{"id":125333,"date":"2025-05-21T15:05:14","date_gmt":"2025-05-21T13:05:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-biblioteke-openpgp-js-pozvolyayushhaya-obojti-verifikacziyu-soobshhenij"},"modified":"2025-05-21T15:05:14","modified_gmt":"2025-05-21T13:05:14","slug":"uyazvimost-v-biblioteke-openpgp-js-pozvolyayushhaya-obojti-verifikacziyu-soobshhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-biblioteke-openpgp-js-pozvolyayushhaya-obojti-verifikacziyu-soobshhenij","title":{"rendered":"Zranite\u013enos\u0165 v kni\u017enici OpenPGP.js, ktor\u00e1 umo\u017e\u0148uje ob\u00eds\u0165 overovanie spr\u00e1v.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V kni\u017enici OpenPGP.js bola zisten\u00e1 zranite\u013enos\u0165 (CVE-2025-47934), ktor\u00e1 umo\u017e\u0148uje \u00fato\u010dn\u00edkovi posla\u0165 upraven\u00fa spr\u00e1vu, ktor\u00e1 bude prijat\u00e1 ako overen\u00e1 (funkcie openpgp.verify a openpgp.decrypt vr\u00e1tia indik\u00e1tor \u00faspe\u0161n\u00e9ho overenia digit\u00e1lneho podpisu, aj ke\u010f obsah bol nahraden\u00fd a l\u00ed\u0161i sa od \u00fadajov, pre ktor\u00e9 bol podpis vytvoren\u00fd). Zranite\u013enos\u0165 bola odstr\u00e1nen\u00e1 vo vydaniach OpenPGP.js 5.11.3 a 6.1.1. Probl\u00e9m sa prejavuje iba vo vetv\u00e1ch OpenPGP.js 5.x a 6.x a net\u00fdka sa OpenPGP.js 4.x. <\/p>\n

Kni\u017enica OpenPGP.js poskytuje samostatn\u00fa implement\u00e1ciu protokolu OpenPGP v jazyku JavaScript, ktor\u00e1 umo\u017e\u0148uje vykon\u00e1va\u0165 v prehliada\u010di oper\u00e1cie \u0161ifrovania a pracova\u0165 s digit\u00e1lnymi podpismi zalo\u017een\u00fdmi na verejn\u00fdch k\u013e\u00fa\u010doch. Projekt sa vyv\u00edja v\u00fdvoj\u00e1rmi Proton Mail a okrem organizovania end-to-end \u0161ifrovania spr\u00e1v v Proton Mail sa pou\u017e\u00edva aj v tak\u00fdch projektoch, ako s\u00fa FlowCrypt, Mymail-Crypt, UDC, Encrypt.to, PGP Anywhere a Passbolt. <\/p>\n

Zranite\u013enos\u0165 zasahuje do proced\u00far overovania zabudovan\u00fdch do textu podpisu (openpgp.verify) a podp\u00edsan\u00fdch a za\u0161ifrovan\u00fdch spr\u00e1v (openpgp.decrypt). \u00dato\u010dn\u00edk m\u00f4\u017ee pou\u017ei\u0165 existuj\u00face podpisom chr\u00e1nen\u00e9 spr\u00e1vy na vytvorenie nov\u00fdch spr\u00e1v, pri de\u0161ifrovan\u00ed ktor\u00fdch zranite\u013en\u00e1 verzia OpenPGP.js vytiahne nahraden\u00fd obsah, ktor\u00fd sa l\u00ed\u0161i od obsahu p\u00f4vodnej podp\u00edsanej spr\u00e1vy. Zranite\u013enos\u0165 sa net\u00fdka podpisov, ktor\u00e9 s\u00fa rozdelen\u00e9 od textu (probl\u00e9m sa prejavuje iba pri prenose podpisu spolu s textom ako jedn\u00e9ho bloku \u00fadajov). <\/p>\n

Na vytvorenie podvrhnutej spr\u00e1vy \u00fato\u010dn\u00edkovi sta\u010d\u00ed ma\u0165 jedno s\u00fahlasen\u00e9 spr\u00e1vy so zabudovan\u00fdm alebo samostatn\u00fdm podpisom, ako aj znalosti o p\u00f4vodn\u00fdch \u00fadajoch, ktor\u00e9 boli v tejto spr\u00e1ve podp\u00edsan\u00e9. \u00dato\u010dn\u00edk m\u00f4\u017ee zmeni\u0165 spr\u00e1vu tak, \u017ee pre zmenen\u00fa verziu podpis zostane pova\u017eovan\u00fd za platn\u00fd. Rovnako m\u00f4\u017ee zmeni\u0165 za\u0161ifrovan\u00e9 spr\u00e1vy s podpisom, pri de\u0161ifrovan\u00ed ktor\u00fdch bud\u00fa vracan\u00e9 \u00fadaje pridan\u00e9 \u00fato\u010dn\u00edkom.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 OpenPGP.js \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-47934), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0431\u0443\u0434\u0435\u0442 \u0432\u043e\u0441\u043f\u0440\u0438\u043d\u044f\u0442\u043e \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u0435\u043b\u0435\u043c \u043a\u0430\u043a \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 (\u0444\u0443\u043d\u043a\u0446\u0438\u0438 openpgp.verify \u0438 openpgp.decrypt \u0432\u0435\u0440\u043d\u0443\u0442 \u043f\u0440\u0438\u0437\u043d\u0430\u043a \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438, \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0437\u0430\u043c\u0435\u043d\u0435\u043d\u043e \u0438 \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f \u043e\u0442 \u0434\u0430\u043d\u043d\u044b\u0445, \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u043b\u0430\u0441\u044c \u043f\u043e\u0434\u043f\u0438\u0441\u044c). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 OpenPGP.js 5.11.3 \u0438 6.1.1. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0432\u0435\u0442\u043a\u0430\u0445 OpenPGP.js […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-125333","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranite\u013enos\u0165 v kni\u017enici OpenPGP.js, ktor\u00e1 umo\u017e\u0148uje ob\u00eds\u0165 overenie spr\u00e1v | ProHoster","description":"V kni\u017enici OpenPGP.js bola zisten\u00e1 zranite\u013enos\u0165 (CVE-2025-47934), ktor\u00e1 umo\u017e\u0148uje \u00fato\u010dn\u00edkovi posla\u0165 upraven\u00fa spr\u00e1vu, ktor\u00e1 bude prijat\u00e1 ako overen\u00e1 (funkcie openpgp.verify a.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-biblioteke-openpgp-js-pozvolyayushhaya-obojti-verifikacziyu-soobshhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 OpenPGP.js, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 OpenPGP.js \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-47934), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0431\u0443\u0434\u0435\u0442 \u0432\u043e\u0441\u043f\u0440\u0438\u043d\u044f\u0442\u043e \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u0435\u043b\u0435\u043c \u043a\u0430\u043a \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 (\u0444\u0443\u043d\u043a\u0446\u0438\u0438 openpgp.verify \u0438.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-biblioteke-openpgp-js-pozvolyayushhaya-obojti-verifikacziyu-soobshhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-05-21T13:05:14+00:00","article:modified_time":"2025-05-21T13:05:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"125333","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 12:55:23","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 12:55:23","updated":"2026-01-23 12:55:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/125333","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=125333"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/125333\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=125333"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=125333"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=125333"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}