{"id":102446,"date":"2021-12-02T21:36:39","date_gmt":"2021-12-02T19:36:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-mozilla-nss-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-sertifikatov"},"modified":"2021-12-02T21:36:39","modified_gmt":"2021-12-02T19:36:39","slug":"uyazvimost-v-mozilla-nss-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-sertifikatov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/uyazvimost-v-mozilla-nss-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-sertifikatov","title":{"rendered":"Vulnerabilit\u00e0 in Mozilla NSS consente l'esecuzione di codice durante l'elaborazione dei certificati","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Nel pacchetto di librerie crittografiche NSS (Network Security Services), sviluppato da Mozilla, \u00e8 stata identificata una vulnerabilit\u00e0 critica (CVE-2021-43527) che pu\u00f2 portare all'esecuzione di codice da parte di un aggressore durante l'elaborazione di firme digitali DSA o RSA-PSS, create utilizzando il metodo di codifica DER (Distinguished Encoding Rules). La problematica, nota con il nome in codice BigSig, \u00e8 stata risolta nelle versioni NSS 3.73 e NSS ESR 3.68.1. Gli aggiornamenti dei pacchetti sono disponibili per le distribuzioni Debian, RHEL, Ubuntu, SUSE, Arch Linux, Gentoo, FreeBSD. Gli aggiornamenti per Fedora non sono ancora disponibili.    <\/p>\n<p> La problematica si manifesta nelle applicazioni che utilizzano NSS per l'elaborazione di firme digitali CMS, S\/MIME, PKCS #7 e PKCS #12, o durante la verifica dei certificati nelle implementazioni TLS, X.509, OCSP e CRL. La vulnerabilit\u00e0 pu\u00f2 emergere in varie applicazioni client e server che supportano TLS, DTLS e S\/MIME, cos\u00ec come nei client di posta e nei lettori PDF che utilizzano la chiamata NSS CERT_VerifyCertificate() per verificare le firme digitali.     <\/p>\n<p>A titolo di esempio, le applicazioni vulnerabili includono LibreOffice, Evolution e Evince. Potenzialmente la problematica potrebbe riguardare anche progetti come Pidgin, Apache OpenOffice, Suricata, Curl, Chrony, Red Hat Directory Server, Red Hat Certificate System, mod_nss per il server http Apache, Oracle Communications Messaging Server e Oracle Directory Server Enterprise Edition. Tuttavia, la vulnerabilit\u00e0 non si manifesta in Firefox, Thunderbird e Tor Browser, dove viene utilizzata una libreria separata mozilla::pkix per la verifica, anch'essa parte di NSS. Anche i browser basati su Chromium non sono vulnerabili (se non sono stati specificamente compilati con NSS) e quelli che hanno utilizzato NSS fino al 2015, sono stati poi migrati a BoringSSL.    <\/p>\n<p>La vulnerabilit\u00e0 \u00e8 causata da un errore nel codice di verifica dei certificati nella funzione vfy_CreateContext del file secvfy.c. L'errore si manifesta sia durante la lettura del certificato da parte del client dal server, sia durante l'elaborazione. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/it\/server\/dts-prohoster\/\"   title=\"server\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"3028\">server<\/a> certificati dei clienti. Durante il processo di verifica della firma digitale codificata con il metodo DER, NSS decodifica la firma in un buffer di dimensione fissa e la trasmette al modulo PKCS #11. Nella fase di elaborazione successiva, per le firme DSA e RSA-PSS non viene verificata correttamente la dimensione, portando a un overflow del buffer allocato per la struttura VFYContextStr, se la dimensione della firma digitale supera i 16384 bit (il buffer \u00e8 allocato a 2048 byte, ma non viene controllato che la firma possa essere di dimensioni superiori).    <\/p>\n<p>Il codice contenente la vulnerabilit\u00e0 \u00e8 tracciato dal 2003, ma non presentava minacce fino al refactoring avvenuto nel 2012. Nel 2017, durante l'implementazione del supporto RSA-PSS, \u00e8 stato commesso lo stesso errore. Per eseguire l'attacco non \u00e8 necessaria una generazione dispendiosa di determinati tasti per ottenere i dati necessari, poich\u00e9 l'overflow si verifica in fase antecedente alla verifica della correttezza della firma digitale. La parte dei dati che esce dai limiti viene scritta nello spazio di memoria contenente puntatori a funzioni, facilitando la creazione di exploit funzionanti.    <\/p>\n<p>La vulnerabilit\u00e0 \u00e8 stata scoperta dai ricercatori di Google Project Zero durante esperimenti con nuovi metodi di fuzzing e rappresenta una buona dimostrazione di come vulnerabilit\u00e0 triviali possano rimanere inosservate per lungo tempo anche in un progetto ampiamente testato e ben noto.  <\/p>\n<ul>\n<li class=\"l\"> Il codice NSS \u00e8 accompagnato da un team esperto responsabile della sicurezza, che utilizza metodi moderni di test e analisi degli errori. Sono attive diverse programmazione per il pagamento di premi significativi per la scoperta di vulnerabilit\u00e0 in NSS.\n<li class=\"l\">  NSS \u00e8 stato uno dei primi progetti a unirsi all'iniziativa Google oss-fuzz ed \u00e8 stato anche testato all'interno del sistema di fuzzing in sviluppo di Mozilla basato su libFuzzer.\n<li class=\"l\"> Il codice della libreria \u00e8 stato verificato pi\u00f9 volte con diversi analizzatori statici, incluso il servizio Coverity che monitora dal 2008.\n<li class=\"l\"> Fino al 2015, NSS \u00e8 stato utilizzato in Google Chrome e controllato indipendentemente da Mozilla dal team di Google (a partire dal 2015 Chrome \u00e8 passato a BoringSSL, ma il supporto per il porting basato su NSS rimane).    <\/ul>\n<p>I principali problemi che hanno fatto s\u00ec che la vulnerabilit\u00e0 rimanesse inosservata per lungo tempo:  <\/p>\n<ul>\n<li class=\"l\"> La libreria modulare NSS e il test di fuzzing sono stati condotti non a livello generale, ma a livello di singoli componenti. Ad esempio, \u00e8 stato controllato separatamente il codice di decodifica DER e l'elaborazione dei certificati \u2014 durante il fuzzing potrebbe essersi ricevuto un certificato che induce a manifestare la vulnerabilit\u00e0 esaminata, ma la sua verifica non raggiungeva il codice di validazione e il problema non si era manifestato.\n<li class=\"l\"> Durante il testing fuzzing, sono stati imposti rigidi limiti alla dimensione dell'output (10.000 byte) mentre non esistevano restrizioni simili in NSS (molte strutture in modalit\u00e0 normale potevano avere dimensioni superiori a 10.000 byte, per cui era necessario un maggior volume di dati in ingresso per identificare problemi). Per un'adeguata verifica, il limite avrebbe dovuto essere di 224-1 byte (16 MB), corrispondente alla dimensione massima del certificato consentita in TLS.\n<li class=\"l\"> Una comprensione errata della copertura del codice nei test di fuzzing. Il codice vulnerabile \u00e8 stato attivamente testato, ma utilizzando fuzzer incapaci di generare i necessari input. Ad esempio, il fuzzer tls_server_target ha utilizzato un insieme predefinito di certificati pronti, limitando cos\u00ec il controllo del codice di verifica del certificato solo ai messaggi TLS e alle variazioni dello stato del protocollo.    <\/ul>\n<p>Fonte: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=56268\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043d\u0430\u0431\u043e\u0440\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a NSS (Network Security Services), \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Mozilla, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-43527), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 DSA \u0438\u043b\u0438 RSA-PSS, \u0437\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043c\u0435\u0442\u043e\u0434\u0430 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f DER (Distinguished Encoding Rules). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f BigSig, \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 NSS 3.73 \u0438 NSS ESR 3.68.1. \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102446","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043d\u0430\u0431\u043e\u0440\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a NSS (Network Security Services), \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Mozilla, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-43527), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 DSA \u0438\u043b\u0438 RSA-PSS, \u0437\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043c\u0435\u0442\u043e\u0434\u0430 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f DER (Distinguished Encoding Rules). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f BigSig, \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 NSS 3.73 \u0438 NSS ESR 3.68.1. \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/uyazvimost-v-mozilla-nss-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-sertifikatov\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"it_IT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Mozilla NSS, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043d\u0430\u0431\u043e\u0440\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a NSS (Network Security Services), \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Mozilla, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-43527), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 DSA \u0438\u043b\u0438 RSA-PSS, \u0437\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043c\u0435\u0442\u043e\u0434\u0430 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f DER (Distinguished Encoding Rules). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f BigSig, \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 NSS 3.73 \u0438 NSS ESR 3.68.1. \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/uyazvimost-v-mozilla-nss-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-sertifikatov\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-12-02T19:36:39+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-12-02T19:36:39+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u00e0 in Mozilla NSS che consente l'esecuzione di codice durante l'elaborazione dei certificati | ProHoster","description":"\u00c8 stata scoperta una vulnerabilit\u00e0 critica (CVE-2021-43527) nel set di librerie crittografiche NSS (Network Security Services) sviluppato da Mozilla, che pu\u00f2 portare all'esecuzione di codice da parte di un attaccante durante l'elaborazione di firme digitali DSA o RSA-PSS definite utilizzando il metodo di codifica DER (Distinguished Encoding Rules). Il problema, soprannominato BigSig, \u00e8 stato risolto nelle versioni NSS 3.73 e NSS ESR 3.68.1. Aggiornamenti dei pacchetti","canonical_url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/uyazvimost-v-mozilla-nss-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-sertifikatov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Mozilla NSS, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 | ProHoster","og:description":"\u0412 \u043d\u0430\u0431\u043e\u0440\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a NSS (Network Security Services), \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Mozilla, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-43527), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 DSA \u0438\u043b\u0438 RSA-PSS, \u0437\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043c\u0435\u0442\u043e\u0434\u0430 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f DER (Distinguished Encoding Rules). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f BigSig, \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 NSS 3.73 \u0438 NSS ESR 3.68.1. \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432","og:url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/uyazvimost-v-mozilla-nss-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-sertifikatov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-12-02T19:36:39+00:00","article:modified_time":"2021-12-02T19:36:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102446","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-12-02 19:38:04","updated":"2026-02-09 21:46:42"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/102446","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=102446"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/102446\/revisions"}],"predecessor-version":[{"id":160309,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/102446\/revisions\/160309"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=102446"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=102446"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=102446"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}