{"id":125333,"date":"2025-05-21T15:05:14","date_gmt":"2025-05-21T13:05:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-biblioteke-openpgp-js-pozvolyayushhaya-obojti-verifikacziyu-soobshhenij"},"modified":"2025-05-21T15:05:14","modified_gmt":"2025-05-21T13:05:14","slug":"uyazvimost-v-biblioteke-openpgp-js-pozvolyayushhaya-obojti-verifikacziyu-soobshhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-biblioteke-openpgp-js-pozvolyayushhaya-obojti-verifikacziyu-soobshhenij","title":{"rendered":"Vulnerability in the OpenPGP.js library allows bypassing message verification","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

W bibliotece OpenPGP.js zidentyfikowano luk\u0119 (CVE-2025-47934), kt\u00f3ra pozwala atakuj\u0105cemu wys\u0142a\u0107 zmodyfikowan\u0105 wiadomo\u015b\u0107, kt\u00f3ra zostanie odebrana przez odbiorc\u0119 jako zweryfikowana (funkcje openpgp.verify i openpgp.decrypt zwr\u00f3c\u0105 oznaczenie pomy\u015blnej weryfikacji podpisu cyfrowego, mimo \u017ce tre\u015b\u0107 zosta\u0142a zmieniona i r\u00f3\u017cni si\u0119 od danych, dla kt\u00f3rych stworzono podpis). Luka zosta\u0142a naprawiona w wersjach OpenPGP.js 5.11.3 i 6.1.1. Problem wyst\u0119puje jedynie w ga\u0142\u0119ziach OpenPGP.js 5.x i 6.x i nie dotyczy OpenPGP.js 4.x. <\/p>\n

Biblioteka OpenPGP.js oferuje samodzieln\u0105 implementacj\u0119 protoko\u0142u OpenPGP w j\u0119zyku JavaScript, umo\u017cliwiaj\u0105c\u0105 wykonywanie operacji szyfrowania w przegl\u0105darce i prac\u0119 z podpisami cyfrowymi opartymi na kluczach publicznych. Projekt jest rozwijany przez programist\u00f3w Proton Mail i opr\u00f3cz organizacji end-to-end szyfrowania wiadomo\u015bci w Proton Mail wykorzystywany jest w takich projektach jak FlowCrypt, Mymail-Crypt, UDC, Encrypt.to, PGP Anywhere i Passbolt. <\/p>\n

Luka dotyczy procedur weryfikacji wpisanej w tre\u015b\u0107 podpisu (openpgp.verify) oraz podpisanych i zaszyfrowanych wiadomo\u015bci (openpgp.decrypt). Atakuj\u0105cy mo\u017ce wykorzysta\u0107 istniej\u0105ce podpisane wiadomo\u015bci do generowania nowych wiadomo\u015bci, przy rozpakowywaniu kt\u00f3rych podatna wersja OpenPGP.js wyodr\u0119bni wstawion\u0105 tre\u015b\u0107, r\u00f3\u017cni\u0105c\u0105 si\u0119 od tre\u015bci oryginalnej podpisanej wiadomo\u015bci. Luka nie dotyczy podpis\u00f3w przesy\u0142anych oddzielnie od tekstu (problem wyst\u0119puje tylko podczas przesy\u0142ania podpisu razem z tekstem jako jednego bloku danych). <\/p>\n

Aby utworzy\u0107 podstawow\u0105 wiadomo\u015b\u0107, atakuj\u0105cy potrzebuje jedynie jednego komunikatu z wpisanym lub oddzielnym podpisem, a tak\u017ce wiedzy o danych \u017ar\u00f3d\u0142owych podpisanych w tej wiadomo\u015bci. Atakuj\u0105cy mo\u017ce zmieni\u0107 wiadomo\u015b\u0107 w taki spos\u00f3b, aby dla zmodyfikowanej wersji podpis nadal by\u0142 uwa\u017cany za poprawny. Podobnie mo\u017cna zmieni\u0107 zaszyfrowane wiadomo\u015bci z podpisem, przy rozpakowywaniu kt\u00f3rych b\u0119d\u0105 zwracane dodatkowe dane dodane przez atakuj\u0105cego.
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 OpenPGP.js \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-47934), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0431\u0443\u0434\u0435\u0442 \u0432\u043e\u0441\u043f\u0440\u0438\u043d\u044f\u0442\u043e \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u0435\u043b\u0435\u043c \u043a\u0430\u043a \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 (\u0444\u0443\u043d\u043a\u0446\u0438\u0438 openpgp.verify \u0438 openpgp.decrypt \u0432\u0435\u0440\u043d\u0443\u0442 \u043f\u0440\u0438\u0437\u043d\u0430\u043a \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438, \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0437\u0430\u043c\u0435\u043d\u0435\u043d\u043e \u0438 \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f \u043e\u0442 \u0434\u0430\u043d\u043d\u044b\u0445, \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u043b\u0430\u0441\u044c \u043f\u043e\u0434\u043f\u0438\u0441\u044c). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 OpenPGP.js 5.11.3 \u0438 6.1.1. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0432\u0435\u0442\u043a\u0430\u0445 OpenPGP.js […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-125333","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Luka w bibliotece OpenPGP.js, kt\u00f3ra pozwala obej\u015b\u0107 weryfikacj\u0119 wiadomo\u015bci | ProHoster","description":"W bibliotece OpenPGP.js zidentyfikowano luk\u0119 (CVE-2025-47934), kt\u00f3ra pozwala atakuj\u0105cemu wys\u0142a\u0107 zmodyfikowan\u0105 wiadomo\u015b\u0107, kt\u00f3ra zostanie odebrana przez odbiorc\u0119 jako zweryfikowana (funkcje openpgp.verify i.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-biblioteke-openpgp-js-pozvolyayushhaya-obojti-verifikacziyu-soobshhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 OpenPGP.js, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 OpenPGP.js \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-47934), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0431\u0443\u0434\u0435\u0442 \u0432\u043e\u0441\u043f\u0440\u0438\u043d\u044f\u0442\u043e \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u0435\u043b\u0435\u043c \u043a\u0430\u043a \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 (\u0444\u0443\u043d\u043a\u0446\u0438\u0438 openpgp.verify \u0438.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-biblioteke-openpgp-js-pozvolyayushhaya-obojti-verifikacziyu-soobshhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-05-21T13:05:14+00:00","article:modified_time":"2025-05-21T13:05:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"125333","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 12:55:23","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 12:55:23","updated":"2026-01-23 12:55:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/125333","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=125333"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/125333\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=125333"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=125333"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=125333"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}