MuLibKSBA raibhurari, yakagadziridzwa neGnuPG purojekiti uye inopa mabasa ekushanda nezvitupa zveX.509, kusazvibata kwakadzama kwaonekwa (CVE-2022-3515), zvichiita kuti pave nekufashukira uye kunyora dhata risingawirirane kupfuura iyo yakagoverwa ASN.1 maumbirwo anoshandiswa muS/MIME, X.509 neCMS. Dambudziko rinowedzerwa nenyaya yekuti raibhurari yeLibksba inoshandiswa muGnuPG package uye kusazvibata kunogona kutungamira kune kure kure kodhi neanorwisa kana GnuPG (gpgsm) ichiita yakavharidzirwa kana kusainwa data kubva kumafaira kana email meseji uchishandisa S/MIME. Muchiitiko chakareruka, kurwisa munhu akabatwa uchishandisa email mutengi anotsigira GnuPG uye S/MIME, zvakakwana kutumira tsamba yakanyatsogadzirwa.
Kusagadzikana kunogona kushandiswawo kurwisa dirmngr maseva anodhawunirodha uye kuparura zvitupa zvekubvisa zvitupa (CRLs) uye kuona zvitupa zvinoshandiswa muTLS. Kurwiswa kwe dirmngr kunogona kuitwa kubva pawebhu server inodzorwa neanorwisa, kuburikidza nekudzoka kweakanyatso gadzirwa CRLs kana zvitupa. Zvinocherechedzwa kuti zvinowanikwa pachena zvegpgsm uye dirmngr hazvisati zvaonekwa, asi kusazvibata kwacho kwakajairika uye hapana chinodzivirira vanorwisa vanokwanisa kubva kugadzirira kubiridzira vega.
Kusagadzikana kwakagadziriswa mukuburitswa kweLibksba 1.6.2 uye muGnuPG 2.3.8 mabhinari anovaka. PaLinux kugoverwa, raibhurari yeLibksba inowanzo kupihwa seyakasarudzika, uye paWindows inovaka inovakwa mukati meiyo huru yekuisa package neGnuPG. Mushure mekugadzirisa, yeuka kutangazve maitiro emashure ne "gpgconf -kill all" murairo. Kuti uone kuvapo kwedambudziko mukubuda kwe "gpgconf -show-versions" murairo, unogona kuongorora mutsara "KSBA ....", iyo inofanira kuratidza shanduro yeinenge 1.6.2.
Zvigadziriso zvekugovera hazvisati zvaburitswa, asi unogona kuteedzera kuwanikwa kwavo pamapeji: Debian, Ubuntu, Gentoo, RHEL, SUSE, Arch, FreeBSD. Kusagadzikana kunowanikwawo muMSI uye AppImage mapakeji ane GnuPG VS-Desktop uye muGpg4win.
Source: opennet.ru