{"id":121855,"date":"2025-02-12T02:22:04","date_gmt":"2025-02-12T00:22:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-openssl-3-4-1-s-ustraneniem-uyazvimostej"},"modified":"2025-02-12T02:22:04","modified_gmt":"2025-02-12T00:22:04","slug":"obnovlenie-openssl-3-4-1-s-ustraneniem-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/obnovlenie-openssl-3-4-1-s-ustraneniem-uyazvimostej","title":{"rendered":"Mise \u00e0 jour OpenSSL 3.4.1 avec correction de vuln\u00e9rabilit\u00e9s","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Des mises \u00e0 jour correctives de la biblioth\u00e8que cryptographique OpenSSL 3.0.16, 3.1.8, 3.2.4, 3.3.3 et 3.4.1 sont disponibles. Les versions 3.2.4, 3.3.3 et 3.4.1 corrigent une vuln\u00e9rabilit\u00e9 (CVE-2024-12797) class\u00e9e comme hautement dangereuse. Cette vuln\u00e9rabilit\u00e9 permet de r\u00e9aliser une attaque MITM sur des connexions TLS et DTLS. Le probl\u00e8me se manifeste uniquement dans les syst\u00e8mes utilisant des cl\u00e9s publiques RPK (Raw Public Key, RFC 7250) pour l'authentification des clients. Par d\u00e9faut, la prise en charge de RPK est d\u00e9sactiv\u00e9e c\u00f4t\u00e9 client et de serveurs<\/a>. <\/p>\n

La vuln\u00e9rabilit\u00e9 est caus\u00e9e par le fait qu'OpenSSL ne renvoie pas au client d'informations sur l'\u00e9chec de l'authentification du serveur lors de l'\u00e9tablissement d'une connexion avec le mode de v\u00e9rification SSL_VERIFY_PEER, car le processus de n\u00e9gociation de la connexion n'est pas correctement interrompu. L'attaquant peut alors r\u00e9aliser une attaque MITM et rediriger le trafic vers son propre h\u00f4te au lieu du serveur cible, tandis que le client ne recevra aucune information le serveur<\/a> signalant comme non authentifi\u00e9. Le probl\u00e8me appara\u00eet \u00e0 partir de la branche OpenSSL 3.2, o\u00f9 l'option d'utiliser RPK au lieu des certificats X.509 a \u00e9t\u00e9 introduite. <\/p>\n

De plus, les mises \u00e0 jour d'OpenSSL corrigent la vuln\u00e9rabilit\u00e9 CVE-2024-13176, permettant une attaque \u00e0 canal lat\u00e9ral pour reconstruire la cl\u00e9 priv\u00e9e ECDSA par l'analyse des d\u00e9lais survenant lors de la g\u00e9n\u00e9ration de signatures num\u00e9riques. La nature de la vuln\u00e9rabilit\u00e9 r\u00e9side dans le fait que pour certains types de courbes elliptiques, comme la NIST P-521, il est possible d'isoler des calculs avec des bits sup\u00e9rieurs nuls dans la valeur invers\u00e9e du vecteur d'initialisation (nonce), dont le temps de traitement diff\u00e8re de 300 nanosecondes. <\/p>\n

Dans le cas d'ECDSA, d\u00e9terminer ne serait-ce que quelques bits d'information sur le vecteur d'initialisation suffit pour mener une attaque par r\u00e9cup\u00e9ration s\u00e9quentielle de l'int\u00e9gralit\u00e9 de la cl\u00e9 priv\u00e9e. Pour r\u00e9ussir cette attaque, l'attaquant doit avoir acc\u00e8s \u00e0 un syst\u00e8me local sur lequel l'application g\u00e9n\u00e9rant les signatures num\u00e9riques s'ex\u00e9cute, ou une connexion r\u00e9seau haute vitesse \u00e0 l'application avec des latences tr\u00e8s faibles. L'attaquant doit \u00e9galement \u00eatre en mesure d'analyser avec une grande pr\u00e9cision le temps de g\u00e9n\u00e9ration d'un grand nombre de signatures num\u00e9riques cr\u00e9\u00e9es sur des donn\u00e9es qu'il conna\u00eet.
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 OpenSSL 3.0.16, 3.1.8, 3.2.4, 3.3.3 \u0438 3.4.1. \u0412 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 3.2.4, 3.3.3 \u0438 3.4.1 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-12797), \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u0432\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c MITM-\u0430\u0442\u0430\u043a\u0443 \u043d\u0430 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f TLS \u0438 DTLS. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0435 \u043a\u043b\u044e\u0447\u0438 RPK (Raw Public Key, RFC 7250). \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121855","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Mise \u00e0 jour OpenSSL 3.4.1 corrigeant les vuln\u00e9rabilit\u00e9s | ProHoster","description":"Des mises \u00e0 jour correctives de la biblioth\u00e8que cryptographique OpenSSL 3.0.16, 3.1.8, 3.2.4, 3.3.3 et 3.4.1 sont disponibles.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/obnovlenie-openssl-3-4-1-s-ustraneniem-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 OpenSSL 3.4.1 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 OpenSSL 3.0.16, 3.1.8, 3.2.4, 3.3.3 \u0438 3.4.1.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/obnovlenie-openssl-3-4-1-s-ustraneniem-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-02-12T00:22:04+00:00","article:modified_time":"2025-02-12T00:22:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121855","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 15:50:24","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 10:32:20","updated":"2026-02-22 15:50:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/121855","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=121855"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/121855\/revisions"}],"predecessor-version":[{"id":173018,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/121855\/revisions\/173018"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=121855"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=121855"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=121855"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}