GnuPG 2.2.23 sabuntawa tare da gyara rashin lahani mai mahimmanci

aka buga sakin kayan aiki GnuPG 2.2.23 (GNU Privacy Guard), mai jituwa tare da ka'idojin OpenPGP (BA-4880) da S/MIME, kuma yana ba da kayan aiki don ɓoye bayanan, aiki tare da sa hannun lantarki, sarrafa maɓalli da samun dama ga shagunan maɓalli na jama'a. Sabuwar sigar tana gyara mummunan rauni (CVE-2020-25125), wanda ya bayyana yana farawa daga sigar 2.2.21 kuma ana amfani dashi lokacin shigo da maɓallin Buɗe PGP na musamman.

Shigo da maɓalli tare da babban ƙira na musamman na AEAD algorithms na iya haifar da ambaliya da faɗuwa ko ɗabi'a mara fayyace. An lura cewa ƙirƙirar amfani da ke haifar da ba kawai ga rushewa ba aiki ne mai wuyar gaske, amma irin wannan yiwuwar ba za a iya kawar da shi ba. Babban wahala wajen haɓaka amfani shine saboda gaskiyar cewa maharin zai iya sarrafa kowane byte na biyu kawai na jeri, kuma byte na farko koyaushe yana ɗaukar ƙimar 0x04. Tsarin rarraba software tare da tabbatarwar maɓalli na dijital suna da aminci saboda suna amfani da jerin maɓallan da aka riga aka ayyana.

source: budenet.ru

Add a comment