{"id":125333,"date":"2025-05-21T15:05:14","date_gmt":"2025-05-21T13:05:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-biblioteke-openpgp-js-pozvolyayushhaya-obojti-verifikacziyu-soobshhenij"},"modified":"2025-05-21T15:05:14","modified_gmt":"2025-05-21T13:05:14","slug":"uyazvimost-v-biblioteke-openpgp-js-pozvolyayushhaya-obojti-verifikacziyu-soobshhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-biblioteke-openpgp-js-pozvolyayushhaya-obojti-verifikacziyu-soobshhenij","title":{"rendered":"Zranitelnost v knihovn\u011b OpenPGP.js, kter\u00e1 umo\u017e\u0148uje obej\u00edt verifikaci zpr\u00e1v.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V knihovn\u011b OpenPGP.js byla zji\u0161t\u011bna zranitelnost (CVE-2025-47934), kter\u00e1 umo\u017e\u0148uje \u00fato\u010dn\u00edkovi poslat upravenou zpr\u00e1vu, kter\u00e1 bude p\u0159ijata p\u0159\u00edjemcem jako ov\u011b\u0159en\u00e1 (funkce openpgp.verify a openpgp.decrypt vr\u00e1t\u00ed indik\u00e1tor \u00fasp\u011b\u0161n\u00e9ho ov\u011b\u0159en\u00ed digit\u00e1ln\u00edho podpisu, i kdy\u017e byl obsah nahrazen a li\u0161\u00ed se od dat, pro kter\u00e1 byl podpis vytvo\u0159en). Zranitelnost byla odstran\u011bna ve verz\u00edch OpenPGP.js 5.11.3 a 6.1.1. Probl\u00e9m se vyskytuje pouze ve v\u011btv\u00edch OpenPGP.js 5.x a 6.x a net\u00fdk\u00e1 se OpenPGP.js 4.x. <\/p>\n

Knihovna OpenPGP.js poskytuje samostatnou implementaci protokolu OpenPGP v JavaScriptu, kter\u00e1 umo\u017e\u0148uje prov\u00e1d\u011bt operace \u0161ifrov\u00e1n\u00ed v prohl\u00ed\u017ee\u010di a pracovat s digit\u00e1ln\u00edmi podpisy na z\u00e1klad\u011b ve\u0159ejn\u00fdch kl\u00ed\u010d\u016f. Projekt vyv\u00edjej\u00ed v\u00fdvoj\u00e1\u0159i Proton Mail a krom\u011b zabezpe\u010den\u00ed \u0161ifrov\u00e1n\u00ed zpr\u00e1v v Proton Mail se pou\u017e\u00edv\u00e1 v projektech jako FlowCrypt, Mymail-Crypt, UDC, Encrypt.to, PGP Anywhere a Passbolt. <\/p>\n

Zranitelnost se t\u00fdk\u00e1 postup\u016f ov\u011b\u0159en\u00ed integrovan\u00e9ho v textu podpisu (openpgp.verify) a podepsan\u00fdch a \u0161ifrovan\u00fdch zpr\u00e1v (openpgp.decrypt). \u00dato\u010dn\u00edk m\u016f\u017ee pou\u017e\u00edt existuj\u00edc\u00ed podepsan\u00e9 zpr\u00e1vy k vytvo\u0159en\u00ed nov\u00fdch zpr\u00e1v, p\u0159i rozbalov\u00e1n\u00ed kter\u00fdch bude zranitelnou verz\u00ed OpenPGP.js extrahov\u00e1n vlo\u017een\u00fd obsah, kter\u00fd se li\u0161\u00ed od obsahu p\u016fvodn\u00ed podepsan\u00e9 zpr\u00e1vy. Zranitelnost se net\u00fdk\u00e1 podpis\u016f \u0161\u00ed\u0159en\u00fdch odd\u011blen\u011b od textu (probl\u00e9m se vyskytuje pouze p\u0159i p\u0159ed\u00e1n\u00ed podpisu spolu s textem jako jedn\u00e9 datov\u00e9 bloky). <\/p>\n

K vytvo\u0159en\u00ed podvodn\u00e9 zpr\u00e1vy pot\u0159ebuje \u00fato\u010dn\u00edk pouze jedno zpr\u00e1vu s integrovan\u00fdm nebo odd\u011blen\u00fdm podpisem, stejn\u011b jako znalost p\u016fvodn\u00edch dat podepsan\u00fdch v t\u00e9to zpr\u00e1v\u011b. \u00dato\u010dn\u00edk m\u016f\u017ee upln\u011b zm\u011bnit zpr\u00e1vu tak, aby pro upravenou variantu podpis st\u00e1le byl pova\u017eov\u00e1n za platn\u00fd. Podobn\u011b lze m\u011bnit \u0161ifrovan\u00e9 zpr\u00e1vy s podpisem, p\u0159i rozbalov\u00e1n\u00ed kter\u00fdch se vr\u00e1t\u00ed p\u0159idan\u00e1 data \u00fato\u010dn\u00edka.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 OpenPGP.js \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-47934), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0431\u0443\u0434\u0435\u0442 \u0432\u043e\u0441\u043f\u0440\u0438\u043d\u044f\u0442\u043e \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u0435\u043b\u0435\u043c \u043a\u0430\u043a \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 (\u0444\u0443\u043d\u043a\u0446\u0438\u0438 openpgp.verify \u0438 openpgp.decrypt \u0432\u0435\u0440\u043d\u0443\u0442 \u043f\u0440\u0438\u0437\u043d\u0430\u043a \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438, \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0437\u0430\u043c\u0435\u043d\u0435\u043d\u043e \u0438 \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f \u043e\u0442 \u0434\u0430\u043d\u043d\u044b\u0445, \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u043b\u0430\u0441\u044c \u043f\u043e\u0434\u043f\u0438\u0441\u044c). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 OpenPGP.js 5.11.3 \u0438 6.1.1. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0432\u0435\u0442\u043a\u0430\u0445 OpenPGP.js […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-125333","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnost v knihovn\u011b OpenPGP.js, kter\u00e1 umo\u017e\u0148uje obch\u00e1zet ov\u011b\u0159en\u00ed zpr\u00e1v | ProHoster","description":"V knihovn\u011b OpenPGP.js byla zji\u0161t\u011bna zranitelnost (CVE-2025-47934), kter\u00e1 umo\u017e\u0148uje \u00fato\u010dn\u00edkovi poslat upravenou zpr\u00e1vu, kter\u00e1 bude p\u0159ijata p\u0159\u00edjemcem jako ov\u011b\u0159en\u00e1 (funkce openpgp.verify a.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-biblioteke-openpgp-js-pozvolyayushhaya-obojti-verifikacziyu-soobshhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 OpenPGP.js, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 OpenPGP.js \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-47934), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0431\u0443\u0434\u0435\u0442 \u0432\u043e\u0441\u043f\u0440\u0438\u043d\u044f\u0442\u043e \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u0435\u043b\u0435\u043c \u043a\u0430\u043a \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 (\u0444\u0443\u043d\u043a\u0446\u0438\u0438 openpgp.verify \u0438.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-biblioteke-openpgp-js-pozvolyayushhaya-obojti-verifikacziyu-soobshhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-05-21T13:05:14+00:00","article:modified_time":"2025-05-21T13:05:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"125333","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 12:55:23","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 12:55:23","updated":"2026-01-23 12:55:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/125333","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=125333"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/125333\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=125333"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=125333"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=125333"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}