…‹ã‚’å—ã‘ã¦ã€ã•ã‚‰ãªã‚‹ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã‚’é˜²æ¢ã™ã‚‹ãŸã‚ã«ã€ã‚µã‚¤ãƒˆã‚’ä¸€æ™‚é–‰éŽ–ã—ãŸã¨è¿°ã¹ã¦ã„ã‚‹ã€‚ ã“ã®äº‹æ…‹ã‚’å¼•ãèµ·ã“ã—ãŸãƒãƒƒã‚«ãƒ¼ï¼ˆé€šç§°
sho 2016/02/25
security

linuxmint

oss
ãƒªãƒ³ã‚¯
ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ãªè£½å“ã§ã©ã†ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒã‚°ã‚’ãƒãƒ³ãƒ‰ãƒ«ã™ã‚‹ã‹ï¼Ÿ
Life with Web Browser Engine (Gecko, WebKit and etc), Mobile and etc. è‡ªåˆ†ãŒFirefox 26ã§ç›´ã—ãŸè©±ã§Security Bugã¨ã—ã¦ãƒžãƒ¼ã‚¯ã•ã‚Œã¦ã„ã‚‹ã®ãŒã‚ã£ãŸã‚“ã ã‘ã©ã€ãã‚Œã®è©±ã€‚ãƒã‚°è‡ªä½“ã¯ã€CVEç•ªå·ã¯æŒ¯ã‚‰ã‚Œã¦ã„ã‚‹ã‘ã©ãŸã ã®ã‚¯ãƒ©ãƒƒã‚·ãƒ¥ãªã®ã§Security Advisoriesã«ã¯è¼‰ã£ã¦ãªã„ã‚‚ã®ãã€‚ ä»Šã¾ã§ã‚‚ãŸã¾ã«Security bugè‡ªä½“ã¯ç›´ã—ã¦ãŸã‚Š (é¢å€’ã§ã‚ã‚Œã°ãƒã‚°ã‚’ç™»éŒ²ã€‚æœ€è¿‘ã‚‚ã—ãŸ) ã™ã‚‹ã‚“ã ã‘ã©ã€ã»ã¨ã‚“ã©ã®å ´åˆã¯ãƒªãƒªãƒ¼ã‚¹ç‰ˆã«ãªã£ã¦ã„ãªã„ãƒ™ãƒ¼ã‚¿ã¨ã‹Trunkã®ã‚‚ã®ã§ã®è©±ã®ãƒã‚°ã‚’ç›´ã™ã“ã¨ã°ã‹ã‚Šãªã®ã§ç¾åœ¨ã®ãƒ—ãƒã‚»ã‚¹ã«ç–Žã„ã“ã¨ãŒã‚ã‚‹ã‚“ã ã‘ã© (ä»Šã®æ—¥æœ¬ã®ã‚ªãƒ•ã‚£ã‚¹ã§åƒã„ã¦ã„ã‚‹äººé”ã«ã€ã„ã¾ã£ã¦ã“ã†ã„ã†ãƒ—ãƒã‚»ã‚¹ã«ãªã£ã¦ãŸã£ã¦çŸ¥ã£ã¦ãŸï¼Ÿã£ã¦èžã„ãŸã‚‰ã€ã€Œãˆã£ï¼Ÿã€ã£ã¦è¨€ã‚ãŸã®ã¯å†…ç·’)ã€ã“ã‚“ãªæ„Ÿã˜ã§å¯¾å¿œã™ã‚‹ã€‚ commitæ™‚
sho 2013/12/18
security

oss
ãƒªãƒ³ã‚¯
Ruby 1.9.2ãƒªãƒªãƒ¼ã‚¹ã¨WEBrickè„†å¼±æ€§å•é¡Œã®é¡›æœ« - è¥¿å°¾æ³°å’Œã®ã¯ã¦ãªãƒ€ã‚¤ã‚¢ãƒªãƒ¼
ã¯ã„ã€Ruby 1.9.2ãŒãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¾ã—ãŸãã€‚ã“ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã§ã¯WEBrick ã«ã‚¼ãƒãƒ‡ã‚¤æ”»æ’ƒå¯èƒ½ãªè„†å¼±æ€§ - ã‚¹ãƒ©ãƒƒã‚·ãƒ¥ãƒ‰ãƒƒãƒˆãƒ»ã‚¸ãƒ£ãƒ‘ãƒ³ã§ç´¹ä»‹ã•ã‚Œã¦ã„ã‚‹è„†å¼±æ€§ãŒåƒ•ãŒæ›¸ã„ãŸãƒ‘ãƒƒãƒã§ä¿®æ£ã•ã‚Œã¦ã„ã‚‹ã‚ã‘ãªã®ã§ã™ã‘ã©ã€ãã‚‚ãã‚‚ãªã‚“ã§åƒ•ãŒä¿®æ£ã—ã¦ã„ã‚‹ã®ã‹ã€ã£ã¦é¡›æœ«ãŒã‚ã‚Šã¨é¢ç™½ã„ã®ã§ç´¹ä»‹ã—ã¾ã™ã€‚ Appleã€upstreamã«å ±å‘Šã—ã¦ãã‚Œãªã„ã¾ã¾è„†å¼±æ€§ã‚’CVEã«å±Šã‘å‡ºã‚‹ upstreamã«é€£çµ¡ãŒæ¥ãªã„ã¾ã¾è„†å¼±æ€§ãŒå…¬é–‹ã•ã‚Œã‚‹ ruby-devã«AppleãŒæ›¸ã„ãŸã¨æ€ã‚ã‚Œã‚‹ãƒ‘ãƒƒãƒãŒè²¼ã‚‰ã‚Œã‚‹(Appleã§ãªã„äººé–“ã«ã‚ˆã£ã¦) ãƒ‘ãƒƒãƒã®ãƒ©ã‚¤ã‚»ãƒ³ã‚¹ãŒä¸æ˜Žãªã®ã§å–ã‚Šè¾¼ã‚ãªã„ ãƒ©ã‚¤ã‚»ãƒ³ã‚¹ã‚’å•ã„åˆã‚ã›ã‚‹Appleã®çª“å£ãŒä¸æ˜Žãªã®ã§å•ã„åˆã‚ã›ã‚‚ã§ããªã„ ruby-devã‚’èªã‚“ã äººã¯ãƒ©ã‚¤ã‚»ãƒ³ã‚¹ä¸Šå®‰å…¨ãªãƒ‘ãƒƒãƒã‚’æ›¸ã‘ãªã„ è„†å¼±æ€§ã ã‹ã‚‰è©±ã¯éžå…¬é–‹ã«é€²ã‚ãŸã„ yuguiã•ã‚“ãŒruby-devã‚’èªã‚“ã§ãªã„åƒ•ã«æ›¸ã‹ã›ã‚‹ã“ã¨ã«ã™ã‚‹
sho 2010/08/19
Appleã®ã‚¯ã‚½ã£ã·ã‚ŠãŒã¾ãŸã²ã¨ã¤ã€‚

ruby

security

oss

license

apple
ãƒªãƒ³ã‚¯
1