Shalay waxaan ku wadaageynaa wararka halkan ku qoran barta joojinta shahaadada IdenTrust (DST Root CA X3) oo loo adeegsaday in lagu saxeexo shahaadada Encrypt CA waxay dhibaato ku keentay ansixinta shahaadada Encrypt ee mashaariicda iyadoo la adeegsanayo noocyadii hore ee OpenSSL iyo GnuTLS.
Arrimaha ayaa sidoo kale saameeyay maktabadda LibreSSL, kuwa horumariyayaashu aysan tixgelin waayo -aragnimadii hore ee la xiriirtay shilal dhacay ka dib markii ay dhammaatay shahaadada xididka AddTrust ee maamulka shahaadada Sectigo (Comodo).
Waa sidaas ee noocyada OpenSSL ilaa iyo ay ku jiraan 1.0.2 iyo GnuTLS kahor 3.6.14, qalad ayaa dhacay in aysan u oggolaan in si sax ah loo socodsiiyo shahaadooyinka isdhaafsan haddii mid ka mid ah shahaadooyinka xididka ee loo adeegsaday saxiixa uu dhacay, xitaa haddii kuwo kale oo ansax ah la hayo.
Nuxurka qaladka ayaa ah in qaababkii hore ee OpenSSL iyo GnuTLS ay u shaabadeeyeen shahaadada sidii silsilad toosan, halka sida ku xusan RFC 4158, shahaadadu waxay matali kartaa jaantuska digirta la qaybiyey ee jihaysan oo leh barroosinno aaminaad oo kala duwan oo ay tahay in la tixgeliyo.
Qeyb ahaan mashruuca OpenBSD ayaa si degdeg ah loogu sii daayay balastar loogu talagalay 6.8 iyo 6.9 laamood maanta, kaas oo hagaajiya arrimaha LibreSSL oo leh xaqiijin shahaado oo la saxiixay, mid ka mid ah shahaadooyinka xididka ee silsiladda aaminaadda ayaa dhacay. Xalka dhibaatada, waxaa lagu talinayaa in / etc / installurl, ka beddel HTTPS una gudub HTTP (tani khatar kuma aha amniga, maaddaama cusboonaysiinta lagu xaqiijiyo saxiixa digital) ama dooro muraayad kale (ftp.usa.openbsd.org , ftp.hostserver.de, cdn.openbsd .org).
Sidoo kale shahaadadii dhacday ee DST Root CA X3 waa laga saari karaa laga bilaabo /etc/ssl/cert.pem faylka, iyo adeegsiga syspatch ee loo adeegsado rakibidda cusboonaysiinta nidaamka ikhtiyaariga ah ayaa joojiyay shaqadii OpenBSD.
Dhibaatooyin la mid ah DragonFly BSD ayaa dhaca marka lala shaqeynayo DPorts. Markii la bilaabayo maamulaha xirmada pkg, qalad xaqiijin shahaado ayaa la abuuraa. Hagaajinta ayaa lagu daray laamaha sayniska, DragonFly_RELEASE_6_0 iyo DragonFly_RELEASE_5_8 maanta. Xal u helid ahaan, waxaad ka saari kartaa shahaadada DST Root CA X3.
Qaar ka mid ah khaladaadka dhacay ka dib markii la joojiyay shahaadada IdenTrust waxay ahaayeen kuwan soo socda:
- Habka xaqiijinta shahaadada Aynu Encrypt ayaa lagu kala dhex galay codsiyada ku saleysan madal Electron. Arrintan waxaa lagu hagaajiyay cusboonaysiinta 12.2.1, 13.5.1, 14.1.0, 15.1.0.
- Qaybinta qaarkood waxay dhibaato ka haysataa marin u helidda bakhaarada marka la isticmaalayo maareeyaha xirmada APT oo ay ku jiraan noocyada hore ee maktabadda GnuTLS.
- Debian 9 waxaa saameeyay xirmada GnuTLS ee aan la buuxin, taasoo dhalisay dhibaatooyin helitaanka deb.debian.org loogu talagalay isticmaaleyaasha aan ku rakibin cusbooneysiinta waqtiga (hagaajinta gnutls28-3.5.8-5 + deb9u6 waxaa la soo jeediyay 17-kii Sebtembar).
- Macmiilka acme wuxuu jabiyay OPNsense, arrinta ayaa la soo sheegay waqti hore, laakiin horumariyayaashu waxay ku guuldareysteen inay sii daayaan balastarka waqtigii loogu talagalay.
- Arrintu waxay saameysay xirmada OpenSSL 1.0.2k ee RHEL / CentOS 7, laakiin toddobaad ka hor RHEL 7 iyo CentOS 7, cusboonaysiinta ca-certificate-2021.2.50-72.el7_9.noarch package ayaa laga soo saaray Shahaadada IdenTrust waa la tirtiray, taas oo ah, muujinta dhibaatada waa la hor istaagay.
- Tan iyo markii cusboonaysiinta la sii daayay goor hore, dhibaatada ka dhalanaysa xaqiijinta shahaadada Encrypt waxay saameysay kaliya isticmaaleyaashii hore RHEL / CentOS iyo laamaha Ubuntu, oo aan si joogto ah u rakibin cusbooneysiinta.
- Habka xaqiijinta shahaadada ee grpc waa la jebiyey.
- Waa lagu guuldareystay in la abuuro madal bogga Cloudflare.
- Arrimaha Adeegga Shabakadda Amazon (AWS).
- Isticmaalayaasha DigitalOcean waxay dhibaato kala kulmaan isku xirka xogta.
- Netlify dariiqa madal ee daruuriga.
- Dhibaatooyinka helitaanka adeegyada Xero.
- Isku day lagu doonayay in lagu dhiso xiriir TLS oo lala yeeshay MailGun Web API ayaa fashilmay.
- Dhiqlaha ku jira noocyada macOS iyo macruufka (11, 13, 14), taas oo aragti ahaan aysan ahayn inay dhibaatadu saameyso.
- Fashilinta adeegyada qabashada
- Waa lagu guuldareystay in la hubiyo shahaadooyinka marka la galayo PostMan API.
- The Guardian Firewall ayaa burburtay.
- Carqaladaynta bogga taageerada ee monday.com.
- Shil on madal Cerb.
- Ma awoodo in la xaqiijiyo wakhtiga korjoogteynta Google Cloud Monitoring.
- Soo saar shahaado shahaado oo ku taal Cisco Dalladda Secure Web Gateway.
- Dhibaatooyinka ku xiraya wakiillada Bluecoat iyo Palo Alto.
- OVHcloud waxay dhibaato ka haysataa isku xirka OpenStack API.
- Dhibaatooyinka abuuraya warbixinnada ku jira Shopify.
- Waxaa jira dhibaatooyin marin u helka Heroku API.
- Shil ku dhacay Maareeyaha Ledger Live.
- Khaladka ansaxinta shahaadada ee aaladaha horumarinta dalabka Facebook.
- Dhibaatooyinka Sophos SG UTM.
- Dhibaatooyinka xaqiijinta shahaadada ee cPanel.
Xal kale, waxaa la soo jeediyay in la tirtiro shahaadada «DST Root CA X3» laga bilaabo dukaanka nidaamka (/etc/ca-certificates.conf iyo / etc / ssl / certs) ka dibna maamula amarka "update -ca -ificates -f -v").
CentOS iyo RHEL, waxaad ku dari kartaa shahaadada "DST Root CA X3" liiska madow.