Dezvoltatorii Fedora Linux au clarificat situa\u021bia legat\u0103 de expirarea, la sf\u00e2r\u0219itul lunii iunie, a certificatului Microsoft utilizat pentru semnarea digital\u0103 a stratului Shim, folosit pentru \u00eenc\u0103rcarea verificat\u0103 a distribu\u021biilor Linux \u00een modul UEFI Secure Boot. Trecerea la un nou certificat ar trebui s\u0103 fie imperceptibil\u0103 pentru utilizatori, deoarece efectiv \u00eencheierea vie\u021bii certificatului va duce doar la imposibilitatea utiliz\u0103rii sale pentru a crea noi semn\u0103turi. La \u00eenc\u0103rcarea UEFI Secure Boot, valabilitatea certificatului nu este verificat\u0103 \u0219i conteaz\u0103 doar retragerea certificatelor compromise. <\/p>\n
Sistemele existente f\u0103r\u0103 instalarea actualiz\u0103rii shim vor continua s\u0103 porneasc\u0103 p\u00e2n\u0103 c\u00e2nd cheia public\u0103 a certificatului va fi \u0219tears\u0103 din firmware sau va fi inclus\u0103 \u00een lista certificatelor UEFI retrase (DBX). Certificatul Microsoft semneaz\u0103 doar stratul de \u00eenc\u0103rcare shim, care con\u021bine cheia public\u0103 a distribu\u021biei, folosit\u0103 pentru a semna componentele \u00eenc\u0103rcate, cum ar fi \u00eenc\u0103rc\u0103torul GRUB2, nucleul Linux, modulele nucleului \u0219i procesele folosite la \u00eenc\u0103rcare, cum ar fi fwupd. Aceast\u0103 abordare permite Microsoft s\u0103 semneze doar modific\u0103rile din stratul shim \u0219i s\u0103 asigure verificarea procesului de \u00eenc\u0103rcare a distribu\u021biei.<\/p>\n
Certificatul Microsoft pentru semnarea firmware-urilor ter\u021be pentru UEFI Secure Boot este \u00een vigoare din 2011. \u00cen 2023, un nou certificat a fost generat, care va fi utilizat pentru semnarea certificatelor \u00eencep\u00e2nd cu octombrie 2025. \u00cen depozitul Fedora Rawhide, pe baza c\u0103ruia se formeaz\u0103 distribu\u021bia Fedora 45, a fost deja ad\u0103ugat shim-ul actualizat, semnat cu mai multe chei pentru a asigura compatibilitate maxim\u0103 cu hardware-ul (poate fi utilizat at\u00e2t pe firmware-uri vechi f\u0103r\u0103 cheia public\u0103 a noului certificat, c\u00e2t \u0219i pe firmware-uri f\u0103r\u0103 cheia public\u0103 a vechiului certificat).<\/p>\n
De\u0219i expirarea certificatului Microsoft nu ar trebui s\u0103 afecteze func\u021bionarea \u00eenc\u0103rc\u0103rii, dezvoltatorii Fedora recomand\u0103 utilizatorilor s\u0103-\u0219i actualizeze baza de date cu cheile pentru Secure Boot la apari\u021bia unor versiuni noi de firmware pentru echipamentele lor. Pentru a determina dac\u0103 sistemul a fost \u00eenc\u0103rcat \u00een modul UEFI Secure Boot, se poate folosi comanda Urm\u0103toarea versiune a stratului shim va fi certificat doar cu un nou certificat Microsoft, iar actualizarea firmware-ului este necesar\u0103 pentru a preg\u0103ti sistemele pentru aceast\u0103 schimbare. Actualizarea shim va fi lansat\u0103 \u00een cazul \u00een care vor fi identificate vulnerabilit\u0103\u021bi \u0219i erori grave, ceea ce ar putea avea loc at\u00e2t \u00een urm\u0103 cu o lun\u0103, c\u00e2t \u0219i \u00een urm\u0103 cu un an. De-a lungul existen\u021bei sale, \u00een proiectul shim au fost g\u0103site vulnerabilit\u0103\u021bi critice, iar cel mai recent raport privind problemele de securitate \u00een shim a fost publicat cu doar c\u00e2teva zile \u00een urm\u0103. <\/p>\n Raportul eviden\u021biaz\u0103 dou\u0103 vulnerabilit\u0103\u021bi recent descoperite, CVE-2026-8863 \u0219i \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Fedora Linux \u043f\u0440\u043e\u044f\u0441\u043d\u0438\u043b\u0438 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u044e, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0443\u044e \u0441 \u0438\u0441\u0442\u0435\u0447\u0435\u043d\u0438\u0435\u043c \u0432 \u043a\u043e\u043d\u0446\u0435 \u0438\u044e\u043d\u044f \u0441\u0440\u043e\u043a\u0430 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 Microsoft, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u0437\u0430\u0432\u0435\u0440\u0435\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u044c\u044e \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0438 Shim, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 Linux \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 UEFI Secure Boot. \u041f\u0435\u0440\u0435\u0445\u043e\u0434 \u043d\u0430 \u043d\u043e\u0432\u044b\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043e\u043b\u0436\u0435\u043d \u043f\u0440\u043e\u0439\u0442\u0438 \u043d\u0435\u0437\u0430\u043c\u0435\u0442\u043d\u043e \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0442\u0430\u043a \u043a\u0430\u043a \u0444\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0435 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u0436\u0438\u0437\u043d\u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u043f\u0440\u0438\u0432\u0435\u0434\u0451\u0442 \u043b\u0438\u0448\u044c \u043a \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182058","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Se \u00eencheie perioada de valabilitate a certificatului care semneaz\u0103 bootloader-ul pentru UEFI Secure Boot \u00een distribu\u021biile Linux | ProHoster","description":"Dezvoltatorii Fedora Linux au clarificat situa\u021bia legat\u0103 de expirarea la sf\u00e2r\u0219itul lunii iunie a certificatului Microsoft, utilizat pentru semnarea digital\u0103 a stratului Shim, folosit pentru verificare.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/istekaet-vremya-zhizni-sertifikata-kotorym-zaveren-zagruzchik-dlya-uefi-secure-boot-v-distributivah-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u0441\u0442\u0435\u043a\u0430\u0435\u0442 \u0432\u0440\u0435\u043c\u044f \u0436\u0438\u0437\u043d\u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0437\u0430\u0432\u0435\u0440\u0435\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u0434\u043b\u044f UEFI Secure Boot \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Fedora Linux \u043f\u0440\u043e\u044f\u0441\u043d\u0438\u043b\u0438 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u044e, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0443\u044e \u0441 \u0438\u0441\u0442\u0435\u0447\u0435\u043d\u0438\u0435\u043c \u0432 \u043a\u043e\u043d\u0446\u0435 \u0438\u044e\u043d\u044f \u0441\u0440\u043e\u043a\u0430 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 Microsoft, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u0437\u0430\u0432\u0435\u0440\u0435\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u044c\u044e \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0438 Shim, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/istekaet-vremya-zhizni-sertifikata-kotorym-zaveren-zagruzchik-dlya-uefi-secure-boot-v-distributivah-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-06-14T12:48:27+00:00","article:modified_time":"2026-06-14T12:48:27+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"182058","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-08-05 12:22:23","updated":"2026-08-05 12:22:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/182058","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=182058"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/182058\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=182058"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=182058"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=182058"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}mokutil \u2014sb-state<\/code>, iar pentru a afi\u0219a lista cheilor publice disponibile \u00een firmware, se folose\u0219te mokutil \u2014db \u2014short<\/code>. Pentru a vizualiza cheile cu care este semnat shim, se poate rula comanda sudo pesign -S -i \/boot\/efi\/EFI\/fedora\/shimx64.efi<\/code>, dup\u0103 ce pachetul pesign a fost instalat. Pentru a verifica dac\u0103 exist\u0103 actualiz\u0103ri de firmware \u0219i pentru a le instala, se poate executa comanda sudo fwupdmgr update<\/code>. <\/p>\n
\nCVE-2026-10797, care permit executarea unui cod nesemnat \u00een etape timpurii de boot, \u00eenainte de a ceda controlul sistemului de operare, ocolind protec\u021bia UEFI Secure Boot \u0219i permi\u021b\u00e2nd bootarea componentelor nucleului f\u0103r\u0103 semn\u0103tur\u0103 digital\u0103. Problemele afecteaz\u0103 versiunile shim p\u00e2n\u0103 la 0.9 inclusiv, create \u00eenainte de 2016. Sistemele foarte vechi, cum ar fi
\n RedHat Enterprise Linux 7.2, CentOS 7.2, Oracle Linux 7.2, ROSA Linux R10\/R9 \u0219i openSUSE cu shim 0.9. Straturile shim p\u00e2n\u0103 la versiunea 0.9 inclusiv au fost ad\u0103ugate \u00een baza de date a semn\u0103turilor digitale revocate DBX (UEFI Forbidden Signature Database) \u0219i, \u00een cazul unei actualiz\u0103ri a DBX, acestea nu vor putea fi utilizate pentru bootarea \u00een modul UEFI Secure Boot.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"