{"id":102446,"date":"2021-12-02T21:36:39","date_gmt":"2021-12-02T19:36:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-mozilla-nss-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-sertifikatov"},"modified":"2021-12-02T21:36:39","modified_gmt":"2021-12-02T19:36:39","slug":"uyazvimost-v-mozilla-nss-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-sertifikatov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-mozilla-nss-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-sertifikatov","title":{"rendered":"Zranitelnost v Mozilla NSS umo\u017e\u0148uj\u00edc\u00ed spu\u0161t\u011bn\u00ed k\u00f3du p\u0159i zpracov\u00e1n\u00ed certifik\u00e1t\u016f","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>V sad\u011b kryptografick\u00fdch knihoven NSS (Network Security Services) vyv\u00edjen\u00fdch spole\u010dnost\u00ed Mozilla byla odhalena kritick\u00e1 zranitelnost (CVE-2021-43527), kter\u00e1 m\u016f\u017ee v\u00e9st k vykon\u00e1n\u00ed k\u00f3du \u00fato\u010dn\u00edka p\u0159i zpracov\u00e1n\u00ed digit\u00e1ln\u00edch podpis\u016f DSA nebo RSA-PSS zadan\u00fdch pomoc\u00ed k\u00f3dov\u00e1n\u00ed DER (Distinguished Encoding Rules). Probl\u00e9m, kter\u00e9mu bylo p\u0159id\u011bleno k\u00f3dov\u00e9 jm\u00e9no BigSig, byl odstran\u011bn ve verz\u00edch NSS 3.73 a NSS ESR 3.68.1. Aktualizace bal\u00ed\u010dk\u016f jsou k dispozici pro distribuce Debian, RHEL, Ubuntu, SUSE, Arch Linux, Gentoo, FreeBSD. Pro Fedora zat\u00edm nejsou dostupn\u00e9 \u017e\u00e1dn\u00e9 aktualizace.    <\/p>\n<p> Probl\u00e9m se projevuje v aplikac\u00edch, kter\u00e9 pou\u017e\u00edvaj\u00ed NSS pro zpracov\u00e1n\u00ed digit\u00e1ln\u00edch podpis\u016f CMS, S\/MIME, PKCS #7 a PKCS #12, nebo p\u0159i ov\u011b\u0159ov\u00e1n\u00ed certifik\u00e1t\u016f v implementac\u00edch TLS, X.509, OCSP a CRL. Zranitelnost se m\u016f\u017ee objevit v r\u016fzn\u00fdch klientsk\u00fdch a serverov\u00fdch aplikac\u00edch s podporou TLS, DTLS a S\/MIME, e-mailov\u00fdch klientech a PDF prohl\u00ed\u017ee\u010d\u00edch, kter\u00e9 pou\u017e\u00edvaj\u00ed v\u00fdzvu NSS CERT_VerifyCertificate() k ov\u011b\u0159ov\u00e1n\u00ed digit\u00e1ln\u00edch podpis\u016f.     <\/p>\n<p>Mezi p\u0159\u00edklady ohro\u017een\u00fdch aplikac\u00ed pat\u0159\u00ed LibreOffice, Evolution a Evince. Potenci\u00e1ln\u011b by probl\u00e9m mohl zahrnovat tak\u00e9 projekty jako Pidgin, Apache OpenOffice, Suricata, Curl, Chrony, Red Hat Directory Server, Red Hat Certificate System, mod_nss pro http server Apache, Oracle Communications Messaging Server a Oracle Directory Server Enterprise Edition. Na druhou stranu zranitelnost nepostihuje Firefox, Thunderbird a Tor Browser, kter\u00e9 pou\u017e\u00edvaj\u00ed jinou knihovnu pro ov\u011b\u0159ov\u00e1n\u00ed mozilla::pkix, kter\u00e1 je tak\u00e9 sou\u010d\u00e1st\u00ed NSS. Probl\u00e9m se tak\u00e9 net\u00fdk\u00e1 prohl\u00ed\u017ee\u010d\u016f zalo\u017een\u00fdch na Chromiu (pokud nebyly speci\u00e1ln\u011b zkompilov\u00e1ny s NSS), kter\u00e9 pou\u017e\u00edvaly NSS do roku 2015, ale pot\u00e9 p\u0159e\u0161ly na BoringSSL.    <\/p>\n<p>Zranitelnost je zp\u016fsobena chybou v k\u00f3du ov\u011b\u0159ov\u00e1n\u00ed certifik\u00e1t\u016f v funkci vfy_CreateContext z souboru secvfy.c. Probl\u00e9m se projevuje jak p\u0159i \u010dten\u00ed certifik\u00e1tu klienta ze serveru, tak p\u0159i zpracov\u00e1n\u00ed <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/cs\/server\/dts-prohoster\/\"   title=\"serverem\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"3028\">serverem<\/a> certifik\u00e1t\u016f klient\u016f. P\u0159i ov\u011b\u0159ov\u00e1n\u00ed digit\u00e1ln\u00edho podpisu zak\u00f3dovan\u00e9ho metodou DER NSS dek\u00f3duje podpis do pevn\u011b stanoven\u00e9ho bufferu a p\u0159ed\u00e1v\u00e1 tento buffer modulu PKCS #11. P\u0159i dal\u0161\u00edm zpracov\u00e1n\u00ed, pro podpisy DSA a RSA-PSS, nen\u00ed spr\u00e1vn\u011b kontrolov\u00e1na velikost, co\u017e vede k p\u0159ete\u010den\u00ed bufferu vyhrazen\u00e9ho pro strukturu VFYContextStr, pokud je velikost digit\u00e1ln\u00edho podpisu v\u011bt\u0161\u00ed ne\u017e 16384 bit\u016f (buffer je vyhrazen na 2048 bajt\u016f, ale nen\u00ed kontrolov\u00e1no, \u017ee podpis m\u016f\u017ee b\u00fdt v\u011bt\u0161\u00ed).    <\/p>\n<p>K\u00f3d obsahuj\u00edc\u00ed zranitelnost se sleduje od roku 2003, ale nep\u0159edstavoval hrozbu a\u017e do refaktoringu proveden\u00e9ho v roce 2012. V roce 2017, p\u0159i implementaci podpory RSA-PSS, byla ud\u011bl\u00e1na stejn\u00e1 chyba. Pro proveden\u00ed \u00fatoku nen\u00ed t\u0159eba v\u00fdpo\u010detn\u011b n\u00e1ro\u010dn\u00e1 generace ur\u010dit\u00fdch kl\u00ed\u010d\u016f k z\u00edsk\u00e1n\u00ed pot\u0159ebn\u00fdch dat, proto\u017ee p\u0159ete\u010den\u00ed nast\u00e1v\u00e1 ve f\u00e1zi p\u0159ed kontrolou spr\u00e1vnosti digit\u00e1ln\u00edho podpisu. \u010c\u00e1st dat vy\u010dn\u00edvaj\u00edc\u00ed za hranice se zapisuje do oblasti pam\u011bti obsahuj\u00edc\u00ed ukazatele na funkce, co\u017e usnad\u0148uje vytv\u00e1\u0159en\u00ed funk\u010dn\u00edch exploit\u016f.    <\/p>\n<p>Zranitelnost byla odhalena v\u00fdzkumn\u00edky z Google Project Zero b\u011bhem experiment\u016f s nov\u00fdmi metodami fuzzingov\u00e9ho testov\u00e1n\u00ed a je dobr\u00fdm p\u0159\u00edkladem toho, jak mohou triviality z\u016fstat po dlouhou dobu nepov\u0161imnut\u00e9 v \u0161iroce testovan\u00fdch zn\u00e1m\u00fdch projektech:  <\/p>\n<ul>\n<li class=\"l\"> K\u00f3d NSS je doprov\u00e1zen zku\u0161en\u00fdm t\u00fdmem zodpov\u011bdn\u00fdm za bezpe\u010dnost, kter\u00fd pou\u017e\u00edv\u00e1 modern\u00ed metody testov\u00e1n\u00ed a anal\u00fdzy chyb. Existuje n\u011bkolik program\u016f na vypl\u00e1cen\u00ed v\u00fdznamn\u00fdch odm\u011bn za odhalen\u00ed zranitelnost\u00ed v NSS.\n<li class=\"l\">  NSS byl jedn\u00edm z prvn\u00edch projekt\u016f, kter\u00e9 se p\u0159ipojily k iniciativ\u011b Google oss-fuzz a byl tak\u00e9 testov\u00e1n v rozv\u00edjen\u00e9m syst\u00e9mu fuzzingov\u00e9ho testov\u00e1n\u00ed Mozilly zalo\u017een\u00e9m na libFuzzer.\n<li class=\"l\"> K\u00f3d knihovny byl opakovan\u011b kontrolov\u00e1n v r\u016fzn\u00fdch statick\u00fdch analytick\u00fdch n\u00e1stroj\u00edch, v\u010detn\u011b sledov\u00e1n\u00ed slu\u017ebou Coverity od roku 2008.\n<li class=\"l\"> Do roku 2015 se NSS pou\u017e\u00edval v Google Chrome a nez\u00e1visle na Mozille byl kontrolov\u00e1n t\u00fdmem Google (od roku 2015 p\u0159e\u0161el Chrome na BoringSSL, ale podpora portu zalo\u017een\u00e9ho na NSS z\u016fst\u00e1v\u00e1).    <\/ul>\n<p>Hlavn\u00ed probl\u00e9my, kv\u016fli nim\u017e z\u016fst\u00e1val probl\u00e9m dlouho neodhalen\u00fd:  <\/p>\n<ul>\n<li class=\"l\"> Modul\u00e1rn\u00ed knihovna NSS a fuzzingov\u00e9 testov\u00e1n\u00ed prob\u00edhalo nikoli v celku, ale na \u00farovni jednotliv\u00fdch komponent\u016f. Nap\u0159\u00edklad byl odd\u011blen\u011b testov\u00e1n k\u00f3d pro dek\u00f3dov\u00e1n\u00ed DER a zpracov\u00e1n\u00ed certifik\u00e1t\u016f \u2014 b\u011bhem fuzzingu bylo mo\u017en\u00e9 z\u00edskat certifik\u00e1t, kter\u00fd vedl k projevov\u00e1n\u00ed zkouman\u00e9 zranitelnosti, ale jeho ov\u011b\u0159en\u00ed nedos\u00e1hlo k\u00f3du pro verifikaci a probl\u00e9m se neodhalil.\n<li class=\"l\"> P\u0159i fuzzingov\u00e9m testov\u00e1n\u00ed byla stanovena p\u0159\u00edsn\u00e1 omezen\u00ed na velikost v\u00fdstupu (10000 byt\u016f), zat\u00edmco v NSS takov\u00e1 omezen\u00ed neexistovala (mnoho struktur v b\u011b\u017en\u00e9m re\u017eimu mohlo m\u00edt velikost v\u011bt\u0161\u00ed ne\u017e 10000 byt\u016f, proto bylo k odhalen\u00ed probl\u00e9m\u016f pot\u0159eba v\u011bt\u0161\u00ed objem vstupn\u00edch dat). Pro plnohodnotn\u00e9 ov\u011b\u0159en\u00ed by limit m\u011bl b\u00fdt 224-1 byt (16 MB), co\u017e odpov\u00edd\u00e1 maxim\u00e1ln\u00ed velikosti certifik\u00e1tu povolen\u00e9ho v TLS.\n<li class=\"l\"> Nespr\u00e1vn\u00e9 zobrazen\u00ed pokryt\u00ed k\u00f3du fuzzingov\u00fdm testov\u00e1n\u00edm. Zraniteln\u00fd k\u00f3d byl aktivn\u011b testov\u00e1n, ale s pou\u017eit\u00edm fuzzery, kter\u00e9 nebyly schopny vygenerovat pot\u0159ebn\u00e9 vstupn\u00ed \u00fadaje. Nap\u0159\u00edklad fuzzer tls_server_target pou\u017e\u00edval p\u0159eddefinovan\u00fd soubor p\u0159ipraven\u00fdch certifik\u00e1t\u016f, co\u017e omezovalo kontrolu k\u00f3du ov\u011b\u0159en\u00ed certifik\u00e1tu pouze na TLS zpr\u00e1vy a zm\u011bny stavu protokolu.    <\/ul>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=56268\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043d\u0430\u0431\u043e\u0440\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a NSS (Network Security Services), \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Mozilla, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-43527), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 DSA \u0438\u043b\u0438 RSA-PSS, \u0437\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043c\u0435\u0442\u043e\u0434\u0430 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f DER (Distinguished Encoding Rules). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f BigSig, \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 NSS 3.73 \u0438 NSS ESR 3.68.1. \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102446","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043d\u0430\u0431\u043e\u0440\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a NSS (Network Security Services), \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Mozilla, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-43527), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043f\u0440\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-mozilla-nss-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-sertifikatov\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Mozilla NSS, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043d\u0430\u0431\u043e\u0440\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a NSS (Network Security Services), \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Mozilla, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-43527), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043f\u0440\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-mozilla-nss-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-sertifikatov\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-12-02T19:36:39+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-12-02T19:36:39+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnost v Mozilla NSS, kter\u00e1 umo\u017e\u0148uje proveden\u00ed k\u00f3du p\u0159i zpracov\u00e1n\u00ed certifik\u00e1t\u016f | ProHoster","description":"V sad\u011b kryptografick\u00fdch knihoven NSS (Network Security Services), vyv\u00edjen\u00fdch spole\u010dnost\u00ed Mozilla, byla zji\u0161t\u011bna kritick\u00e1 zranitelnost (CVE-2021-43527), kter\u00e1 m\u016f\u017ee v\u00e9st k proveden\u00ed k\u00f3du \u00fato\u010dn\u00edka p\u0159i.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-mozilla-nss-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-sertifikatov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Mozilla NSS, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 | ProHoster","og:description":"\u0412 \u043d\u0430\u0431\u043e\u0440\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a NSS (Network Security Services), \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Mozilla, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-43527), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043f\u0440\u0438.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-mozilla-nss-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-sertifikatov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-12-02T19:36:39+00:00","article:modified_time":"2021-12-02T19:36:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102446","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-12-02 19:38:04","updated":"2026-02-09 21:46:42","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/102446","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=102446"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/102446\/revisions"}],"predecessor-version":[{"id":160309,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/102446\/revisions\/160309"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=102446"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=102446"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=102446"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}