{"id":121855,"date":"2025-02-12T02:22:04","date_gmt":"2025-02-12T00:22:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-openssl-3-4-1-s-ustraneniem-uyazvimostej"},"modified":"2025-02-12T02:22:04","modified_gmt":"2025-02-12T00:22:04","slug":"obnovlenie-openssl-3-4-1-s-ustraneniem-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/obnovlenie-openssl-3-4-1-s-ustraneniem-uyazvimostej","title":{"rendered":"OpenSSL 3.4.1 uuendus, mis k\u00f5rvaldab haavatavused","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Saadaval on OpenSSLi kr\u00fcptoosalise raamatukogu versioonid 3.0.16, 3.1.8, 3.2.4, 3.3.3 ja 3.4.1. Versioonides 3.2.4, 3.3.3 ja 3.4.1 on lahendatud haavatavus (CVE-2024-12797), millele on antud k\u00f5rge ohu tase. See haavatavus v\u00f5imaldab korraldada MITM-r\u00fcnnaku TLS-i ja DTLS-i \u00fchendustele. Probleem ilmneb ainult nendes s\u00fcsteemides, mis kasutavad kliendi autentimiseks RPK (Raw Public Key, RFC 7250) avatud v\u00f5tmeid. Vaikimisi on RPK tugi kliendi poolel keelatud ja serverile<\/a>. <\/p>\n

Haavatavus tuleneb sellest, et OpenSSL ei edasta kliendile teavet serveri autentimisvea kohta, kui luuakse \u00fchendust SSL_VERIFY_PEER kinnitamisre\u017eiimi kasutades, kuna \u00fchenduse loomise protsess ei katkestata \u00f5igesti. R\u00fcndaja v\u00f5ib korraldada MITM-r\u00fcnnaku ja suunata liikluse oma hostile siht-serveri asemel, kuid klient ei saa teavet, et server<\/a> ei ole autentitud. Probleem ilmneb alates OpenSSL 3.2 harust, kus on v\u00f5imalik kasutada RPK-d X.509 sertifikaatide asemel. <\/p>\n

Lisaks on OpenSSLi uuendustes parandatud haavatavust CVE-2024-13176, mis v\u00f5imaldab r\u00fcnnakut k\u00fclgkanalite kaudu ECDSA privaatv\u00f5tme taastamiseks, anal\u00fc\u00fcsides viivitusi, mis tekivad digitaalallkirja genereerimise ajal. Haavatavuse olemus seisneb selles, et teatud t\u00fc\u00fcpi elliptiliste k\u00f5verate, nagu NIST P-521 puhul, on v\u00f5imalik eraldada arvutused, millel on nulli vanemad bitid initsialiseerimisvektoris (nonce), mille t\u00f6\u00f6tlemise aeg erineb 300 nanosekundi v\u00f5rra. <\/p>\n

ECDSA puhul on piisav, et m\u00e4\u00e4rata isegi m\u00f5ned bitid teavet initsialiseerimisvektori kohta, et teostada r\u00fcnnak j\u00e4rjestikumise kaudu, et taastada kogu privaatv\u00f5ti. R\u00fcnnaku edukaks elluviimiseks peab r\u00fcndajal olema juurdep\u00e4\u00e4s kohalikule s\u00fcsteemile, kus t\u00f6\u00f6tatakse v\u00e4lja digitaalallkirju lugev rakendus, v\u00f5i kiudupesaverk, millel on v\u00e4ga madalad viivitused. R\u00fcndajal peab olema ka v\u00f5imalus t\u00e4pselt anal\u00fc\u00fcsida suure hulga digitaalallkirjade genereerimise aega, mis on loodud tuntud andmete p\u00f5hjal.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 OpenSSL 3.0.16, 3.1.8, 3.2.4, 3.3.3 \u0438 3.4.1. \u0412 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 3.2.4, 3.3.3 \u0438 3.4.1 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-12797), \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u0432\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c MITM-\u0430\u0442\u0430\u043a\u0443 \u043d\u0430 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f TLS \u0438 DTLS. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0435 \u043a\u043b\u044e\u0447\u0438 RPK (Raw Public Key, RFC 7250). \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121855","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47OpenSSLi uuendus 3.4.1 haavatavuste parandamisega | ProHoster","description":"Saadaval on OpenSSLi kr\u00fcptoosalise raamatukogu versioonid 3.0.16, 3.1.8, 3.2.4, 3.3.3 ja 3.4.1. Versioonides 3.2.4, 3.3.3 ja 3.4.1 on lahendatud haavatavus (CVE-2024-12797), millele on antud k\u00f5rge ohu tase. See haavatavus v\u00f5imaldab korraldada MITM-r\u00fcnnaku TLS-i ja DTLS-i \u00fchendustele. Probleem ilmneb ainult nendes s\u00fcsteemides, mis kasutavad kliendi autentimiseks RPK avatud v\u00f5tmeid. Vaikimisi on tugi","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/obnovlenie-openssl-3-4-1-s-ustraneniem-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 OpenSSL 3.4.1 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 OpenSSL 3.0.16, 3.1.8, 3.2.4, 3.3.3 \u0438 3.4.1. \u0412 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 3.2.4, 3.3.3 \u0438 3.4.1 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-12797), \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u0432\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c MITM-\u0430\u0442\u0430\u043a\u0443 \u043d\u0430 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f TLS \u0438 DTLS. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0435 \u043a\u043b\u044e\u0447\u0438 RPK (Raw Public Key, RFC 7250). \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/obnovlenie-openssl-3-4-1-s-ustraneniem-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-02-12T00:22:04+00:00","article:modified_time":"2025-02-12T00:22:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121855","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 15:50:24","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 10:32:20","updated":"2026-02-22 15:50:24"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/121855","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=121855"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/121855\/revisions"}],"predecessor-version":[{"id":173018,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/121855\/revisions\/173018"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=121855"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=121855"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=121855"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}