Hadda waa la heli karaa nooca cusbooneysiinta cusub diyo "cURL 7.71.0", oo ay diiradda ku saareen xallinta laba cayayaan oo halis ah kaas oo u oggolaanaya furayaasha sirta ah iyo sidoo kale awoodda dib loo qoro faylasha. Taasi waa sababta casuumaadda loogu casriyaynayo nooca cusub loo sameeyay.
Kuwa aan ka warqabin utility this, waa inay ogaadaan taas u adeegta si loo helo loona diro xogta shabakadda, Waxay bixisaa awooda si dabacsan u sameysato codsi adoo dejinaya cabirrada sida cookie, user_agent, referer, iyo cinwaan kale oo kasta.
usu waxay taageertaa HTTP, HTTPS, HTTP / 2.0, HTTP / 3, SMTP, IMAP, POP3, Telnet, FTP, LDAP, RTSP, RTMP, iyo hab maamuuska kale ee shabakada. Isla mar ahaantaana, cusbooneysiin isbarbar dhig ah ayaa loo sii daayay maktabadda libcurl, oo bixisa API si loogu isticmaalo dhammaan howlaha curl ee barnaamijyada luqadaha sida C, Perl, PHP, Python.
Isbedelada ugu waaweyn ee CURL 7.71.0
Noocani cusubi waa cusbooneysiin sidaan horeba u soo sheegnayna waxay u timid xalinta laba khalad, kuwaas oo ah kuwa soo socda:
- U nuglaanta CVE-2020-8177- Tani waxay u oggolaaneysaa weeraryahan inuu ku dul qoro faylka maxalliga ah nidaamka markii uu galayo server-ka weerarka la xakameeyey. Dhibaatada kaliya ayaa is muujisa marka xulashooyinka "-J" ("-remote-header-name") iyo "-i" ("--head") isku mar la isticmaalo.
Doorashada "-J" wuxuu kuu ogolaanayaa inaad ku keydisato feylka magaca la cayimay ku jira cinwaanka "Mawduuc-ka-dhigid". Swaxaan horey ujiray feyl isku magac ah, barnaamijka curlku caadi ahaan wuu diidaa inuu dib u qoro, laakiin haddii ikhtiyaarka "-I" waa la joogaa, caqli galinta xaqiijinta ayaa la jabiyay oo dib loo qoray faylka (xaqiijinta waxaa lagu sameeyaa marxaladda soo dhaweynta jirka, laakiin ikhtiyaarka ah "-i" madaxa HTTP ayaa baxa marka hore waxayna haystaan waqti ay ku adkeystaan ka hor intaan la shaqeynin jirka jawaabta). Kaliya madaxyada HTTP ayaa loo qoraa faylka.
- Jilicsanaanta CVE-2020-8169: tani waxay sababi kartaa in ay soo daadato server-ka DNS ee furayaasha sirta ah qaarkood si ay u galaan goobta (Basic, Digest, NTLM, iwm).
Markaad isticmaaleyso "@" astaamaha erayga sirta ah, oo sidoo kale loo adeegsado xaddid sirta ah ee URL-ka, marka HTTP-ga la kicinayo, curlku wuxuu soo diri doonaa qayb ka mid ah lambarka sirta ah ka dib dabeecadda "@" oo ay weheliso bogga si loo go'aamiyo magac.
Tusaale ahaan, haddii aad sheegto erayga sirta ah "passw @ passw" iyo magaca isticmaale "isticmaale", curl wuxuu abuuri doonaa cinwaanka "https: // user: passw @ passw @ example.com / path" halkii laga dhigi lahaa "https: user: passw % 40passw@example.com/path "oo u dir codsi si aad u xalliso martida" pasww@example.com "halkii laga dhigi lahaa" example.com ".
Dhibaatadu waxay muujineysaa lafteeda marka ay awood u siinayso taageerada wareejinta HTTP Qaraabo (waxaa loo naafoobiyey CURLOPT_FOLLOWLOCATION).
Xaaladda isticmaalka DNS dhaqameed, adeeg bixiyaha DNS-ka iyo weeraryahanku waxay ka heli karaan macluumaad ku saabsan qayb ka mid ah lambarka sirta ah, kaas oo dhexda ka gali kara taraafikada taraafikada (xitaa haddii codsigii asalka ahaa laga soo gudbiyay HTTPS, maadaama taraafikada DNS aysan ahayn kuwo sir ah). Markaad isticmaaleyso DNS ka badan HTTPS (DoH), daadinta waxay ku egtahay bayaanka DoH.
Ugu dambeyntiina, mid ka mid ah isbeddelada lagu soo daray nooca cusub ayaa ah ku darista ikhtiyaarka "–rery-all-qaladyada" ee isku dayga soo noqnoqda ah ee lagu doonayo in lagu sameeyo hawlgallada marka qalad dhaco.
Sidee loo rakibaa cURL Linux?
Kuwa xiiseynaya inay awoodaan inay soo rogaan nuqulkan cusub ee 'CURL' Way ku samayn karaan iyagoo soo dejista koodhka ilaha oo ay soo ururiyaan.
Si tan loo sameeyo, waxa ugu horreeya ee aan sameyn doonno waa inaan soo dejino xirmada ugu dambeysa ee curl iyadoo gacan ka heleysa terminaalka, gudaha aan qorno:
wget https://curl.haxx.se/download/curl-7.71.0.tar.xz
Kadib, waxaan fureynaa xirmada la soo dejiyey:
tar -xzvf curl-7.71.0.tar.xz
Waxaan ku galnaa galka cusub ee la abuuray:
cd curl-7.71.0
Waxaan ku galnaa xidid ahaan:
sudo su
Oo waxaan ku qoreynaa waxyaabaha soo socda:
./configure --prefix=/usr \ --disable-static \ --enable-threaded-resolver \ --with-ca-path=/etc/ssl/certs &&
make make install && rm -rf docs/examples/.deps &&
find docs \( -name Makefile\* -o -name \*.1 -o -name \*.3 \) -exec rm {} \; &&
install -v -d -m755 /usr/share/doc/curl-7.71.0 && cp -v -R docs/* /usr/share/doc/curl-7.71.0
Ugu dambeyntii waxaan ku hubin karnaa nooca:
curl --version
Haddii aad rabto inaad waxbadan ka ogaato, waad la tashan kartaa xiriirka soo socda.