{"id":125333,"date":"2025-05-21T15:05:14","date_gmt":"2025-05-21T13:05:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-biblioteke-openpgp-js-pozvolyayushhaya-obojti-verifikacziyu-soobshhenij"},"modified":"2025-05-21T15:05:14","modified_gmt":"2025-05-21T13:05:14","slug":"uyazvimost-v-biblioteke-openpgp-js-pozvolyayushhaya-obojti-verifikacziyu-soobshhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-biblioteke-openpgp-js-pozvolyayushhaya-obojti-verifikacziyu-soobshhenij","title":{"rendered":"Nj\u00eb dob\u00ebsi n\u00eb bibliotek\u00ebn OpenPGP.js, e cila lejon kalimin e verifikimit t\u00eb mesazheve","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb bibliotek\u00ebn OpenPGP.js \u00ebsht\u00eb identifikuar nj\u00eb dob\u00ebsi (CVE-2025-47934), e cila lejon nj\u00eb sulmues t\u00eb d\u00ebrgoj\u00eb nj\u00eb mesazh t\u00eb modifikuar q\u00eb do t\u00eb njihet nga marr\u00ebsi si i verifikuar (funksionet openpgp.verify dhe openpgp.decrypt do t\u00eb kthejn\u00eb nj\u00eb tregues t\u00eb suksessh\u00ebm t\u00eb verifikimit t\u00eb n\u00ebnshkrimit digjital, megjith\u00ebse p\u00ebrmbajtja \u00ebsht\u00eb z\u00ebvend\u00ebsuar dhe ndryshon nga t\u00eb dh\u00ebnat p\u00ebr t\u00eb cilat u krijua n\u00ebnshkrimi). Dob\u00ebsia \u00ebsht\u00eb adresuar n\u00eb l\u00ebshimet OpenPGP.js 5.11.3 dhe 6.1.1. Problemi shfaqet vet\u00ebm n\u00eb deg\u00ebt OpenPGP.js 5.x dhe 6.x, dhe nuk prek OpenPGP.js 4.x. <\/p>\n
Biblioteka OpenPGP.js ofron nj\u00eb zbatim t\u00eb plot\u00eb t\u00eb protokollit OpenPGP n\u00eb gjuh\u00ebn JavaScript, q\u00eb lejon kryerjen e operacioneve t\u00eb enkriptimit n\u00eb shfletues dhe punimin me n\u00ebnshkrime digjitale t\u00eb bazuara n\u00eb \u00e7el\u00ebsa publik\u00eb. Projekti zhvillohet nga zhvilluesit e Proton Mail dhe, p\u00ebrve\u00e7 organizimit t\u00eb enkriptimit end-to-end t\u00eb mesazheve n\u00eb Proton Mail, p\u00ebrdoret n\u00eb projekte t\u00eb tilla si FlowCrypt, Mymail-Crypt, UDC, Encrypt.to, PGP Anywhere dhe Passbolt. <\/p>\n
Dob\u00ebsia prek procedurat e verifikimit t\u00eb n\u00ebnshkrimit t\u00eb integruar n\u00eb tekstin e n\u00ebnshkrimit (openpgp.verify) dhe mesazhet e n\u00ebnshkruara dhe t\u00eb enkriptuara (openpgp.decrypt). Nj\u00eb sulmues mund t\u00eb p\u00ebrdor\u00eb mesazhe t\u00eb n\u00ebnshkruara ekzistuese p\u00ebr t\u00eb formuar mesazhe t\u00eb reja, gjat\u00eb nxjerrjes s\u00eb t\u00eb cilave versioni i dob\u00ebt i OpenPGP.js do t\u00eb nxjerr\u00eb p\u00ebrmbajtjen e z\u00ebvend\u00ebsuar, e cila ndryshon nga p\u00ebrmbajtja e mesazhit t\u00eb n\u00ebnshkruar origjinal. Dob\u00ebsia nuk prek n\u00ebnshkrimet q\u00eb shp\u00ebrndahen ve\u00e7mas nga teksti (problemi shfaqet vet\u00ebm gjat\u00eb transmetimit t\u00eb n\u00ebnshkrimit s\u00eb bashku me tekstin si nj\u00eb bllok t\u00eb dh\u00ebnash). <\/p>\n
P\u00ebr t\u00eb formuar nj\u00eb mesazh t\u00eb z\u00ebvend\u00ebsuar, nj\u00eb sulmuesi i nevojitet vet\u00ebm nj\u00eb mesazh me n\u00ebnshkrim t\u00eb integruar ose t\u00eb ve\u00e7ant\u00eb, si dhe njohja e t\u00eb dh\u00ebnave origjinale t\u00eb n\u00ebnshkruara n\u00eb k\u00ebt\u00eb mesazh. Sulmuesi mund t\u00eb ndryshoj\u00eb mesazhin n\u00eb m\u00ebnyr\u00eb q\u00eb n\u00ebnshkrimi i modifikuar t\u00eb vazhdoj\u00eb t\u00eb konsiderohet korrekt. Po ashtu, mund t\u00eb ndryshohen mesazhe t\u00eb enkriptuara me n\u00ebnshkrim, gjat\u00eb nxjerrjes s\u00eb t\u00eb cilave do t\u00eb kthehen t\u00eb dh\u00ebnat e shtuara nga sulmuesi. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"