{"id":107307,"date":"2023-03-16T12:48:10","date_gmt":"2023-03-16T10:48:10","guid":{"rendered":"https:\/\/prohoster.info\/?p=107307"},"modified":"2023-03-17T13:35:25","modified_gmt":"2023-03-17T11:35:25","slug":"obnovlenie-openssh-9-3-s-ustraneniem-problem-s-bezopasnostyu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/obnovlenie-openssh-9-3-s-ustraneniem-problem-s-bezopasnostyu","title":{"rendered":"Aktualiz\u00e1cia OpenSSH 9.3 s odstr\u00e1nen\u00edm probl\u00e9mov so zabezpe\u010den\u00edm","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Bol vydan\u00fd OpenSSH 9.3, otvoren\u00e1 implement\u00e1cia klienta a servera pre pr\u00e1cu s protokolmi SSH 2.0 a SFTP. V novej verzii boli odstr\u00e1nen\u00e9 bezpe\u010dnostn\u00e9 probl\u00e9my:    <\/p>\n<ul>\n<li class=\"l\"> V utilite ssh-add bola zisten\u00e1 logick\u00e1 chyba, kv\u00f4li ktorej pri prid\u00e1van\u00ed k\u013e\u00fa\u010dov pre smart karty do ssh-agentu neboli agentovi odovzdan\u00e9 obmedzenia stanoven\u00e9 pomocou mo\u017enosti &#171;ssh-add -h&#187;. V\u00fdsledkom bolo, \u017ee do agenta bol pridan\u00fd k\u013e\u00fa\u010d, pre ktor\u00fd neboli uplatnen\u00e9 obmedzenia, povolen\u00e9 iba pre ur\u010dit\u00e9 hostite\u013esk\u00e9 po\u010d\u00edta\u010de.\n<li class=\"l\"> V utilite ssh bola zisten\u00e1 zranite\u013enos\u0165, ktor\u00e1 m\u00f4\u017ee vies\u0165 k \u010d\u00edtaniu \u00fadajov z oblasti z\u00e1sobn\u00edka mimo alokovan\u00e9ho vyrovn\u00e1vacieho priestoru pri spracovan\u00ed \u0161peci\u00e1lne form\u00e1tovan\u00fdch odpoved\u00ed DNS, ak je v konfigura\u010dnom s\u00fabore aktivovan\u00e1 mo\u017enos\u0165 VerifyHostKeyDNS. Probl\u00e9m sa vyskytuje vo vstavanom spracovan\u00ed funkcie getrrsetbyname(), ktor\u00e1 sa pou\u017e\u00edva v prenosn\u00fdch verzi\u00e1ch OpenSSH zostavovan\u00fdch bez extern\u00fdch kni\u017en\u00edc ldns (&#8212;with-ldns) a na syst\u00e9mach so \u0161tandardn\u00fdmi kni\u017enicami, ktor\u00e9 nepodporuj\u00fa volanie getrrsetbyname(). Mo\u017enos\u0165 zneu\u017eitia zranite\u013enosti, okrem iniciovania odmietnutia slu\u017eby klienta ssh, je pova\u017eovan\u00e1 za m\u00e1lo pravdepodobn\u00fa.  <\/ul>\n<p>\u010ealej mo\u017eno spomen\u00fa\u0165 zranite\u013enos\u0165 vo verejnej kni\u017enici libskey, ktor\u00e1 je s\u00fa\u010das\u0165ou OpenBSD a pou\u017e\u00edva sa v OpenSSH. Probl\u00e9m existuje od roku 1997 a m\u00f4\u017ee vies\u0165 k prete\u010deniu z\u00e1sobn\u00edka pri spracovan\u00ed \u0161peci\u00e1lne form\u00e1tovan\u00fdch n\u00e1zvov hostite\u013eov. Upozor\u0148uje sa, \u017ee hoci sa zranite\u013enos\u0165 m\u00f4\u017ee prejavi\u0165 na dia\u013eku cez OpenSSH, v praxi je to nepou\u017eite\u013en\u00e9, preto\u017ee na jej prejav mus\u00ed n\u00e1zov napadnut\u00e9ho hosta (&#047;etc&#047;hostname) obsahova\u0165 viac ako 126 znakov a z\u00e1sobn\u00edk m\u00f4\u017ee by\u0165 preplnen\u00fd iba nulov\u00fdmi znakmi (&#8216;&#092;0&#8217;).        <\/p>\n<p>Medzi nez\u00e1visl\u00fdmi zmenami nes\u00favisiacimi so zabezpe\u010den\u00edm:  <\/p>\n<ul>\n<li class=\"l\"> V ssh-keygen a ssh-keyscan bola pridan\u00e1 podpora parametra &#171;-Ohashalg=sha1|sha256&#187; na v\u00fdber algoritmu zobrazenia otiskov SSHFP.\n<li class=\"l\"> V sshd bola pridan\u00e1 mo\u017enos\u0165 &#171;-G&#187; na anal\u00fdzu a zobrazenie akt\u00edvnej konfigur\u00e1cie bez pokusu o na\u010d\u00edtanie s\u00fakromn\u00fdch k\u013e\u00fa\u010dov a bez vykon\u00e1vania dodato\u010dn\u00fdch kontrol, \u010do umo\u017e\u0148uje overi\u0165 konfigur\u00e1ciu pred generovan\u00edm k\u013e\u00fa\u010dov a spusti\u0165 kontrolu neprivilegovan\u00fdmi pou\u017e\u00edvate\u013emi.\n<li class=\"l\"> V sshd bola posilnen\u00e1 izol\u00e1cia na platforme Linux, ktor\u00e1 vyu\u017e\u00edva mechanizmy filtrovania syst\u00e9mov\u00fdch volan\u00ed seccomp a seccomp-bpf. Do zoznamu povolen\u00fdch syst\u00e9mov\u00fdch volan\u00ed boli pridan\u00e9 flagy pre mmap, madvise a futex.    <\/ul>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=58801\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 9.3, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP. \u0412 \u043d\u043e\u0432\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e: \u0412 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 ssh-add \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043e\u0448\u0438\u0431\u043a\u0430, \u0438\u0437-\u0437\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0438 \u0432 ssh-agent \u043a\u043b\u044e\u0447\u0435\u0439 \u0434\u043b\u044f \u0441\u043c\u0430\u0440\u0442\u043a\u0430\u0440\u0442 \u0430\u0433\u0435\u043d\u0442\u0443 \u043d\u0435 \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u043b\u0438\u0441\u044c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f, \u0437\u0430\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0435 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043e\u043f\u0446\u0438\u0438 &#171;ssh-add -h&#187;. \u0412 \u0438\u0442\u043e\u0433\u0435 \u0432 \u0430\u0433\u0435\u043d\u0442 \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u043b\u0441\u044f \u043a\u043b\u044e\u0447, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-107307","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 9.3, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/news\/obnovlenie-openssh-9-3-s-ustraneniem-problem-s-bezopasnostyu\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 OpenSSH 9.3 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 9.3, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/news\/obnovlenie-openssh-9-3-s-ustraneniem-problem-s-bezopasnostyu\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-03-16T10:48:10+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-03-17T11:35:25+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Aktualiz\u00e1cia OpenSSH 9.3 s odstr\u00e1nen\u00edm bezpe\u010dnostn\u00fdch probl\u00e9mov | ProHoster","description":"Bol misia OpenSSH 9.3, otvorenej implement\u00e1cie klienta a servera pre pr\u00e1cu s protokolmi SSH 2.0 a SFTP.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/obnovlenie-openssh-9-3-s-ustraneniem-problem-s-bezopasnostyu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 OpenSSH 9.3 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 9.3, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/obnovlenie-openssh-9-3-s-ustraneniem-problem-s-bezopasnostyu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-03-16T10:48:10+00:00","article:modified_time":"2023-03-17T11:35:25+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/107307","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=107307"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/107307\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=107307"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=107307"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=107307"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}