{"id":102627,"date":"2021-12-15T21:36:51","date_gmt":"2021-12-15T19:36:51","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-openssl-3-0-1-s-ustraneniem-uyazvimosti"},"modified":"2021-12-15T21:36:51","modified_gmt":"2021-12-15T19:36:51","slug":"obnovlenie-openssl-3-0-1-s-ustraneniem-uyazvimosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/obnovlenie-openssl-3-0-1-s-ustraneniem-uyazvimosti","title":{"rendered":"P\u00ebrdit\u00ebsimi i OpenSSL 3.0.1 me eliminimin e vulnerabilitetit","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Shtojca dhe p\u00ebrmir\u00ebsime p\u00ebr bibliotek\u00ebn kriptografike OpenSSL 3.0.1 dhe 1.1.1m jan\u00eb t\u00eb disponueshme. N\u00eb versionin 3.0.1 \u00ebsht\u00eb eliminuar nj\u00eb vulnerabilitet (CVE-2021-4044) dhe n\u00eb t\u00eb dy versionet jan\u00eb korrigjuar rreth nj\u00eb duzin\u00eb gabimesh. <\/p>\n
Vulnerabiliteti \u00ebsht\u00eb i pranish\u00ebm n\u00eb implementimin e klient\u00ebve SSL\/TLS dhe lidhet me at\u00eb q\u00eb biblioteca libssl nuk trajton si\u00e7 duhet vlerat negative t\u00eb kodit t\u00eb gabimeve q\u00eb kthehen nga funksioni X509_verify_cert(), i thirrur p\u00ebr t\u00eb verifikuar certifikat\u00ebn e d\u00ebrguar nga serveri tek klienti. K\u00ebto kode negative kthehen kur ndodhin gabime t\u00eb brendshme, si p.sh., kur nuk mund t\u00eb alokohet memoria p\u00ebr nj\u00eb tampon. N\u00eb rastin e kthimit t\u00eb nj\u00eb gabimi t\u00eb till\u00eb, thirrja e m\u00ebvonshme e funksioneve t\u00eb hyrjes\/daljes, si SSL_connect() dhe SSL_do_handshake(), do t\u00eb \u00e7oj\u00eb n\u00eb kthimin e nj\u00eb p\u00ebrfundimi t\u00eb pasuksessh\u00ebm dhe kodit t\u00eb gabimit SSL_ERROR_WANT_RETRY_VERIFY, i cili duhet t\u00eb kthehet vet\u00ebm n\u00ebse aplikacioni paraprakisht ka b\u00ebr\u00eb thirrje nga SSL_CTX_set_cert_verify_callback(). <\/p>\n
Duke q\u00eb shumica e aplikacioneve nuk e th\u00ebrrasin SSL_CTX_set_cert_verify_callback(), shfaqja e gabimit SSL_ERROR_WANT_RETRY_VERIFY mund t\u00eb interpretohet gabimisht dhe t\u00eb \u00e7oj\u00eb n\u00eb mbyllje t\u00eb papritur, ciklim ose reagime t\u00eb tjera t\u00eb pap\u00ebrshtatshme. Rreziku m\u00eb i madh q\u00eb paraqet ky problem \u00ebsht\u00eb n\u00eb kombinim me nj\u00eb gabim tjet\u00ebr n\u00eb OpenSSL 3.0, i cili \u00e7on n\u00eb shfaqjen e nj\u00eb gabimi t\u00eb brendsh\u00ebm gjat\u00eb p\u00ebrpunimit n\u00eb X509_verify_cert() certifikatave q\u00eb nuk kan\u00eb zgjerimin \"Subject Alternative Name\", por me lidhje ndaj emrave n\u00eb kufizimet e p\u00ebrdorimit. N\u00eb k\u00ebt\u00eb rast, sulmi mund t\u00eb shkaktoj\u00eb anomali q\u00eb varen nga aplikacionet gjat\u00eb p\u00ebrpunimit t\u00eb certifikatave dhe vendosjes s\u00eb seancave TLS. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"