{"id":102446,"date":"2021-12-02T21:36:39","date_gmt":"2021-12-02T19:36:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-mozilla-nss-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-sertifikatov"},"modified":"2021-12-02T21:36:39","modified_gmt":"2021-12-02T19:36:39","slug":"uyazvimost-v-mozilla-nss-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-sertifikatov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-mozilla-nss-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-sertifikatov","title":{"rendered":"Vulnerability in Mozilla NSS allows code execution when processing certificates","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Mozilla arendatud NSS (Network Security Services) kr\u00fcptograafiliste teekide komplektis tuvastati kriitiline haavatavus (CVE-2021-43527), mis v\u00f5ib v\u00f5imaldada r\u00fcndajal koodi t\u00e4itmist DSA v\u00f5i RSA-PSS digitaalsete allkirjade t\u00f6\u00f6tlemisel, mis on m\u00e4\u00e4ratud DER (Distinguished Encoding Rules) kodeerimismeetodi kasutamisega. Probleem, mille koodinimi on BigSig, on k\u00f5rvaldatud NSS 3.73 ja NSS ESR 3.68.1 v\u00e4ljaannetes. Pakettide uuendused jaotustes on saadaval Debian, RHEL, Ubuntu, SUSE, Arch Linux, Gentoo, FreeBSD jaoks. Fedora jaoks uuendused ei ole veel saadaval.    <\/p>\n<p> Probleem ilmneb rakendustes, mis kasutavad NSS-i digitaalsete allkirjade CMS, S\/MIME, PKCS #7 ja PKCS #12 t\u00f6\u00f6tlemiseks v\u00f5i sertifikaatide kontrollimiseks TLS, X.509, OCSP ja CRL rakendustes. Haavatavus v\u00f5ib ilmneda erinevates kliendi- ja serverirakendustes, mis toetavad TLS, DTLS ja S\/MIME, e-posti klientides ja PDF-vaatamisprogrammides, mis kasutavad NSS-kutset CERT_VerifyCertificate() digitaalsete allkirjade kontrollimiseks.     <\/p>\n<p>N\u00e4itena haavatavatest rakendustest mainitakse LibreOffice'i, Evolutioni ja Evince'i. Potentsiaalselt v\u00f5ivad probleem m\u00f5jutada ka projekte nagu Pidgin, Apache OpenOffice, Suricata, Curl, Chrony, Red Hat Directory Server, Red Hat Certificate System, mod_nss Apache HTTP serverile, Oracle Communications Messaging Server ja Oracle Directory Server Enterprise Edition. Samuti ei avaldu haavatavus Firefoxis, Thunderbirdis ja Tor Browseris, kus valideerimiseks kasutatakse eraldi teeki mozilla::pkix, mis kuulub samuti NSS-i. Probleem ei puuduta ka Chromiumi p\u00f5hiseid brausereid (kui need ei ole spetsiaalselt kokku pandud NSS-iga), mis kasutasid NSS-i kuni 2015. aastani, kuid on seej\u00e4rel \u00fcle l\u00e4inud BoringSSL-ile.    <\/p>\n<p>Haavatavus on p\u00f5hjustatud t\u00f5rkest sertifikaatide valideerimise kontrollikoodis funktsioonis vfy_CreateContext failis secvfy.c. T\u00f5rge ilmneb nii kliendi sertifikaadi lugemisel serverist kui ka t\u00f6\u00f6tlemisel. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/server\/dts-prohoster\/\"   title=\"serveriga\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"3028\">serveriga<\/a> klientide sertifikaate. Digitaalse allkirja kontrollimise k\u00e4igus, mis on kodeeritud DER-meetodil, dekodeerib NSS allkirja fikseeritud suurusega puhvri ja edastab selle PKCS #11 moodulisse. Edasise t\u00f6\u00f6tlemise k\u00e4igus kontrollitakse DSA ja RSA-PSS allkiri puhul suurust v\u00e4\u00e4ralt, mis viib m\u00e4lupuhvri \u00fclevooluni, mis on ette n\u00e4htud VFYContextStr struktuuri jaoks, kui digitaalne allkiri \u00fcletab 16384 bitti (m\u00e4lupuhvrile on eraldatud 2048 baiti, aga ei kontrollita, et allkiri v\u00f5ib olla suurem).    <\/p>\n<p>Haavatavusega kood on tuvastatud alates 2003. aastast, kuid see ei ole kujutanud ohtu enne 2012. aastal tehtud refaktoreerimist. 2017. aastal RSA-PSS toe rakendamisel tehti sama viga. R\u00fcnnaku teostamiseks ei ole vaja ressursimahukat kindlate v\u00f5tmete genereerimist vajalike andmete saamiseks, kuna \u00fclevool toimub allkirja \u00f5igsuse kontrollimise enne. \u00dclem\u00e4\u00e4rased andmed kirjutatakse m\u00e4lu osasse, mis sisaldab funktsioonide silte, mis lihtsustab t\u00f6\u00f6tavate eksploitide loomist.    <\/p>\n<p>Haavatavus avastati Google Project Zero uurijate poolt uute fuzzimislausete testimise meetodite katsetamise k\u00e4igus ja see on hea n\u00e4ide sellest, kuidas laialdaselt testitud tuntud projektis v\u00f5ivad triviaalne haavatavused pikka aega m\u00e4rkamata j\u00e4\u00e4da:  <\/p>\n<ul>\n<li class=\"l\"> NSS-i koodi toetab kogenud meeskond, kes vastutab turvalisuse ja rakendab modernseid testimis- ja vigade anal\u00fc\u00fcsi meetodeid. T\u00f6\u00f6tavad mitmed programmid, mis pakuvad olulisi preemiaid NSS-is leiduvate haavatavuste avastamise eest.\n<li class=\"l\">  NSS oli \u00fcks esimesi projekte, mis liitus Google'i oss-fuzz algatusega ja seda testiti ka Mozilla arendatavas fuzzimistestimise s\u00fcsteemis libFuzzeri baasil.\n<li class=\"l\"> Raamatukogu kood on korduvalt kontrollitud erinevate staatiliste anal\u00fcsaatorite poolt, sealhulgas on alates 2008. aastast j\u00e4lginud Coverity teenus.\n<li class=\"l\"> Kuni 2015. aastani kasutati NSS-i Google Chrome'is ja s\u00f5ltumatult Mozilla poolt kontrollis seda Google'i meeskond (alates 2015. aastast on Chrome \u00fcle l\u00e4inud BoringSSL-ile, kuid NSS-p\u00f5hise sadama tugi p\u00fcsib).    <\/ul>\n<p>Peamised probleemid, miks probleem pikka aega t\u00e4helepanuta j\u00e4i:  <\/p>\n<ul>\n<li class=\"l\"> NSS moodulaarne raamatukogu ja fuzzing-testimine viidi l\u00e4bi mitte tervikuna, vaid eraldi komponentide tasandil. N\u00e4iteks kontrolliti eraldi DER dekoodeerimise ja sertifikaatide t\u00f6\u00f6tlemise koodi \u2014 fuzzing'u k\u00e4igus v\u00f5idi saada sertifikaat, mis p\u00f5hjustas arutatava haavatavuse ilmnemise, kuid selle kontrollimine ei j\u00f5udnud verifitseerimise koodini ja probleem ei ilmunud v\u00e4lja.\n<li class=\"l\"> Fuzzing-testimise k\u00e4igus kehtestati v\u00e4ljundi suurusele ranged piirangud (10000 baiti), samas kui NSS-is selliseid piiranguid ei olnud (paljud struktuurid normaalses re\u017eiimis v\u00f5isid olla suuremad kui 10000 baiti, seega probleemide tuvastamiseks oli vajalik suurem sisendandmete maht). T\u00e4ielikuks kontrollimiseks pidi piirang olema 224-1 baiti (16 MB), mis vastab maksimaalsele sertifikaadi suurusele, mis on TLS-is lubatud.\n<li class=\"l\"> Vale arusaam fuzzing-testi katte ulatusest. Haavatav kood on aktiivselt testitud, kuid fuzzerite abil, mis ei suuda genereerida vajalikke sisendeid. N\u00e4iteks kasutas fuzzer tls_server_target eelnevalt m\u00e4\u00e4ratud sertifikaatide komplekti, mis piiras sertifikaadi kontrollimise koodi validatsiooni ainult TLS- s\u00f5numite ja protokolli oleku muutustega.    <\/ul>\n<p>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=56268\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043d\u0430\u0431\u043e\u0440\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a NSS (Network Security Services), \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Mozilla, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-43527), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 DSA \u0438\u043b\u0438 RSA-PSS, \u0437\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043c\u0435\u0442\u043e\u0434\u0430 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f DER (Distinguished Encoding Rules). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f BigSig, \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 NSS 3.73 \u0438 NSS ESR 3.68.1. \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102446","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043d\u0430\u0431\u043e\u0440\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a NSS (Network Security Services), \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Mozilla, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-43527), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 DSA \u0438\u043b\u0438 RSA-PSS, \u0437\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043c\u0435\u0442\u043e\u0434\u0430 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f DER (Distinguished Encoding Rules). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f BigSig, \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 NSS 3.73 \u0438 NSS ESR 3.68.1. \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-mozilla-nss-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-sertifikatov\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Mozilla NSS, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043d\u0430\u0431\u043e\u0440\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a NSS (Network Security Services), \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Mozilla, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-43527), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 DSA \u0438\u043b\u0438 RSA-PSS, \u0437\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043c\u0435\u0442\u043e\u0434\u0430 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f DER (Distinguished Encoding Rules). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f BigSig, \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 NSS 3.73 \u0438 NSS ESR 3.68.1. \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-mozilla-nss-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-sertifikatov\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-12-02T19:36:39+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-12-02T19:36:39+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus Mozilla NSS-is, mis v\u00f5imaldab koodi t\u00e4itmist sertifikaatide t\u00f6\u00f6tlemisel | ProHoster","description":"Mozilla arendatud NSS (Network Security Services) kr\u00fcptograafiliste raamatukogude kogumis leiti kriitiline haavatavus (CVE-2021-43527), mis v\u00f5ib viia pahatahtliku koodi t\u00e4itmisele DSA v\u00f5i RSA-PSS digitaalse allkirja t\u00f6\u00f6tlemisel, mis on m\u00e4\u00e4ratud DER (Distinguished Encoding Rules) kodeerimismeetodi abil. Probleem, millele on antud koodnimi BigSig, on k\u00f5rvaldatud NSS versioonides 3.73 ja NSS ESR 3.68.1. Pakettide uuendused","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-mozilla-nss-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-sertifikatov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Mozilla NSS, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 | ProHoster","og:description":"\u0412 \u043d\u0430\u0431\u043e\u0440\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a NSS (Network Security Services), \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Mozilla, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-43527), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 DSA \u0438\u043b\u0438 RSA-PSS, \u0437\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043c\u0435\u0442\u043e\u0434\u0430 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f DER (Distinguished Encoding Rules). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f BigSig, \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 NSS 3.73 \u0438 NSS ESR 3.68.1. \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-mozilla-nss-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-sertifikatov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-12-02T19:36:39+00:00","article:modified_time":"2021-12-02T19:36:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102446","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-12-02 19:38:04","updated":"2026-02-09 21:46:42"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102446","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=102446"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102446\/revisions"}],"predecessor-version":[{"id":160309,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102446\/revisions\/160309"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=102446"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=102446"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=102446"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}