{"id":103424,"date":"2022-02-24T15:36:49","date_gmt":"2022-02-24T13:36:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-openssh-8-9-s-ustraneniem-uyazvimosti-v-sshd"},"modified":"2022-02-24T15:36:49","modified_gmt":"2022-02-24T13:36:49","slug":"reliz-openssh-8-9-s-ustraneniem-uyazvimosti-v-sshd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/reliz-openssh-8-9-s-ustraneniem-uyazvimosti-v-sshd","title":{"rendered":"Lansarea OpenSSH 8.9 cu remedierea unei vulnerabilit\u0103\u021bi \u00een sshd","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Dup\u0103 \u0219ase luni de dezvoltare, a fost lansat\u0103 versiunea OpenSSH 8.9, o implementare deschis\u0103 a clientului \u0219i serverului pentru a lucra prin protocoalele SSH 2.0 \u0219i SFTP. \u00cen noua versiune, \u00een sshd a fost eliminat\u0103 o vulnerabilitate care ar putea permite accesul f\u0103r\u0103 autentificare. Problema este cauzat\u0103 de o suprascriere a \u00eentregilor numere \u00een codul de autentificare, dar exploatarea este posibil\u0103 doar \u00een combina\u021bie cu alte erori logice \u00een cod.    <\/p>\n<p> \u00cen forma actual\u0103, vulnerabilitatea nu este exploatabil\u0103 atunci c\u00e2nd este activat modul de separare a privilegiilor, deoarece manifestarea ei este blocat\u0103 de verific\u0103rile distincte efectuate \u00een codul de urm\u0103rire a separ\u0103rii privilegiilor. Modul de separare a privilegiilor a fost activat implicit \u00een 2002, \u00eencep\u00e2nd cu OpenSSH 3.2.2, \u0219i este obligatoriu \u00eencep\u00e2nd cu versiunea OpenSSH 7.5, publicat\u0103 \u00een 2017. \u00cen plus, \u00een versiuni portabile de OpenSSH \u00eencep\u00e2nd cu versiunea 6.5 (2014), vulnerabilitatea este blocat\u0103 prin compilarea cu activarea flag-urilor de protec\u021bie \u00eempotriva suprascrierilor \u00eentregilor numere.       <\/p>\n<p>Paleta de culori a fost modificat\u0103, oferind o separare mai contrastant\u0103 \u00eentre text \u0219i fundal.  <\/p>\n<ul>\n<li class=\"l\"> \u00cen versiunea portabil\u0103 de OpenSSH, sshd a eliminat suportul \u00eencorporat pentru hashing-ul parolelor folosind algoritmul MD5 (pentru returnare este permis\u0103 legarea cu biblioteci externe, cum ar fi libxcrypt).\n<li class=\"l\"> \u00cen ssh, sshd, ssh-add \u0219i ssh-agent a fost implementat un subsistem pentru restric\u021bionarea transferului \u0219i utiliz\u0103rii cheilor ad\u0103ugate \u00een ssh-agent. Subsistemul permite stabilirea unor reguli care definesc cum \u0219i unde pot fi utilizate cheile \u00een ssh-agent. De exemplu, pentru a ad\u0103uga o cheie care poate fi utilizat\u0103 doar pentru autentificarea oric\u0103rui utilizator pe gazda scylla.example.org, utilizatorului perseus pe gazda cetus.example.org \u0219i utilizatorului medea pe gazda charybdis.example.org cu redirec\u021bionare prin gazda intermediar\u0103 scylla.example.org, se poate folosi urm\u0103toarea comand\u0103: $ ssh-add -h \"perseus@cetus.example.org\" \\ -h \"scylla.example.org\" \\ -h \"scylla.example.org&gt;medea@charybdis.example.org\" \\ ~\/.ssh\/id_ed25519\n<li class=\"l\"> \u00cen ssh \u0219i sshd, \u00een lista KexAlgorithms, care define\u0219te ordinea de selec\u021bie a metodelor de schimb al cheilor, a fost ad\u0103ugat, \u00een mod implicit, algoritmul hibrid \"sntrup761x25519-sha512@openssh.com\" (ECDH\/x25519 + NTRU Prime), rezistent la atacurile de tip brute-force pe computere cuantice. \u00cen versiunea OpenSSH 8.9, aceast\u0103 metod\u0103 de negociere a fost ad\u0103ugat\u0103 \u00eentre metodele ECDH \u0219i DH, dar \u00een urm\u0103toarea versiune se preconizeaz\u0103 c\u0103 va fi utilizat\u0103 \u00een mod implicit.\n<li class=\"l\"> \u00cen ssh-keygen, ssh \u0219i ssh-agent a fost \u00eembun\u0103t\u0103\u021bit\u0103 gestionarea cheilor FIDO, utilizate pentru verificarea dispozitivului, inclusiv chei pentru autentificarea biometric\u0103.\n<li class=\"l\"> \u00cen ssh-keygen a fost ad\u0103ugat\u0103 comanda \"ssh-keygen -Y match-principals\" pentru a verifica numele utilizatorilor \u00een fi\u0219ierul cu lista numelui permis.\n<li class=\"l\"> \u00cen ssh-add \u0219i ssh-agent a fost ad\u0103ugat\u0103 posibilitatea de a ad\u0103uga chei FIDO protejate cu PIN \u00een ssh-agent (solicitarea PIN-ului este afi\u015fat\u0103 \u00een momentul autentific\u0103rii).\n<li class=\"l\"> \u00cen ssh-keygen a fost permis\u0103 selectarea algoritmului de hash (sha512 sau sha256) \u00een timpul gener\u0103rii semn\u0103turii.\n<li class=\"l\"> \u00cen ssh \u0219i sshd, pentru a \u00eembun\u0103t\u0103\u021bi performan\u021ba, s-a asigurat citirea datelor de re\u021bea direct \u00een bufferul pachetelor de intrare, ocolind buffering-ul intermediar din stiv\u0103. \u00cen mod similar, a fost implementat\u0103 plasarea direct\u0103 a datelor primite \u00een bufferul canalului.\n<li class=\"l\"> \u00cen ssh, \u00een direc\u021bia PubkeyAuthentication a fost extins\u0103 lista de parametri accepta\u021bi (yes|no|unbound|host-bound) pentru a oferi posibilitatea de a alege op\u021biunea de extensie a protocolului utilizat\u0103.      <\/ul>\n<p>\u00cen una dintre urm\u0103toarele versiuni, se preconizeaz\u0103 ca utilitarul scp s\u0103 fie mutat \u00een mod implicit la utilizarea SFTP \u00een locul protocolului SCP\/RCP \u00eenvechit. SFTP folose\u0219te metode mai previzibile de gestionare a numelui \u0219i nu are o procesare glob a \u0219abloanelor de nume de fi\u0219iere prin shell pe partea celeilalte gazde, care creeaz\u0103 probleme de securitate. \u00cen special, \u00een cazul SCP \u0219i RCP, serverul decide ce fi\u0219iere \u0219i directoare s\u0103 trimit\u0103 clientului, iar clientul doar verific\u0103 corectitudinea numelui obiectelor returnate, ceea ce \u00een cazul lipsei unor verific\u0103ri adecvate pe partea clientului permite <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/ro\/server\/dts-shicago\/\"   title=\"server\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2906\">server<\/a> a transmite alte nume de fi\u0219iere, diferite de cele solicitate. Protocolul SFTP nu prezint\u0103 problemele men\u021bionate, dar nu suport\u0103 expunerea c\u0103ilor speciale, cum ar fi \"~\/\". Pentru a remedia aceast\u0103 discrepan\u021b\u0103, \u00een ultima versiune OpenSSH a fost propus\u0103 o nou\u0103 extensie a protocolului SFTP pentru expunerea c\u0103ilor ~\/ \u0219i ~user\/.<br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=56751\">opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 \u0448\u0435\u0441\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.9, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP. \u0412 \u043d\u043e\u0432\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u0432 sshd \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u043c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0432 \u043a\u043e\u0434\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u0430 \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u0438 \u0441 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u043c\u0438 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u0432 \u043a\u043e\u0434\u0435. \u0412 \u0442\u0435\u043a\u0443\u0449\u0435\u043c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103424","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0448\u0435\u0441\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.9, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/reliz-openssh-8-9-s-ustraneniem-uyazvimosti-v-sshd\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.9 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 sshd | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0448\u0435\u0441\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.9, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/reliz-openssh-8-9-s-ustraneniem-uyazvimosti-v-sshd\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2022-02-24T13:36:49+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-02-24T13:36:49+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Lansarea OpenSSH 8.9 cu corectarea vulnerabilit\u0103\u021bii \u00een sshd | ProHoster","description":"Dup\u0103 \u0219ase luni de dezvoltare, a fost lansat\u0103 versiunea OpenSSH 8.9, o implementare deschis\u0103 a clientului \u0219i serverului pentru lucrul prin protocoalele SSH 2.0 \u0219i SFTP.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/reliz-openssh-8-9-s-ustraneniem-uyazvimosti-v-sshd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.9 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 sshd | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 \u0448\u0435\u0441\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.9, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/reliz-openssh-8-9-s-ustraneniem-uyazvimosti-v-sshd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-02-24T13:36:49+00:00","article:modified_time":"2022-02-24T13:36:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103424","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-02-24 13:37:31","updated":"2026-02-09 21:42:01","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/103424","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=103424"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/103424\/revisions"}],"predecessor-version":[{"id":160186,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/103424\/revisions\/160186"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=103424"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=103424"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=103424"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}