{"id":121855,"date":"2025-02-12T02:22:04","date_gmt":"2025-02-12T00:22:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-openssl-3-4-1-s-ustraneniem-uyazvimostej"},"modified":"2025-02-12T02:22:04","modified_gmt":"2025-02-12T00:22:04","slug":"obnovlenie-openssl-3-4-1-s-ustraneniem-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/obnovlenie-openssl-3-4-1-s-ustraneniem-uyazvimostej","title":{"rendered":"OpenSSL 3.4.1 v\u00e4rskendus turvan\u00f5rkuste k\u00f5rvaldamiseks","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Korrigeerivad versioonid kr\u00fcptograafilisest raamatukogust OpenSSL 3.0.16, 3.1.8, 3.2.4, 3.3.3 ja 3.4.1 on saadaval. Versioonides 3.2.4, 3.3.3 ja 3.4.1 on k\u00f5rvaldatud haavatavus (CVE-2024-12797), millele on antud k\u00f5rge ohuaste. Haavatavus v\u00f5imaldab korraldada MITM-r\u00fcnnaku TLS ja DTLS \u00fchendustes. Probleem ilmneb ainult s\u00fcsteemides, mis kasutavad kliendi autentimiseks RPK avatud v\u00f5tmeid (Raw Public Key, RFC 7250). RPK tugi on kliendi k\u00fcljes vaikimisi keelatud ja serverilt<\/a>. <\/p>\n

Haavatavus tuleneb sellest, et OpenSSL ei edasta kliendile teavet serveri autentimise t\u00f5rkest, kui luuakse \u00fchendus SSL_VERIFY_PEER verifitseerimisre\u017eiimi kasutades, kuna \u00fchenduse l\u00e4bir\u00e4\u00e4kimise protsess ei katkestata \u00f5igesti. R\u00fcndaja saab korraldada MITM-r\u00fcnnaku ja suunata liikluse oma hostile sihtserveri asemel, ning klient ei saa teavet, et server<\/a> ei ole autentitud. Probleem ilmneb alates OpenSSL 3.2 harust, kus lisandus RPK kasutamise v\u00f5imalus X.509 sertifikaatide asemel. <\/p>\n

Lisaks on OpenSSL v\u00e4rskendustes parandatud haavatavust CVE-2024-13176, mis v\u00f5imaldab r\u00fcnnakut k\u00fclgkanalite kaudu ECDSA privaatv\u00f5tme taastamiseks, anal\u00fc\u00fcsides viivitusi, mis tekivad digitaalsete allkirjade genereerimise k\u00e4igus. Haavatavuse olemus on selles, et teatud t\u00fc\u00fcpi elliptiliste k\u00f5verate, n\u00e4iteks NIST P-521 puhul, saab \u00fcldisest massist v\u00e4lja tuua nullis \u00fclemiste bittidega arvutused, mille t\u00f6\u00f6tlemise aeg erineb 300 nanosekundi v\u00f5rra. <\/p>\n

ECDSA puhul piisab isegi m\u00f5nede bittide m\u00e4\u00e4ramisest, mis sisaldavad teavet initsialiseerimisvektorist, r\u00fcnnaku l\u00e4biviimiseks, mille tulemusel saab j\u00e4rjestikku taastada kogu privaatv\u00f5tme. R\u00fcnnaku edukaks l\u00e4biviimiseks peab r\u00fcndajal olema juurdep\u00e4\u00e4s kohalikule s\u00fcsteemile, kus k\u00e4ivitub digitaalsete allkirjade genereerimise rakendus, v\u00f5i kiiruslintide kaudu rakendusele v\u00e4ga madalate viivitustega. R\u00fcndajal peab olema ka v\u00f5imalus v\u00e4ga t\u00e4pselt anal\u00fc\u00fcsida suure hulga digitaalsete allkirjade genereerimise aega, mis on loodud teadaoleva teabe p\u00f5hjal.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 OpenSSL 3.0.16, 3.1.8, 3.2.4, 3.3.3 \u0438 3.4.1. \u0412 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 3.2.4, 3.3.3 \u0438 3.4.1 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-12797), \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u0432\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c MITM-\u0430\u0442\u0430\u043a\u0443 \u043d\u0430 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f TLS \u0438 DTLS. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0435 \u043a\u043b\u044e\u0447\u0438 RPK (Raw Public Key, RFC 7250). \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121855","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47OpenSSL 3.4.1 uuendus haavatavuste k\u00f5rvaldamiseks | ProHoster","description":"Saadaval on korrektsiooniv\u00e4ljaanded kr\u00fcptograafia teegi OpenSSL 3.0.16, 3.1.8, 3.2.4, 3.3.3 ja 3.4.1.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/obnovlenie-openssl-3-4-1-s-ustraneniem-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 OpenSSL 3.4.1 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 OpenSSL 3.0.16, 3.1.8, 3.2.4, 3.3.3 \u0438 3.4.1.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/obnovlenie-openssl-3-4-1-s-ustraneniem-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-02-12T00:22:04+00:00","article:modified_time":"2025-02-12T00:22:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121855","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 15:50:24","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 10:32:20","updated":"2026-02-22 15:50:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/121855","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=121855"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/121855\/revisions"}],"predecessor-version":[{"id":173018,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/121855\/revisions\/173018"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=121855"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=121855"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=121855"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}