{"id":84601,"date":"2020-06-09T13:42:13","date_gmt":"2020-06-09T11:42:13","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-gnutls-pozvolyayushhaya-vozobnovit-seans-tls-1-3-bez-znaniya-klyucha"},"modified":"2020-06-09T13:42:13","modified_gmt":"2020-06-09T11:42:13","slug":"uyazvimost-v-gnutls-pozvolyayushhaya-vozobnovit-seans-tls-1-3-bez-znaniya-klyucha","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/uyazvimost-v-gnutls-pozvolyayushhaya-vozobnovit-seans-tls-1-3-bez-znaniya-klyucha","title":{"rendered":"Vulnerabilit\u00e0 in GnuTLS che consente il rinnovo della sessione TLS 1.3 senza conoscere la chiave","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Nella libreria GnuTLS, utilizzata di default in molti pacchetti di Debian, incluso il gestore di pacchetti APT e molte utilit\u00e0, \u00e8 stata rilevata<\/a><\/noindex> una vulnerabilit\u00e0<\/a><\/noindex> (CVE-2020-13777<\/a><\/noindex>), che consente il ripristino di una sessione TLS precedentemente interrotta senza conoscere la chiave di sessione. Dal punto di vista pratico, la vulnerabilit\u00e0 pu\u00f2 essere utilizzata per attacchi MITM. <\/p>\n

La vulnerabilit\u00e0 \u00e8 causata da una costruzione errata della chiave di sessione ticket\u2014il server TLS non associava la chiave di sessione di crittografia al valore fornito dall'applicazione. Fino al primo cambio di chiave, il server TLS, durante la creazione delle chiavi di sessione, continua a utilizzare dati errati invece della chiave di crittografia ricevuta dall'applicazione, consentendo a un attaccante di bypassare l'autenticazione in TLS 1.3 e riprendere sessioni precedenti in modalit\u00e0 TLS 1.2.<\/p>\n

Vulnerabilit\u00e0 risolto<\/a><\/noindex> nella versione 3.6.14, in cui \u00e8 stata anche risolta i problemi<\/a><\/noindex> la gestione dei certificati firmati incrociati, emersa dopo l'invalidamento del certificato radice AddTrust. Il problema si manifesta a partire dalla versione 3.6.4 (2018-09-24). Nei pacchetti distribuiti, la vulnerabilit\u00e0 \u00e8 stata risolta in Debian<\/a><\/noindex>, SUSE<\/a><\/noindex>, FreeBSD<\/a><\/noindex>, Fedora<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, EPEL<\/a><\/noindex>, RHEL 8<\/a><\/noindex> (RHEL 6 e 7 non sono vulnerabili<\/a><\/noindex>).<\/p>\n

<\/a><\/noindex><\/p>\n

Fonte: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 GnuTLS, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 \u0438\u0437 \u0441\u043e\u0441\u0442\u0430\u0432\u0430 Debian, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0439 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440 APT \u0438 \u043c\u043d\u043e\u0433\u0438\u0435 \u0443\u0442\u0438\u043b\u0438\u0442\u044b, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-13777), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043e\u0437\u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0440\u0430\u043d\u0435\u0435 \u043e\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u0441\u0435\u0430\u043d\u0441 TLS \u0431\u0435\u0437 \u0437\u043d\u0430\u043d\u0438\u044f \u0441\u0435\u0441\u0441\u0438\u043e\u043d\u043d\u043e\u0433\u043e \u043a\u043b\u044e\u0447\u0430. \u0421 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0438\u044f MITM-\u0430\u0442\u0430\u043a. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u044b\u043c \u043f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u0438\u0435\u043c \u0441\u0435\u0441\u0441\u0438\u043e\u043d\u043d\u043e\u0433\u043e ticket-\u043a\u043b\u044e\u0447\u0430 — TLS-\u0441\u0435\u0440\u0432\u0435\u0440 \u043d\u0435 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u043b \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0443 \u0441\u0435\u0441\u0441\u0438\u043e\u043d\u043d\u043e\u0433\u043e \u043a\u043b\u044e\u0447\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-84601","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u00e0 in GnuTLS che consente il ripristino di una sessione TLS 1.3 senza conoscere la chiave | ProHoster","description":"Nella libreria GnuTLS, utilizzata di default in molti pacchetti di Debian, incluso il gestore di pacchetti APT e molte utilit\u00e0, \u00e8 stata trovata una vulnerabilit\u00e0 (CVE-2020-13777) che consente il ripristino di una sessione TLS precedentemente interrotta senza conoscere la chiave di sessione. Dal punto di vista pratico, la vulnerabilit\u00e0 pu\u00f2 essere utilizzata per attacchi MITM. La vulnerabilit\u00e0 \u00e8 causata da una costruzione errata della chiave del ticket di sessione: il server TLS non associava la chiave di sessione","canonical_url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/uyazvimost-v-gnutls-pozvolyayushhaya-vozobnovit-seans-tls-1-3-bez-znaniya-klyucha","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 GnuTLS, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043e\u0437\u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0435\u0430\u043d\u0441 TLS 1.3 \u0431\u0435\u0437 \u0437\u043d\u0430\u043d\u0438\u044f \u043a\u043b\u044e\u0447\u0430 | ProHoster","og:description":"\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 GnuTLS, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 \u0438\u0437 \u0441\u043e\u0441\u0442\u0430\u0432\u0430 Debian, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0439 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440 APT \u0438 \u043c\u043d\u043e\u0433\u0438\u0435 \u0443\u0442\u0438\u043b\u0438\u0442\u044b, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-13777), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043e\u0437\u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0440\u0430\u043d\u0435\u0435 \u043e\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u0441\u0435\u0430\u043d\u0441 TLS \u0431\u0435\u0437 \u0437\u043d\u0430\u043d\u0438\u044f \u0441\u0435\u0441\u0441\u0438\u043e\u043d\u043d\u043e\u0433\u043e \u043a\u043b\u044e\u0447\u0430. \u0421 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0438\u044f MITM-\u0430\u0442\u0430\u043a. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u044b\u043c \u043f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u0438\u0435\u043c \u0441\u0435\u0441\u0441\u0438\u043e\u043d\u043d\u043e\u0433\u043e ticket-\u043a\u043b\u044e\u0447\u0430 - TLS-\u0441\u0435\u0440\u0432\u0435\u0440 \u043d\u0435 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u043b \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0443 \u0441\u0435\u0441\u0441\u0438\u043e\u043d\u043d\u043e\u0433\u043e \u043a\u043b\u044e\u0447\u0430","og:url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/uyazvimost-v-gnutls-pozvolyayushhaya-vozobnovit-seans-tls-1-3-bez-znaniya-klyucha","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-09T11:42:13+00:00","article:modified_time":"2020-06-09T11:42:13+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"84601","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:54:33","updated":"2022-09-28 00:21:28"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/84601","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=84601"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/84601\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=84601"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=84601"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=84601"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}