Trivy under attack again: GitHub Actions jɛnsɛnnenw tag bɛnkan gundo

Trivy bɛ binkanni senfɛ tugun : Widespread GitHub Actions tag compromise gundo

porogaramuw feereli cakɛda lakanani barika ka bon dɔrɔn i n' a fɔ a barika dɔgɔyalenba . Yiriwali jɛkulu jatebaliya la, o jɛɲɔgɔnya kɛra baarakɛminɛn yɛrɛ ye u bɛ u jigi da min kan walasa ka dɛsɛw sɔrɔ. Kow jiginni jɔrɔnanko dɔ la, Trivy, n’o ye da wulilen sɛgɛsɛgɛlikɛlan ye min bɛ fɔ kosɛbɛ, n’a bɛ mara Aqua Security fɛ, o y’a yɛrɛ sɔrɔ binkanni camanba dɔ cɛmancɛ la. Baarakɛla juguw ye sɛgɛsɛgɛli kɛcogo kɛrɛnkɛrɛnnen dɔ (`v0.48.0`) tiɲɛ a ka GitHub Actions marayɔrɔ kɔnɔ, ka kode pikiri kɛ min dabɔra ka gundo gɛlɛnw sonya baarakɛcogo o baarakɛcogo la min bɛ baara kɛ n’a ye. Nin ko in ye hakilijiginba ye ko an ka yiriwaliko siratigɛ la, dannaya ka kan ka sɛgɛsɛgɛ tuma bɛɛ, a man kan ka miiri.

Tag bɛnkan binkanni in farikololajɛ

Nin tun tɛ Trivy ka baarakɛminɛn jɔnjɔnw tiɲɛni ye , nka a ka CI/CD otomatiki sɛgɛsɛgɛli hakilitigiya dɔ tun don . Binkannikɛlaw ye GitHub Actions marayɔrɔ laɲini, ka `action.yml` filen jugu dɔ da `v0.48.0` taamasiyɛn kama. Ni baarakɛla dɔ ka baarakɛcogo ye o taamaʃyɛn kɛrɛnkɛrɛnnen in Lakodɔn, wale in tùn bɛ sɛbɛnni jugu dɔ Kɛ ka Sɔrɔ ka Trivy scan sariyalen Kɛ. O sɛbɛnni in dabɔra walasa ka gundo dɔw bɔ kɛnɛ kan — i n’a fɔ fɛnmarayɔrɔ taamasiyɛnw, sankaba dilanbagaw ka seereyaw, ani API kilisiw — ka taa yɔrɔjan baarakɛminɛn dɔ la min bɛ binkannikɛla bolo. Nin binkanni in namara cogoya bɛ a kɛrɛnkɛrɛnnenya la; baarakɛlaw minnu bɛ baara kɛ ni `@v0.48` walima `@main` taamasiyɛn lakananenw ye, olu ma nɔ bila, nka minnu ye taamasiyɛn tiɲɛnen tigitigi pinɛ, olu ye bɔnɛba dɔ don u ka pibiliki kɔnɔ k’a sɔrɔ u ma dɔn.

Mun na nin ko in bɛ mankan bɔ DevOps diɲɛ kɔnɔ

Trivy ka bɛnkan in nafa ka bon kun caman kosɔn . A fɔlɔ, Trivy ye lakana baarakɛminɛn jɔnjɔn ye min bɛ kɛ mɔgɔ miliyɔn caman fɛ walasa ka fɛnw sɛgɛsɛgɛ minnu bɛ se ka kɛ minɛnw ni kode kɔnɔ. Binkanni min bɛ kɛ lakana baarakɛminɛn dɔ kan, o bɛ dannaya jɔnjɔn tiɲɛ, dannaya min ka kan ka kɛ walasa ka yiriwali lakananen sɔrɔ. Filanan, a bɛ binkannikɛlaw ka taa "sanfɛ" cogoya min bɛ ka bonya, o jira, k’a ɲɛsin baarakɛminɛnw ni dannayakow ma, porozɛ wɛrɛw jɔlen bɛ minnu kan. Ni u ye baga don yɔrɔ kelen na min bɛ baara kɛ kosɛbɛ, u bɛ se ka se ka don porozɛw ni jɛkuluw ka ɲɔgɔnyeba dɔ la min bɛ duguma. Nin ko in bɛ kɛ ko kɛlenba ye min bɛ kɛ ka ɲɛsin fɛnw dilancogo lakanani ma, min b’a jira ko baarakɛminɛn si, hali n’a tɔgɔ bɔra cogo o cogo, a tɛ se ka kɛ binkannikɛlan ye.

ye "Nin binkanni in b'a jira ko faamuyali caman bɛ sɔrɔ yiriwalikɛlaw ka kɛwalew ni CI/CD mekanikiniw kan. Ka pinɛ kɛ version tag kɛrɛnkɛrɛnnen dɔ la, o bɛ jate tuma caman na ko wale ɲuman ye sabatili kama, nka nin ko in b'a jira ko a bɛ se ka farati fana don a la ni o version kɛrɛnkɛrɛnnen in tiɲɛna. Kalansen ye ko lakana ye taabolo ye min bɛ taa ɲɛ, a tɛ sigicogo ye min bɛ kɛ siɲɛ kelen."(Alimankan na)

teliya fɛɛrɛ minnu bɛ kɛ walasa ka i ka GitHub walew lakana

Nin ko in kɔfɛ, baarakɛlaw ni lakanajɛkuluw ka kan ka fɛɛrɛw tigɛ minnu bɛ se ka kɛ walasa k’u ka GitHub Actions baarakɛcogo gɛlɛya. Ka wasa sɔrɔ, o ye lakana jugu ye. Nin ye fɛɛrɛ nafamaw ye minnu bɛ se ka waleya joona :

• Ka baara kɛ ni commit SHA pinning ye taamasiyɛnw nɔ na : Tuma bɛɛ ka walew ɲɛfɔ u ka commit hash dafalen fɛ (misali la, `actions/checkout@a81bbbf8298c0fa03ea29cdc473d45769f953675`). O dɔrɔn de ye fɛɛrɛ ye min b’a jira ko i bɛ baara kɛ ni wale in cogoya ye min tɛ se ka Changé.
• aw ka sisan baarakɛcogo jateminɛ : aw ka `.github/workflows` ɲɛbilasɛbɛn sɛgɛsɛgɛ . Waleya minnu sirilen bɛ taamasiyɛnw na, olu dɔn ani k’u sɛmɛntiya ka kɛ SHAw ye, kɛrɛnkɛrɛnnenya la lakana baarakɛminɛn nafamaw kama.
• Aw ka GitHub ka lakana fɛɛrɛw ta : Aw ye cogoya sɛgɛsɛgɛli wajibiyalenw kɛ ani ka `workflow_permissions` sigicogo lajɛ, k’u bila kalan dɔrɔn na ka da a kan walasa ka tiɲɛni minnu bɛ se ka kɛ wale jugu dɔ la, olu dɔgɔya.
• Kɔlɔsili kɛ baara kɛcogo la min tɛ deli ka kɛ : Aw ye jatebɔ ni kɔlɔsili kɛ aw ka CI/CD pibilikiw la walasa ka bɔli rezow ɲɔgɔndanw dɔn minnu ma labɛn walima ka donko ɲininiw dɔn minnu ma yamaruya ni aw ka gundo ye.

Jɛkulu min bɛ se ka muɲu, o jɔli ni Mewayz ye

Hali ni baarakɛminɛn kelen-kelen bɛɛ lakanani nafa ka bon kosɛbɛ, muɲuli lakika bɛ bɔ fɛɛrɛ bɛɛjɛfanga la i ka jago baarakɛcogo la. Ko minnu kɛra i n’a fɔ Trivy ka bɛnkan, olu bɛ gɛlɛya dogolenw ni faratiw jira minnu bɛ bi baarakɛminɛnw kɔnɔ. Plateforme min bɛ i n’a fɔ Mewayz, o bɛ o ɲɛnabɔ ni jago OS kelen ye, min bɛ modulu, min bɛ dɔ bɔ dependency sprawl la ani ka controle centralize. Sani a ka baara kɛ ni baarakɛminɛn tan ni fila ye minnu tɛ kelen ye — u kelen-kelen bɛɛ n’u ka lakana misali n’u ka fɛnkurabɔcogo — Mewayz bɛ baara kolomaw i n’a fɔ poroze ɲɛnabɔli, CRM ani sɛbɛnw ɲɛnabɔcogo fara ɲɔgɔn kan ka kɛ sigida kelen ye, min lakananen don. O jɛ-ka-baara in bɛ binkanni-yɔrɔ dɔgɔya ani ka lakana mara nɔgɔya, o b’a to ekipuw bɛ se k’u sinsin fɛnw jɔli kan sanni u ka to ka bɔnɛw labɛn porogaramuw kulu tilalen dɔ kɔnɔ. Diɲɛ kɔnɔ, taamasiyɛn kelen min bɛ se ka kɛ fɛn ye min bɛ se ka kɛ sababu ye ka sariya tiɲɛniba kɛ, lakana jɛlen ni baarakɛcogo nɔgɔman minnu bɛ di Mewayz fɛ, olu bɛ kɛ sababu ye ka bonya jusigilan dɔ di min bɛ kɔlɔsi kosɛbɛ ani min bɛ se ka jateminɛ.

Ɲininkali minnu bɛ kɛ tuma caman na

Trivy bɛ binkanni senfɛ tugun : Widespread GitHub Actions tag compromise gundo

porogaramuw feereli cakɛda lakanani barika ka bon dɔrɔn i n' a fɔ a barika dɔgɔyalenba . Yiriwali jɛkulu jatebaliya la, o jɛɲɔgɔnya kɛra baarakɛminɛn yɛrɛ ye u bɛ u jigi da min kan walasa ka dɛsɛw sɔrɔ. Kow jiginni jɔrɔnanko dɔ la, Trivy, n’o ye da wulilen sɛgɛsɛgɛlikɛlan ye min bɛ fɔ kosɛbɛ, n’a bɛ mara Aqua Security fɛ, o y’a yɛrɛ sɔrɔ binkanni camanba dɔ cɛmancɛ la. Baarakɛla juguw ye sɛgɛsɛgɛli kɛcogo kɛrɛnkɛrɛnnen dɔ (`v0.48.0`) tiɲɛ a ka GitHub Actions marayɔrɔ kɔnɔ, ka kode pikiri kɛ min dabɔra ka gundo gɛlɛnw sonya baarakɛcogo o baarakɛcogo la min bɛ baara kɛ n’a ye. Nin ko in ye hakilijiginba ye ko an ka yiriwaliko siratigɛ la, dannaya ka kan ka sɛgɛsɛgɛ tuma bɛɛ, a man kan ka miiri.

Tag bɛnkan binkanni in farikololajɛ

Nin tun tɛ Trivy ka baarakɛminɛn jɔnjɔnw tiɲɛni ye , nka a ka CI/CD otomatiki sɛgɛsɛgɛli hakilitigiya dɔ tun don . Binkannikɛlaw ye GitHub Actions marayɔrɔ laɲini, ka `action.yml` filen jugu dɔ da `v0.48.0` taamasiyɛn kama. Ni baarakɛla dɔ ka baarakɛcogo ye o taamaʃyɛn kɛrɛnkɛrɛnnen in Lakodɔn, wale in tùn bɛ sɛbɛnni jugu dɔ Kɛ ka Sɔrɔ ka Trivy scan sariyalen Kɛ. O sɛbɛnni in dabɔra walasa ka gundo dɔw bɔ kɛnɛ kan — i n’a fɔ fɛnmarayɔrɔ taamasiyɛnw, sankaba dilanbagaw ka seereyaw, ani API kilisiw — ka taa yɔrɔjan baarakɛminɛn dɔ la min bɛ binkannikɛla bolo. Nin binkanni in namara cogoya bɛ a kɛrɛnkɛrɛnnenya la; baarakɛlaw minnu bɛ baara kɛ ni `@v0.48` walima `@main` taamasiyɛn lakananenw ye, olu ma nɔ bila, nka minnu ye taamasiyɛn tiɲɛnen tigitigi pinɛ, olu ye bɔnɛba dɔ don u ka pibiliki kɔnɔ k’a sɔrɔ u ma dɔn.

Mun na nin ko in bɛ mankan bɔ DevOps diɲɛ kɔnɔ

Trivy ka bɛnkan in nafa ka bon kun caman kosɔn . A fɔlɔ, Trivy ye lakana baarakɛminɛn jɔnjɔn ye min bɛ kɛ mɔgɔ miliyɔn caman fɛ walasa ka fɛnw sɛgɛsɛgɛ minnu bɛ se ka kɛ minɛnw ni kode kɔnɔ. Binkanni min bɛ kɛ lakana baarakɛminɛn dɔ kan, o bɛ dannaya jɔnjɔn tiɲɛ, dannaya min ka kan ka kɛ walasa ka yiriwali lakananen sɔrɔ. Filanan, a bɛ binkannikɛlaw ka taa "sanfɛ" cogoya min bɛ ka bonya, o jira, k’a ɲɛsin baarakɛminɛnw ni dannayakow ma, porozɛ wɛrɛw jɔlen bɛ minnu kan. Ni u ye baga don yɔrɔ kelen na min bɛ baara kɛ kosɛbɛ, u bɛ se ka se ka don porozɛw ni jɛkuluw ka ɲɔgɔnyeba dɔ la min bɛ duguma. Nin ko in bɛ kɛ ko kɛlenba ye min bɛ kɛ ka ɲɛsin fɛnw dilancogo lakanani ma, min b’a jira ko baarakɛminɛn si, hali n’a tɔgɔ bɔra cogo o cogo, a tɛ se ka kɛ binkannikɛlan ye.

Teliya fɛɛrɛ minnu bɛ kɛ walasa k’aw ka GitHub walew lakana

Nin ko in kɔfɛ, baarakɛlaw ni lakanajɛkuluw ka kan ka fɛɛrɛw tigɛ minnu bɛ se ka kɛ walasa k’u ka GitHub Actions baarakɛcogo gɛlɛya. Ka wasa sɔrɔ, o ye lakana jugu ye. Nin ye fɛɛrɛ nafamaw ye minnu bɛ se ka waleya joona :

Jɛkulu min bɛ se ka muɲu, o jɔli ni Mewayz ye

Hali ni baarakɛminɛn kelen-kelen bɛɛ lakanani nafa ka bon kosɛbɛ, muɲuli lakika bɛ bɔ fɛɛrɛ bɛɛjɛfanga la i ka jago baarakɛcogo la. Ko minnu kɛra i n’a fɔ Trivy ka bɛnkan, olu bɛ gɛlɛya dogolenw ni faratiw jira minnu bɛ bi baarakɛminɛnw kɔnɔ. Plateforme min bɛ i n’a fɔ Mewayz, o bɛ o ɲɛnabɔ ni jago OS kelen ye, min bɛ modulu, min bɛ dɔ bɔ dependency sprawl la ani ka controle centralize. Sani a ka baara kɛ ni baarakɛminɛn tan ni fila ye minnu tɛ kelen ye — u kelen-kelen bɛɛ n’u ka lakana misali n’u ka fɛnkurabɔcogo — Mewayz bɛ baara kolomaw i n’a fɔ poroze ɲɛnabɔli, CRM ani sɛbɛnw ɲɛnabɔcogo fara ɲɔgɔn kan ka kɛ sigida kelen ye, min lakananen don. O jɛ-ka-baara in bɛ binkanni-yɔrɔ dɔgɔya ani ka lakana mara nɔgɔya, o b’a to ekipuw bɛ se k’u sinsin fɛnw jɔli kan sanni u ka to ka bɔnɛw labɛn porogaramuw kulu tilalen dɔ kɔnɔ. Diɲɛ kɔnɔ, taamasiyɛn kelen min bɛ se ka kɛ fɛn ye min bɛ se ka kɛ sababu ye ka sariya tiɲɛniba kɛ, lakana jɛlen ni baarakɛcogo nɔgɔman minnu bɛ di Mewayz fɛ, olu bɛ kɛ sababu ye ka bonya jusigilan dɔ di min bɛ kɔlɔsi kosɛbɛ ani min bɛ se ka jateminɛ.