{"id":1317,"date":"2026-08-28T23:04:32","date_gmt":"2026-08-28T20:04:32","guid":{"rendered":"https:\/\/www.tayfnews.tech\/tr\/?p=1317"},"modified":"2026-08-28T23:04:32","modified_gmt":"2026-08-28T20:04:32","slug":"aws-tarafindan-awsdac-icin-zip-slip-acigi-acikladi","status":"publish","type":"post","link":"https:\/\/www.tayfnews.tech\/tr\/technology\/aws-tarafindan-awsdac-icin-zip-slip-acigi-acikladi\/","title":{"rendered":"AWS Taraf\u0131ndan awsdac \u0130\u00e7in Zip Slip A\u00e7\u0131\u011f\u0131 A\u00e7\u0131klad\u0131"},"content":{"rendered":"<p>Amazon Web Services mimari diyagramlar\u0131n\u0131 YAML tan\u0131mlar\u0131ndan olu\u015fturmak i\u00e7in kullan\u0131lan pop\u00fcler bir kod olarak diyagram komut sat\u0131r\u0131 aray\u00fcz\u00fc arac\u0131 <strong>awsdac<\/strong> i\u00e7inde <strong>CVE-2026-81838<\/strong> olarak tan\u0131mlanan kritik bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131 ortaya \u00e7\u0131kar\u0131ld\u0131. 27.08.2026 tarihinde 2026-090-AWS B\u00fclten Kimli\u011fi ile yay\u0131nlanan g\u00fcvenlik dan\u0131\u015fmanl\u0131\u011f\u0131, sald\u0131rganlar\u0131n yerel geli\u015ftirici makinelerinde veya s\u00fcrekli entegrasyon hatlar\u0131nda rastgele kod y\u00fcr\u00fctmesine potansiyel olarak izin verebilecek bir awsdac Zip Slip dosya yolu ge\u00e7i\u015fi (path traversal) kusurunun detaylar\u0131n\u0131 payla\u015f\u0131yor.<\/p>\n<h2>awsdac Dosya Yolu Ge\u00e7i\u015fi Kusurunu Anlamak<\/h2>\n<p>G\u00fcvenlik sorunu, CLI yard\u0131mc\u0131 program\u0131n\u0131n s\u0131k\u0131\u015ft\u0131r\u0131lm\u0131\u015f ar\u015fivleri nas\u0131l y\u00f6netti\u011fi ve i\u015fledi\u011fi etraf\u0131nda d\u00f6n\u00fcyor. \u00d6zellikle awsdac, bir tan\u0131m dosyas\u0131 i\u00e7indeki bir ZipFile kayna\u011f\u0131 taraf\u0131ndan ba\u015fvurulan bir zip ar\u015fivini \u00e7\u0131kard\u0131\u011f\u0131nda, dosya yollar\u0131n\u0131 yeterince sanitize edemez. Sonu\u00e7 olarak, k\u00f6t\u00fc ama\u00e7l\u0131 olarak haz\u0131rlanm\u0131\u015f bir ar\u015fivi bu a\u00e7\u0131\u011f\u0131 k\u00f6t\u00fcye kullanarak dosyalar\u0131 ama\u00e7lanan \u00f6nbellek dizininin tamamen d\u0131\u015f\u0131na yazabilir ve arac\u0131 \u00e7al\u0131\u015ft\u0131ran kullan\u0131c\u0131n\u0131n yazabilece\u011fi herhangi bir dosya sistemi yolunu hedefleyebilir. Yaz\u0131lan dosyalar\u0131n tam do\u011fas\u0131na ve hedefine ba\u011fl\u0131 olarak, bu dosya yolu ge\u00e7i\u015fi kusuru h\u0131zla rastgele koda y\u00fcr\u00fctmeye t\u0131rmanabilir.<\/p>\n<p>G\u00fcvenlik analistleri, CVE-2026-81838&#8217;den yararlanman\u0131n, arac\u0131n g\u00fcvenilmeyen bir kaynaktan gelen bir tan\u0131m dosyas\u0131n\u0131 i\u015flemesini gerektirdi\u011fini belirtiyor. Bu tehdit vekt\u00f6r\u00fc tipik olarak belirli operasyonel ko\u015fullar alt\u0131nda ortaya \u00e7\u0131kar:<\/p>\n<ul>\n<li>awsdac arac\u0131n\u0131 uygun tan\u0131m g\u00fcvenli\u011fi k\u0131s\u0131tlamalar\u0131 olmadan \u00e7al\u0131\u015ft\u0131rmak; bu durum, herhangi bir g\u00fcven ayr\u0131m\u0131 i\u00e7ermeyen 0.22.4 s\u00fcr\u00fcm\u00fcnden \u00f6nceki s\u00fcr\u00fcmlerde yayg\u0131n bir a\u00e7\u0131kt\u0131r. (0.22.4 s\u00fcr\u00fcm\u00fcnden itibaren ara\u00e7, <code>--allow-untrusted-definitions<\/code> bayra\u011f\u0131n\u0131 zorunlu k\u0131lar).<\/li>\n<li>Yerle\u015fik tan\u0131m URL izin listesini tamamen by-pass eden <code>Type: LocalFile<\/code> kullanarak yerel dosya sisteminden do\u011frudan bir tan\u0131m dosyas\u0131 y\u00fcklemek.<\/li>\n<\/ul>\n<h2>Ortamlar \u0130\u00e7in Etki ve Risk De\u011ferlendirmesi<\/h2>\n<p>Birincil risk senaryosu, g\u00fcvenilmeyen veya yar\u0131 g\u00fcvenilir d\u0131\u015f kat\u0131l\u0131mc\u0131lardan kaynaklanan altyap\u0131 tan\u0131m dosyalar\u0131n\u0131 rutin olarak i\u015fleyen otomatize edilmi\u015f <strong>CI\/CD ortamlar\u0131n\u0131<\/strong> i\u00e7erir. awsdac kat\u0131 bir \u015fekilde yerel bir i\u015f istasyonunda veya \u00e7al\u0131\u015ft\u0131r\u0131c\u0131da mimari diyagramlar\u0131 yerel olarak olu\u015fturmak i\u00e7in tasarlanm\u0131\u015f istemci taraf\u0131 bir CLI yard\u0131mc\u0131 program\u0131 olarak i\u015flev g\u00f6rd\u00fc\u011f\u00fcnden, AWS bu kusurun altyap\u0131daki hi\u00e7bir bulut hizmetini, AWS altyap\u0131 hesab\u0131n\u0131 veya m\u00fc\u015fteri verilerini tehlikeye atmad\u0131\u011f\u0131n\u0131 netle\u015ftirdi. Ortaya \u00e7\u0131kan etki, kat\u0131 bir \u015fekilde savunmas\u0131z arac\u0131n y\u00fcr\u00fct\u00fcld\u00fc\u011f\u00fc yerel ana makine ile s\u0131n\u0131rl\u0131d\u0131r.<\/p>\n<p>G\u00fcvenlik a\u00e7\u0131\u011f\u0131 geni\u015f bir yaz\u0131l\u0131m yelpazesini etkilemektedir:<\/p>\n<ul>\n<li><strong>Etkilenen Yaz\u0131l\u0131m:<\/strong> awsdac<\/li>\n<li><strong>Etkilenen S\u00fcr\u00fcmler:<\/strong> 0.10 ile 0.23 s\u00fcr\u00fcmleri dahil<\/li>\n<li><strong>Yay\u0131n Tarihi:<\/strong> 27.08.2026 13:00 PDT<\/li>\n<li><strong>Kapsam:<\/strong> AWS G\u00fcvenlik B\u00fclteni 2026-090-AWS<\/li>\n<\/ul>\n<p>Arac\u0131n etkilenen s\u00fcr\u00fcmlerini kullanan kullan\u0131c\u0131lara ve y\u00f6netim ekiplerine CI\/CD hatlar\u0131n\u0131 g\u00f6zden ge\u00e7irmeleri, g\u00fcvenilmeyen tan\u0131m dosyalar\u0131n\u0131n y\u00fcr\u00fct\u00fclmesini k\u0131s\u0131tlamalar\u0131 ve gerekli g\u00fcvenlik s\u0131n\u0131rlar\u0131 ile bayrak gereksinimlerini i\u00e7eren g\u00fcncellenmi\u015f yaz\u0131l\u0131m s\u00fcr\u00fcmlerini benimsemeleri \u015fiddetle tavsiye edilir.<\/p>\n<p><em>Kaynak: <a href=\"https:\/\/aws.amazon.com\/security\/security-bulletins\/rss\/2026-090-aws\/\" target=\"_blank\" rel=\"noopener noreferrer\">Orijinal Makale<\/a><\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u00d6zel olarak haz\u0131rlanm\u0131\u015f ar\u015fivler ile rastgele kod y\u00fcr\u00fctmeye izin veren awsdac Zip Slip a\u00e7\u0131\u011f\u0131 CVE-2026-81838&#8217;i ke\u015ffedin. AWS g\u00fcvenlik b\u00fclteni detaylar\u0131.<\/p>\n","protected":false},"author":1,"featured_media":1316,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"googlesitekit_rrm_CAowrrDMDA:productID":"","tayfnews_source_url":"","footnotes":"","rank_math_focus_keyword":"awsdac Zip Slip, CVE-2026-81838 a\u00e7\u0131\u011f\u0131, AWS awsdac arac\u0131, G\u00fcvenlik A\u00e7\u0131\u011f\u0131, G\u00fcvenlik, Teknoloji","rank_math_title":"AWS Taraf\u0131ndan awsdac \u0130\u00e7in Zip Slip A\u00e7\u0131\u011f\u0131 A\u00e7\u0131klad\u0131","rank_math_description":"\u00d6zel olarak haz\u0131rlanm\u0131\u015f ar\u015fivler ile rastgele kod y\u00fcr\u00fctmeye izin veren awsdac Zip Slip a\u00e7\u0131\u011f\u0131 CVE-2026-81838'i ke\u015ffedin. AWS g\u00fcvenlik b\u00fclteni detaylar\u0131."},"categories":[2],"tags":[],"class_list":["post-1317","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/posts\/1317","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/comments?post=1317"}],"version-history":[{"count":1,"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/posts\/1317\/revisions"}],"predecessor-version":[{"id":1318,"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/posts\/1317\/revisions\/1318"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/media\/1316"}],"wp:attachment":[{"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/media?parent=1317"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/categories?post=1317"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/tags?post=1317"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}