{"id":121855,"date":"2025-02-12T02:22:04","date_gmt":"2025-02-12T00:22:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-openssl-3-4-1-s-ustraneniem-uyazvimostej"},"modified":"2025-02-12T02:22:04","modified_gmt":"2025-02-12T00:22:04","slug":"obnovlenie-openssl-3-4-1-s-ustraneniem-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/obnovlenie-openssl-3-4-1-s-ustraneniem-uyazvimostej","title":{"rendered":"Aktualizacja OpenSSL 3.4.1 z poprawkami zabezpiecze\u0144.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Dost\u0119pne s\u0105 poprawki do biblioteki kryptograficznej OpenSSL w wersjach 3.0.16, 3.1.8, 3.2.4, 3.3.3 oraz 3.4.1. W wersjach 3.2.4, 3.3.3 i 3.4.1 naprawiono luk\u0119 (CVE-2024-12797), kt\u00f3rej przyznano wysoki poziom zagro\u017cenia. Luka ta umo\u017cliwia przeprowadzenie ataku MITM na po\u0142\u0105czenia TLS i DTLS. Problem wyst\u0119puje tylko w systemach, kt\u00f3re u\u017cywaj\u0105 do uwierzytelniania klient\u00f3w kluczy publicznych RPK (Raw Public Key, RFC 7250). Domy\u015blnie obs\u0142uga RPK jest wy\u0142\u0105czona po stronie klienta i serwera<\/a>. <\/p>\n

Luka powstaje z powodu tego, \u017ce OpenSSL nie zwraca klientowi informacji o b\u0142\u0119dzie uwierzytelnienia serwera podczas nawi\u0105zywania po\u0142\u0105czenia w trybie weryfikacji SSL_VERIFY_PEER, poniewa\u017c proces negocjacji po\u0142\u0105czenia nie zostaje prawid\u0142owo zerwany. Atakuj\u0105cy mo\u017ce przeprowadzi\u0107 atak MITM i przekierowa\u0107 ruch na sw\u00f3j host zamiast na docelowy serwer, a klient nie otrzyma informacji, \u017ce serwer<\/a> nie zosta\u0142 uwierzytelniony. Problem wyst\u0119puje od ga\u0142\u0119zi OpenSSL 3.2, w kt\u00f3rej wprowadzono mo\u017cliwo\u015b\u0107 u\u017cywania RPK zamiast certyfikat\u00f3w X.509. <\/p>\n

Ponadto w aktualizacjach OpenSSL naprawiono luk\u0119 CVE-2024-13176, kt\u00f3ra umo\u017cliwia przeprowadzenie ataku przez boczne kana\u0142y w celu odzyskania tajnego klucza ECDSA poprzez analiz\u0119 op\u00f3\u017anie\u0144, kt\u00f3re pojawiaj\u0105 si\u0119 podczas generowania podpisu cyfrowego. Istota luki polega na tym, \u017ce dla niekt\u00f3rych rodzaj\u00f3w krzywych eliptycznych, takich jak NIST P-521, z og\u00f3\u0142u oblicze\u0144 mo\u017cna wyr\u00f3\u017cni\u0107 obliczenia z zerowymi najstarszymi bitami odwr\u00f3conej warto\u015bci wektora inicjalizacyjnego (nonce), kt\u00f3rych czas przetwarzania r\u00f3\u017cni si\u0119 o 300 nanosekund. <\/p>\n

W przypadku ECDSA okre\u015blenie nawet kilku bit\u00f3w z informacj\u0105 o wektorze inicjalizacyjnym jest wystarczaj\u0105ce do przeprowadzenia ataku polegaj\u0105cego na sekwencyjnym odzyskiwaniu ca\u0142ego tajnego klucza. Aby atak by\u0142 skuteczny, atakuj\u0105cy musi mie\u0107 dost\u0119p do lokalnego systemu, na kt\u00f3rym dzia\u0142a aplikacja generuj\u0105ca podpisy cyfrowe, lub szybki dost\u0119p sieciowy do aplikacji z bardzo niskimi op\u00f3\u017anieniami. Atakuj\u0105cy musi r\u00f3wnie\u017c mie\u0107 mo\u017cliwo\u015b\u0107 bardzo dok\u0142adnej analizy czasu generowania du\u017cej liczby podpis\u00f3w cyfrowych utworzonych nad danymi, kt\u00f3re s\u0105 mu znane.
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 OpenSSL 3.0.16, 3.1.8, 3.2.4, 3.3.3 \u0438 3.4.1. \u0412 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 3.2.4, 3.3.3 \u0438 3.4.1 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-12797), \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u0432\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c MITM-\u0430\u0442\u0430\u043a\u0443 \u043d\u0430 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f TLS \u0438 DTLS. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0435 \u043a\u043b\u044e\u0447\u0438 RPK (Raw Public Key, RFC 7250). \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121855","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Aktualizacja OpenSSL 3.4.1 z poprawkami zabezpiecze\u0144 | ProHoster","description":"Dost\u0119pne s\u0105 poprawki do biblioteki kryptograficznej OpenSSL 3.0.16, 3.1.8, 3.2.4, 3.3.3 i 3.4.1.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/obnovlenie-openssl-3-4-1-s-ustraneniem-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 OpenSSL 3.4.1 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 OpenSSL 3.0.16, 3.1.8, 3.2.4, 3.3.3 \u0438 3.4.1.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/obnovlenie-openssl-3-4-1-s-ustraneniem-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-02-12T00:22:04+00:00","article:modified_time":"2025-02-12T00:22:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121855","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 15:50:24","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 10:32:20","updated":"2026-02-22 15:50:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/121855","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=121855"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/121855\/revisions"}],"predecessor-version":[{"id":173018,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/121855\/revisions\/173018"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=121855"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=121855"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=121855"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}