2023年 人気脆弱性 TOP 10 in GitHub

スライド版「2023年 人気脆弱性 TOP 10 in GitHub - まったり技術ブログ」
https://blog.motikan2010.com/entry/2023/12/26/2023%E5%B9%B4_%E4%BA%BA%E6%B0%97%E8%84%86%E5%BC%B1%E6%80%A7_TOP_10_in_GitHub

Transcript

1. ೥
   ਓؾ੬ऑੑ
   501
   
   JO
   (JU)VC 2024/01/02 motikan2010
2. είΞͷࢉग़ํ๏ ϥϯΩϯάʹར༻͢ΔείΞͷࢉग़ํ๏
   ɾᶃ
   ϦϙδτϦຖʹ
   QU
   ɾᶄ
   ελʔຖʹ
   QU
   ɹɹɹɹ ➡︎ ʮᶃʴᶄͷ߹ܭQUʯͷείΞͰϥϯΩϯάΛ࡞੒ ର৅ͱͳΔ੬ऑੑ ݄ʹެ։͞Εͨ੬ऑੑ͸౰೥ͷௐࠪର৅͔Βআ֎͢ΔΑ͏ʹͳ͍ͬͯ·͢ɻ
   ɹɹɹɹɹɹɹɹɹɹɹɹʮ$7& ʯ͔ͭʮެද೔͕
   
   Ҏલʯ
   ɹɹɹɹɹɹɹɹɹɹɹɹʮ$7& ʯ͔ͭʮެද೔͕
   
   Ҏ߱ʯ
   ʢ݄ʹެ։͞Εͨ੬ऑੑ͕ෆརʹͳΒͳ͍Α͏ʹ͢Δ͜ͱ͕໨తʣ
3. Ґ
   
   QU
   "UMBTTJBOࣾͷ
   $PO fl VFODF
   %BUB
   $FOUFS
   ͓Αͼ
   4FSWFS
   
   ʹ͓͚ΔΞΫηε੍ޚഁଛͷ੬ऑੑʢ$7&ʣ "UMBTTJBO͕ࣾఏڙ͍ͯ͠Δʮ$PO fl VFODF
   4FSWFSʯʮ%BUB
   $FOUFSʯͷ੬ऑੑ
   ϦϞʔτΑΓঝೝͳ͠ʹʮ؅ཧऀΞΧ΢ϯτʯΛ࡞੒͠ɺΠϯελϯεʹରͯ͠ΞΫηε͢ Δ͜ͱ͕Մೳ
   ຊ੬ऑੑΛར༻ͨ͠ͱࢥΘΕΔෆਖ਼ͳΞΫηε͕Ұ෦ސ٬ʢϢʔβʣΑΓใࠂΛड͚͍ͯΔ
   ط஌ͷࠃՈ߈ܸऀ͕
   $7&
   Λੵۃతʹѱ༻͍ͯ͠Δ͜ͱΛࣔࠦ͢ΔূڌΛಘΒ Ε͍ͯΔ
   $*4"
   ,&7
   ʹ௥Ճʢ೥݄೔ʣ
4. Ґ
   
   QU
   $JUSJYࣾͷωοτϫʔΫػث
   $JUSJY
   "%$
   ͓Αͼ
   $JUSJY
   (BUFXBZ
   ʹೝূෆཁͷ3$&ͷ੬ऑੑʢ$7&ʣ $JUSJYࣾͷʮ$JUSJY
   /FU4DBMFS
   "%$ʢ$JUSJY
   "%$ʣʯ͓Αͼʮ/FU4DBMFS
   (BUFXBZʢ$JUSJY
   (BUFXBZʣʯͷ੬ऑੑ
   ѱ༻͞ΕΔͱೝূ͞Ε͍ͯͳ͍ԕִͷୈࡾऀ͕೚ҙͷίʔυΛ࣮ߦ͕Մೳ
   $JUSJY͸੬ऑੑΛѱ༻͢Δ߈ܸΛ֬ೝ͍ͯ͠Δ
   $*4"
   ,&7
   ʹ௥Ճʢ೥݄೔ʣ
   +1$&35$$
   ͔Β஫ҙשى͋Γ
5. Ґ
   
   QU
   -JOVY
   LFSOFM
   ͷݖݶঢ֨ͷՄೳੑͷ੬ऑੑ
   ʢ$7&ʣ ҰൠݖݶΞΧ΢ϯτͰ੬ऑͳ
   -JOVY
   γεςϜ΁ͷ৵ೖʹ੒ޭͨ͠߈ܸऀ͸ɺSPPU
   ݖݶ΁ͷ ঢ͕֨Մೳ
6. Ґ
   
   QU
   ύεϫʔυ؅ཧπʔϧʮ,FF1BTTʯʹϝϞϦμϯϓͰ
   ϚελʔύεϫʔυΛ෮ݩͰ͖Δ੬ऑੑʢ$7&ʣ ,FF1BTT
   ͸
   8JOEPXTɾ.BDɾ-JOVY
   ্Ͱಈ࡞͢ΔਓؾͷΦʔϓϯιʔεͷύεϫʔυϚωʔ δϟʔ
   ࣮ߦதͷϓϩηεͷϝϞϦ͔ΒϚελʔΩʔΛฏจͰநग़͢Δ͜ͱ͕Ͱ͖Δ੬ऑੑ
   ϚελʔΩʔʹΑΓ߈ܸऀ͸อଘ͞Ε͍ͯΔ͢΂ͯͷೝূ৘ใʹΞΫηε͢Δ͜ͱ͕Ͱ ͖ΔΑ͏ʹͳΔ
7. Ґ
   
   QU
   -JOVYͷඪ४$ϥΠϒϥϦʢ(/6
   $ϥΠϒϥϦʣʹ͓͚ΔόοϑΝ Φʔόʔϑϩʔͷ੬ऑੑʢ$7&
   
   -PPOFZ
   5VOBCMFTʣ ೥݄ʹൃݟ͞Εͨ-JOVYͷඪ४$ϥΠϒϥϦʢ(/6
   $ϥΠϒϥϦ͋Δ͍͸HMJCDʣʹ ͓͚ΔόοϑΝΦʔόʔϑϩʔͷ੬ऑੑ
   ߈ܸऀ͸੬ऑੑΛѱ༻͠ɺSPPUݖݶ΁ͷঢ֨΍ෆਖ਼ΞΫηεΛߦ͏͜ͱ͕Մೳ
   $*4"
   ,&7
   ʹ௥Ճʢ೥݄೔ʣ
8. Ґ
   
   QU
   .JDSPTPGUࣾͷ
   8JO4PDL
   ༻
   8JOEPXT
   "ODJMMBSZ
   'VODUJPO
   %SJWFS
   ʹݖݶঢ֨ͷ੬ऑੑ
   ʢ$7&ʣ .JDSPTPGU
   8JOEPXT
   
   ͱ.JDSPTPGU
   8JOEPXT
   4FSWFS
   
   ͕ର৅
   .JDSPTPGU
   8JOEPXT
   04
   ʹ
   4:45&.
   ݖݶ΁ͷঢ͕֨ՄೳͱͳΔ੬ऑੑ
9. Ґ
   
   QU
   *NBHF.BHJDL
   ͷݕূෆඋʹΑΓ೚ҙͷϑΝΠϧ͕ಡΈऔΓՄೳͱͳ Δ੬ऑੑʢ$7&ʣ ѱҙͷ͋Δ
   1/(
   ϑΝΠϧͷม׵ʹΑΓɺγεςϜ্ͷ೚ҙͷϑΝΠϧ͕ಡΈऔΒΕΔ
10. Ґ
    
    QU
    8JOEPXTࣾͷ
    .JDSPTPGU
    0VUMPPL
    ʹ͓͚Δಛݖঢ֨ͷ੬ऑੑ
    ʢ$7&ʣ 8JOEPXT
    .JDSPTPGU
    0VUMPPL
    ΫϥΠΞϯτͷ੬ऑੑ
    ੬ऑੑΛѱ༻͢Δ͜ͱͰɺ߈ܸର৅ωοτϫʔΫͷΞΧ΢ϯτͱೝূ৘ใΛ઄औ͢Δ͜ͱɺ ΋͘͠͸Ϛϧ΢ΣΞͳͲͷϖΠϩʔυΛૹΓࠐΉ͜ͱ͕ՄೳʹͳΔ
    ϢʔβͷհࡏΛඞཁͱ͠ͳ͍ʢθϩλονʣͷ੬ऑੑ
    $*4"
    ,&7
    ʹ௥Ճʢ೥݄೔ʣ
11. Ґ
     
    QU
    3"3-"#
    8JO3"3
    ͷ;*1ϑΝΠϧӾཡ࣌ʹ
    ೚ҙͷίʔυ࣮ߦͱͳΔ੬ऑੑ
    ʢ$7&ʣ ;*1
    ΞʔΧΠϒ಺ͷྑੑͷϑΝΠϧΛӾཡ͠Α͏ͱ͢Δࡍʹ߈ܸऀʹΑΔ೚ҙͷίʔυ࣮ߦ ͕ߦΘΕΔՄೳੑ
    (SPVQ*#
    ͷௐࠪ݁ՌʹΑΔͱɺ͜ͷ੬ऑੑ͸೥݄Ҏ߱ʹτϨʔμʔΛඪతʹ͢Δθ ϩσΠ߈ܸͰར༻͞Εͨ
    $*4"
    ,&7
    ʹ௥Ճʢ೥݄೔ʣ
12. Ґ
     
    QU
    NBD04
    ʹ͓͚Δݖݶঢ֨͞ΕΔ੬ऑੑ
    ʢ$7&
    
    .BD%JSUZ$PXʣ ΞϓϦ͕ΧʔωϧݖݶͰ೚ҙͷίʔυΛ࣮ߦͰ͖ΔՄೳੑ
    J1IPOFͷվ଄ʹར༻͞Ε͍ͯΔ੬ऑੑ
    ҰൠͷJ1IPOFϢʔβ͕ར༻͢Δ੬ऑੑͷͨΊਓؾͱߟ͑ΒΕΔ
13. ·ͱΊ ॱҐ είΞ ެද೔ $7&
    *% ϦϙδτϦ਺ ελʔ߹ܭ $*4"
    ,&7 ֓ཁ Ґ    $7&    NBD04
    ʹ͓͚Δݖݶঢ֨͞ΕΔ੬ऑੑ Ґ    $7&    ✅ 3"3-"#
    8JO3"3
    ͷ;*1ϑΝΠϧӾཡ࣌ʹ೚ҙͷίʔυ࣮ߦͱͳΔ੬ऑੑ Ґ   $7&   ✅ 8JOEPXTࣾͷ
    .JDSPTPGU
    0VUMPPL
    ʹ͓͚Δಛݖঢ֨ͷ੬ऑੑ Ґ   $7&   *NBHF.BHJDL
    ͷݕূෆඋʹΑΓ೚ҙͷϑΝΠϧ͕ಡΈऔΓՄೳͱͳΔ੬ऑੑ Ґ   $7&   .JDSPTPGUࣾͷ
    8JO4PDL
    ༻
    8JOEPXT
    "ODJMMBSZ
    'VODUJPO
    %SJWFS
    ʹݖݶঢ֨ͷ੬ऑੑ Ґ   $7&   ✅ -JOVYͷඪ४$ϥΠϒϥϦʢ(/6
    $ϥΠϒϥϦʣʹ͓͚ΔόοϑΝΦʔόʔϑϩʔͷ੬ऑੑ Ґ   $7&   ύεϫʔυ؅ཧπʔϧʮ,FF1BTTʯʹϝϞϦμϯϓͰϚελʔύεϫʔυΛ෮ݩͰ͖Δ੬ऑੑ Ґ   $7&   -JOVY
    LFSOFM
    ͷݖݶঢ֨ͷՄೳੑͷ੬ऑੑ Ґ   $7&   ✅ $JUSJYࣾͷωοτϫʔΫػث
    $JUSJY
    "%$
    ͓Αͼ
    $JUSJY
    (BUFXBZ
    ʹೝূෆཁͷ3$&ͷ੬ऑੑ Ґ   $7&   ✅ "UMBTTJBOࣾͷ
    $PO fl VFODF
    %BUB
    $FOUFS
    ͓Αͼ
    4FSWFS
    ʹ͓͚ΔΞΫηε੍ޚഁଛͷ੬ऑੑ
14. ࢀߟ̍ "UMBTTJBOࣾͷ
    $PO fl VFODF
    %BUB
    $FOUFS
    ͓Αͼ
    4FSWFS
    ʹ͓͚ΔΞΫηε੍ޚഁଛͷ੬ऑੑʢ$7&ʣ
    ▶︎
    ΞτϥγΞϯ
    αϙʔτ
    c
    $PO fl VFODF
    %BUB
    $FOUFS
    ͓Αͼ
    4FSWFS
    ʹ͓͚ΔΞΫηε੍ޚഁଛͷ੬ऑੑ
    IUUQTKBDPO fl VFODFBUMBTTJBODPNTFDVSJUZDWFQSJWJMFHFFTDBMBUJPOWVMOFSBCJMJUZJODPO fl VFODFEBUBDFOUFSBOE TFSWFSIUNM
    ▶︎
    4FDVSJUZ
    /&95
    c
    ʮ"UMBTTJBO
    $PO fl VFODFʯʹθϩσΠ੬ऑੑ
    
    ৵֐ঢ়گͷ֬ೝΛ
    IUUQTXXXTFDVSJUZOFYUDPN $JUSJYࣾͷωοτϫʔΫػث
    $JUSJY
    "%$
    ͓Αͼ
    $JUSJY
    (BUFXBZ
    ʹೝূෆཁͷ3$&ͷ੬ऑੑʢ$7&ʣ
    ▶︎
    +1$&35$$
    c
    $JUSJY
    "%$͓Αͼ$JUSJY
    (BUFXBZͷ੬ऑੑʢ$7&ʣʹؔ͢Δ஫ҙשى
    IUUQTXXXKQDFSUPSKQBUBUIUNM
    ▶︎
    1BMP
    "MUP
    /FUXPSLT
    c
    ڴҖʹؔ͢Δ৘ใ
    ސ٬؅ཧԼͷ
    $JUSJY
    αʔόʔʹϦϞʔτίʔυ࣮ߦͷ੬ऑੑ
    IUUQTVOJUQBMPBMUPOFUXPSLTKQUISFBUCSJFGDJUSJYDWF -JOVY
    LFSOFM
    ͷݖݶঢ֨ͷՄೳੑͷ੬ऑੑ
    ʢ$7&ʣ
    ▶︎
    4DBO/FU4FDVSJUZ
    c
    0GFSMBZGT
    ϑΝΠϧγεςϜʹ͓͍ͯҟͳΔϚ΢ϯτؒͰͷϑΝΠϧϚοϐϯάෆඋʹΑΓݖݶঢ͕֨ՄೳͱͳΔ੬ऑੑ
    ʢ4DBO
    5FDI
    3FQPSUʣ
    
    IUUQTTDBOOFUTFDVSJUZOFKQBSUJDMFIUNM
    ▶︎
    4*04
    4&$63*5:
    #-0(
    c
    -JOVY
    ,FSOFMͷ੬ऑੑ *NQPSUBOU
    $7&
    IUUQTTFDVSJUZTJPTKQWVMOFSBCJMJUZLFSOFMTFDVSJUZWVMOFSBCJMJUZ
15. ࢀߟ̎ ύεϫʔυ؅ཧπʔϧʮ,FF1BTTʯʹϝϞϦμϯϓͰϚελʔύεϫʔυΛ෮ݩͰ͖Δ੬ऑੑʢ$7&ʣ
    ▶︎
    4ZTEJH
    c
    ,FF1BTT
    $7&ɿϓϩηεϝϞϦʔμϯϓͷݕ஌
    IUUQTTZTEJHKQCMPHLFFQBTTDWFEFUFDUJPO
    ▶︎
    ૭ͷై
    c
    ϑϦʔͷύεϫʔυ؅ཧπʔϧʮ,FF1BTTʯʹ੬ऑੑɺϚελʔύεϫʔυΛ෮ݩ͞ΕΔ
    IUUQTGPSFTUXBUDIJNQSFTTDPKQEPDTOFXTIUNM -JOVYͷඪ४$ϥΠϒϥϦʢ(/6
    $ϥΠϒϥϦʣʹ͓͚ΔόοϑΝΦʔόʔϑϩʔͷ੬ऑੑʢ$7&
    
    -PPOFZ
    5VOBCMFTʣ
    ▶︎
    40.10
    $:#&3
    4&$63*5:
    c
    -PPOFZ
    5VOBCMFTͱ͸ʲ༻ޠूৄࡉʳ
    IUUQTXXXTPNQPDZCFSTFDVSJUZDPNDPMVNOHMPTTBSZMPPOFZUVOBCMFT
    ▶︎
    *P5
    05
    4FDVSJUZ
    /FXT
    c
    $*4"
    ,&7
    ܯࠂ
    ɿ-JOVY
    ͷ
    -PPOFZ
    5VOBCMFT
    Λѱ༻Ϧετʹ௥Ճ
    IUUQTJPUPUTFDOFXTKQDJTBPSEFSTGFEFSBMBHFODJFTUPQBUDIMPPOFZUVOBCMFTMJOVYCVH .JDSPTPGUࣾͷ
    8JO4PDL
    ༻
    8JOEPXT
    "ODJMMBSZ
    'VODUJPO
    %SJWFS
    ʹݖݶঢ֨ͷ੬ऑੑ
    ʢ$7&ʣ
    ▶︎
    $7&
    
    ηΩϡϦςΟߋ৽ϓϩάϥϜ
    ΨΠυ
    
    .JDSPTPGU
    
    8JO4PDL
    ༻
    8JOEPXT
    "ODJMMBSZ
    'VODUJPO
    %SJWFS
    ͷಛݖͷঢ֨ͷ੬ ऑੑ
    IUUQTNTSDNJDSPTPGUDPNVQEBUFHVJEFWVMOFSBCJMJUZ$7&
    ▶︎
    4DBO/FU4FDVSJUZ
    .JDSPTPGU
    8JOEPXT
    04
    ʹ͓͚Δ
    8JOTPDL
    ͰͷσʔλݕূෆඋʹىҼ͢Δݖݶঢ͕֨ՄೳͱͳΔ੬ऑੑʢ4DBO
    5FDI
    3FQPSUʣ
    IUUQTTDBOOFUTFDVSJUZOFKQBSUJDMFIUNM
    ▶︎
    +7/%#
    
    +7/
    J1FEJB
    
    ੬ऑੑରࡦ৘ใσʔλϕʔε
    IUUQTKWOECKWOKQKBDPOUFOUT+7/%#IUNM
16. ࢀߟ̏ *NBHF.BHJDL
    ͷݕূෆඋʹΑΓ೚ҙͷϑΝΠϧ͕ಡΈऔΓՄೳͱͳΔ੬ऑੑʢ$7&ʣ
    ▶︎
    4DBO/FU4FDVSJUZ
    c
    *NBHF.BHJDL
    ʹ͓͍ͯ
    1/(
    ը૾ॲཧதͷ
    QSP fi MF
    ৘ใͷݕূෆඋʹΑΓ೚ҙͷϑΝΠϧ͕ಡΈऔΓՄೳͱͳΔ੬ऑੑ
    IUUQTTDBOOFUTFDVSJUZOFKQBSUJDMFIUNM
    ▶︎
    ʲ*NBHF.BHJDLʳ*NBHF.BHJDLͰ͋ͬͨ৘ใ࿙Ӯͷ੬ऑੑΛৄ͘͠ղઆʂʲDWFʳʲѱ༻ݫېʳ
    
    :PV5VCF
    IUUQTXXXZPVUVCFDPNXBUDI W,C$3@ML76X
    ▶︎
    $7&
    *NBHF.BHJDL
    "SCJUSBSZ
    'JMF
    3FBE
    
    TIJNPKVCPY
    IUUQTTDSBQCPYJPTIJNPKV$7&@*NBHF.BHJDL@"SCJUSBSZ@'JMF@3FBE 8JOEPXTࣾͷ
    .JDSPTPGU
    0VUMPPL
    ʹ͓͚Δಛݖঢ֨ͷ੬ऑੑ
    ʢ$7&ʣ
    ▶︎
    τϨϯυϚΠΫϩ
    c
    0VUMPPL
    GPS
    8JOEPXTʹਂࠁͳಛݖঢ֨ͷ੬ऑੑʮ$7&ʯɿରॲ͢΂͖಺༰ͱ஫ҙ఺
    IUUQTXXXUSFOENJDSPDPNKB@KQSFTFBSDIDQBUDIDWFJNNFEJBUFMZXIBUZPVOFFEUPLOPXBOEEPIUNM
    ▶︎
    1BMP
    "MUP
    /FUXPSLT
    c
    ڴҖʹؔ͢Δ৘ใ
    .JDSPTPGU
    0VUMPPLʹ͓͚Δಛݖঢ֨ͷ੬ऑੑ $7&
    IUUQTVOJUQBMPBMUPOFUXPSLTKQUISFBUCSJFGDWF
    ▶︎
    5SZ)BDL.F
    c
    0VUMPPL
    /5-.
    -FBL
    IUUQTUSZIBDLNFDPNSPPNPVUMPPLOUMNMFBL
17. ࢀߟ̐ 3"3-"#
    8JO3"3
    ͷ;*1ϑΝΠϧӾཡ࣌ʹ೚ҙͷίʔυ࣮ߦͱͳΔ੬ऑੑ
    ʢ$7&ʣ
    ▶︎
    ૭ͷై
    c
    ʮ8JO3"3ʯʹ੓෎ܥϋοΧʔ͕ѱ༻͢Δ੬ऑੑ
    ʙ(PPHMFڴҖ෼ੳάϧʔϓ͕ܯࠂ
    IUUQTGPSFTUXBUDIJNQSFTTDPKQEPDTOFXTIUNM
    ▶︎
    *P5
    05
    4FDVSJUZ
    /FXT
    c
    8JO3"3
    ͷθϩσΠ
    $7&
    ͷѱ༻ɿੈքதͷτϨʔμʔ͕ૂΘΕ͍ͯΔ
    IUUQTJPUPUTFDOFXTKQXJOSBSWVMOFSBCJMJUZB ff FDUTUSBEFSTXPSMEXJEF
    ▶︎
    (SPVQ*#
    #MPH
    c
    5SBEFST
    EPMMBST
    JO
    EBOHFS
    $7&
    [FSPEBZ
    WVMOFSBCJMJUZ
    JO
    8JO3"3
    FYQMPJUFE
    CZ
    DZCFSDSJNJOBMT
    UP
    UBSHFU
    USBEFST
    IUUQTXXXHSPVQJCDPNCMPHDWFXJOSBS[FSPEBZ NBD04
    ʹ͓͚Δݖݶঢ֨͞ΕΔ੬ऑੑʢ$7&
    
    .BD%JSUZ$PXʣ
    ▶︎
    8PSUI
    %PJOH
    #BEMZ
    c
    (FU
    SPPU
    PO
    NBD04
    
    XJUI
    $7&
    UIF
    NBD04
    %JSUZ
    $PX
    CVH
    IUUQTXPSUIEPJOHCBEMZDPNNBDEJSUZDPX
    ▶︎
    5PPMT
    
    )BDL
    c
    J04
    ҎԼͰ࢖༻Մೳͳ&YQMPJU͕ެ։ɺߋʹ࣮ࡍʹ&YQMPJUΛར༻ͨ͠1P$ΞϓϦ΋ϦϦʔε͞ΕΔ
    IUUQT UPPMTIBDLTBOUBMBCNFSFMFBTFDWFNBDEJSUZDPXFYQMPJUBOEQPDUSPMMMPDLSFCPSOGPSJPTIUNM
    ▶︎
    0 ff FOTJWF$PO
    
    *BO
    #FFS
    
    .BD%JSUZ$PX
    r
    "VEJUJOH
    BOE
    &YQMPJUJOH
    9/6
    7JSUVBM
    .FNPSZ
    
    :PV5VCF
    IUUQTXXXZPVUVCFDPNXBUDI WKSY0I((Y%;