{"id":105318,"date":"2022-10-17T21:36:42","date_gmt":"2022-10-17T19:36:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-libksba-privodyashhaya-k-vypolneniyu-koda-pri-obrabotke-s-mime-v-gnupg"},"modified":"2022-10-17T21:36:42","modified_gmt":"2022-10-17T19:36:42","slug":"uyazvimost-v-libksba-privodyashhaya-k-vypolneniyu-koda-pri-obrabotke-s-mime-v-gnupg","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-libksba-privodyashhaya-k-vypolneniyu-koda-pri-obrabotke-s-mime-v-gnupg","title":{"rendered":"Dob\u00ebsi n\u00eb LibKSBA q\u00eb \u00e7on n\u00eb ekzekutim kodi gjat\u00eb p\u00ebrpunimit t\u00eb S\/MIME n\u00eb GnuPG","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb bibliotek\u00ebn LibKSBA, e zhvilluar nga projekti GnuPG dhe q\u00eb ofron funksione p\u00ebr pun\u00eb me certifikata X.509, \u00ebsht\u00eb zbuluar nj\u00eb dob\u00ebsi kritike (CVE-2022-3515) q\u00eb shkakton mbingarkes\u00eb t\u00eb numrave t\u00eb plot\u00eb dhe shkrim t\u00eb t\u00eb dh\u00ebnave arbitrare jasht\u00eb buffer-it t\u00eb alokuar gjat\u00eb analizimit t\u00eb strukturave ASN.1 t\u00eb p\u00ebrdorura n\u00eb S\/MIME, X.509 dhe CMS. Problemi r\u00ebndohet nga fakti se biblioteka Libksba p\u00ebrdoret n\u00eb paket\u00ebn GnuPG dhe dob\u00ebsia mund t\u00eb \u00e7oj\u00eb n\u00eb ekzekutim t\u00eb kodit nga distanca nga nj\u00eb sulmues gjat\u00eb p\u00ebrpunimit n\u00eb GnuPG (gpgsm) t\u00eb t\u00eb dh\u00ebnave t\u00eb enkriptuara ose t\u00eb n\u00ebnshkruara nga skedar\u00eb apo mesazhe emaili q\u00eb p\u00ebrdorin S\/MIME. N\u00eb rastin m\u00eb t\u00eb thjesht\u00eb, p\u00ebr t\u00eb sulmuar nj\u00eb viktim\u00eb q\u00eb p\u00ebrdor nj\u00eb klient emaili me mb\u00ebshtetje p\u00ebr GnuPG dhe S\/MIME, mjafton t\u00eb d\u00ebrgohet nj\u00eb email i p\u00ebrgatitur posa\u00e7\u00ebrisht. <\/p>\n

Dob\u00ebsia mund t\u00eb p\u00ebrdoret gjithashtu p\u00ebr sulme ndaj server\u00ebve dirmngr, t\u00eb cil\u00ebt merren me shkarkimin dhe analizimin e listave t\u00eb certifikatave t\u00eb revokuara (CRLs) dhe verifikimin e certifikatave t\u00eb p\u00ebrdorura n\u00eb TLS. Sulmi ndaj dirmngr mund t\u00eb kryhet nga ana e servert web<\/a>, n\u00ebn kontrollin e sulmuesit, p\u00ebrmes dor\u00ebzimit t\u00eb CRL-ve ose certifikatave t\u00eb p\u00ebrgatitura posa\u00e7\u00ebrisht. Theksohet se ende nuk jan\u00eb identifikuar exploite t\u00eb disponueshme publikisht p\u00ebr gpgsm dhe dirmngr, por dob\u00ebsia \u00ebsht\u00eb tipike dhe asgj\u00eb nuk i pengon sulmuesit e kualifikuar t\u00eb p\u00ebrgatisin vet\u00eb nj\u00eb exploit. <\/p>\n

P\u00ebrmir\u00ebsimi i vul\u00ebs \u00ebsht\u00eb b\u00ebr\u00eb n\u00eb versionin Libksba 1.6.2 dhe n\u00eb nd\u00ebrtimet binariz GnuPG 2.3.8. N\u00eb distribucione t\u00eb Linux-it, biblioteka Libksba zakonisht ofrohet si nj\u00eb var\u00ebsi e ve\u00e7ant\u00eb, nd\u00ebrsa n\u00eb nd\u00ebrtimet p\u00ebr Windows \u00ebsht\u00eb e p\u00ebrfshir\u00eb n\u00eb paket\u00ebn kryesore t\u00eb instalimit me GnuPG. Pas p\u00ebrdit\u00ebsimit, mos harroni t\u00eb rinisni proceset prapa sken\u00ebs me komand\u00ebn «gpgconf —kill all». P\u00ebr t\u00eb kontrolluar pranin\u00eb e problemit, n\u00eb rezultatin e komand\u00ebs «gpgconf —show-versions» mund t\u00eb vler\u00ebsoni vler\u00ebn e rreshtit «KSBA ….», n\u00eb t\u00eb cilin duhet t\u00eb jet\u00eb e specifikuar nj\u00eb version jo m\u00eb t\u00eb vog\u00ebl se 1.6.2. <\/p>\n

P\u00ebrdit\u00ebsimet p\u00ebr shp\u00ebrndarjet ende nuk jan\u00eb publikuar, por mund t\u00eb ndiqni daljen e tyre n\u00eb faqet: Debian, Ubuntu, Gentoo, RHEL, SUSE, Arch, FreeBSD. Dob\u00ebsia \u00ebsht\u00eb gjithashtu e pranishme n\u00eb paketat MSI dhe AppImage me GnuPG VS-Desktop dhe n\u00eb Gpg4win.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 LibKSBA, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c GnuPG \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\u043c\u0438 X.509, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-3515), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u0440\u0430\u0437\u0431\u043e\u0440\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440 ASN.1, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0432 S\/MIME, X.509 \u0438 CMS. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0443\u0433\u0443\u0431\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0435\u043c, \u0447\u0442\u043e \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 Libksba \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 GnuPG \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105318","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Cenueshm\u00ebri n\u00eb LibKSBA q\u00eb lejon ekzekutimin e kodit gjat\u00eb p\u00ebrpunimit t\u00eb S\/MIME n\u00eb GnuPG | ProHoster","description":"N\u00eb bibliotek\u00ebn LibKSBA, e zhvilluar nga projekti GnuPG dhe q\u00eb ofron funksione p\u00ebr pun\u00eb me certifikata X.509, \u00ebsht\u00eb zbuluar nj\u00eb cenueshm\u00ebri kritike (CVE-2022-3515), q\u00eb \u00e7on n\u00eb tejmbushje t\u00eb numrave t\u00eb plot\u00eb dhe shkrim n\u00eb memorie.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-libksba-privodyashhaya-k-vypolneniyu-koda-pri-obrabotke-s-mime-v-gnupg","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 LibKSBA, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 S\/MIME \u0432 GnuPG | ProHoster","og:description":"\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 LibKSBA, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c GnuPG \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\u043c\u0438 X.509, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-3515), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0438 \u0437\u0430\u043f\u0438\u0441\u0438.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-libksba-privodyashhaya-k-vypolneniyu-koda-pri-obrabotke-s-mime-v-gnupg","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-10-17T19:36:42+00:00","article:modified_time":"2022-10-17T19:36:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"105318","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-08 20:31:51","updated":"2026-02-08 20:31:51","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/105318","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=105318"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/105318\/revisions"}],"predecessor-version":[{"id":157955,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/105318\/revisions\/157955"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=105318"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=105318"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=105318"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}