当前位置：网站首页>(personal) sorting out system vulnerabilities after recent project development

(personal) sorting out system vulnerabilities after recent project development

2022-04-23 13:01:00 【His Highness the peach blossom demon】

operating system

Host tag

Vulnerability name

Hole type

Threat level

explain

Last test time

state

Vulnerability description

Repair plan

Reference link

Disclosure time

CVE Number

CVSS score

linux64_Linux.x86_64

Spring Framework reflective file download vulnerability (CVE-2020-5421)

Application vulnerability

High-risk

route ：/home/apache-tomcat-8.0.45/webapps/api/WEB-INF/lib/spring-core-4.3.12.RELEASE.jar, edition ：4.3.12

2022/2/7 0:34

To be repaired

VMware Tanzu Issue safety bulletins , stay Spring Framework edition 5.2.0-5.2.8、5.1.0-5.1.17、5.0.0-5.0.18、4.3.0-4.3.28 And older unsupported versions , Published an existing in Spring Framework Reflective file download in （Reflected File Download,RFD） Loophole CVE-2020-5421.
CVE-2020-5421 It can be done by jsessionid Path parameter , Bypass the defense RFD The protection of the attack . Previously targeted RFD Our protection is in response to CVE-2015-5211 Added .
An attacker sends a message with a batch script extension to the user URL, Enables users to download and execute files , Thus endangering the user system .VMware Tanzu Officials have released a new version to fix the vulnerability .
Spring Framework yes Java An open source full stack application framework and control inversion container implementation of the platform , Commonly referred to directly as Spring.

Officials have released a new version that fixes the vulnerability , It is recommended that relevant users upgrade and protect as soon as possible .
Download link ：https://github.com/spring-projects/spring-framework/releases

https://s.tencent.com/research/report/1131.html

2020/9/21 0:00

CVE-2020-5421

6.5

linux64_Linux.x86_64

Oracle MySQL JDBC XXE Loophole (CVE-2021-2471)

Application vulnerability

Middle risk

/home/apache-tomcat-8.0.45/webapps/api/WEB-INF/lib/mysql-connector-java-5.1.47.jar : 5.1.47

2022/2/7 0:34

To be repaired

In less than 8.0.27 In version mysql-connector-java There is XXE Loophole , Allows remote attackers to exploit the XXE The vulnerability reads arbitrary files or causes the program to crash .

upgrade MySQL JDBC（mysql-connector-java jar package ） To 8.0.27 Above version .
Official website download address ：https://dev.mysql.com/downloads/connector/j/

https://s.tencent.com/research/report/124

2021/10/21 0:00

CVE-2021-2471

5.9

linux64_Linux.x86_64

Linux polkit Local privilege promotion vulnerability （CVE-2021-4034）

Application vulnerability

High-risk

Linux polkit Version is 0.112-26.el7 , Vulnerability

2022/2/9 9:44

Repaired

In recent days, , The foreign security team issued a security announcement saying , stay polkit Of pkexec A local privilege escalation vulnerability was found in the program .pkexec The application is a setuid Tools , Designed to allow non privileged users to run commands as privileged users according to predefined policies .
Because of the current version of pkexec Cannot handle call parameter count correctly , And will eventually try to execute the environment variable as a command . An attacker can control environment variables , To induce pkexec Execute arbitrary code . After successful use , Can cause non privileged users to gain administrator privileges .

1、 Unable to upgrade the of the software repair package , You can use the following command to delete pkexec Of SUID-bit Access to avoid vulnerability risk ：
chmod 0755 /usr/bin/pkexec
2、CentOS 7 Users of can use yum update polkit Upgrade repair ,Centos 5、6、8 The official has terminated the life cycle (EOL) maintain , It is recommended to stop using ;
3、RedHat Users are advised to contact the red hat official to obtain the security repair source and then execute yum update polkit Upgrade repair ;
4、Ubuntu 18.04 LTS、Ubuntu 20.04 LTS Users of can use sudo apt-get install policykit-1 Upgrade repair ,Ubuntu 14.04、16.04、12.04 The official has terminated the life cycle (EOL) maintain , Repair requires an extra charge Ubuntu ESM（ Extended security maintenance ） service , It is recommended to stop using .

http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-202201-2343

2022/1/26 0:00

CVE-2021-4034

7.8

linux64_Linux.x86_64

Jackson-databind Deserialization vulnerability (CVE-2021-20190)

Application vulnerability

High-risk

route ：/home/apache-tomcat-8.0.45/webapps/api/WEB-INF/lib/jackson-databind-2.8.10.jar, edition ：2.8.10

2022/2/7 0:34

To be repaired

2021 year 1 month 19 Japan ,jackson-databind The official safety notice , Disclosure jackson-databind < 2.9.10.6 There is a deserialization vulnerability , This vulnerability could lead to remote code execution .

Upgrade to safe version
jackson-databind >= 2.9.10.7

https://s.tencent.com/research/report/1232.html

2021/1/19 0:00

CVE-2021-20190

8.1

linux64_Linux.x86_64

Jackson-databind Deserialization vulnerability (CVE-2020-36179 etc. )

Application vulnerability

High-risk

route ：/home/apache-tomcat-8.0.45/webapps/api/WEB-INF/lib/jackson-databind-2.8.10.jar, edition ：2.8.10

2022/2/7 0:34

To be repaired

2021 year 1 month 7 Japan ,jackson-databind The official safety notice , Disclosure jackson-databind < 2.9.10.8 There are multiple deserialization remote code execution vulnerabilities （CVE-2020-36179 ~ CVE-2020-36189）, Exploit the vulnerability , Attackers can execute code remotely , Control server .

To upgrade to 2.9.10.8 And above

https://s.tencent.com/research/report/1217.html

2021/1/7 0:00

CVE-2020-36179 ~ CVE-2020-36189

8.1

linux64_Linux.x86_64

Jackson Remote code execution vulnerability (CVE-2020-35728)

Application vulnerability

High-risk

route ：/home/apache-tomcat-8.0.45/webapps/api/WEB-INF/lib/jackson-databind-2.8.10.jar, edition ：2.8.10

2022/2/7 0:34

To be repaired

2020 year 12 month 27 Japan ,jackson-databind The official safety notice , Disclosure jackson-databind < 2.9.10.8 There is a deserialization Remote Code Execution Vulnerability （CVE-2020-35728）. Exploit the vulnerability , Attackers can execute code remotely , Control server . If not used enableDefaultTyping() Method , The vulnerability can be ignored .

Security version ：
jackson-databind >= 2.9.10.8 ( Not yet available )
jackson-databind >= 2.10.0
Vulnerability mitigation measures ：
1. The official patch has not been released yet , It is recommended that customers use jackson-databind > 2.10 Version of , This version uses activateDefaultTyping(), Configuring a white list can completely eliminate such risks .
For the white list configuration method, please refer to ： reference ：https://s.tencent.com/research/bsafe/1209.html
2. Cannot upgrade for jackson-databind Of , Check and report relevant information jar Removing components from application dependencies can prevent vulnerability attacks （ Risk of unavailability of the application ）.

https://s.tencent.com/research/report/1209.html

2020/12/28 0:00

CVE-2020-35728

8.1

linux64_Linux.x86_64

Jackson Remote code execution vulnerability (CVE-2020-35490 etc. )

Application vulnerability

High-risk

route ：/home/apache-tomcat-8.0.45/webapps/api/WEB-INF/lib/jackson-databind-2.8.10.jar, edition ：2.8.10

2022/2/7 0:34

To be repaired

2020 year 12 month 17 Japan ,jackson-databind The official safety notice , Disclosure jackson-databind < 2.9.10.8 There is a deserialization Remote Code Execution Vulnerability （CVE-2020-35490/CVE-2020-35491）. Exploit the vulnerability , An attacker can take control of the server .

Security version ：
jackson-databind >= 2.9.10.8 ( Not yet available )
jackson-databind >= 2.10.0

https://s.tencent.com/research/report/1205.html

2020/12/19 0:00

CVE-2020-35490/CVE-2020-35491

8.1

linux64_Linux.x86_64

Fastjson Remote code execution vulnerability

Application vulnerability

High-risk

route ：/home/apache-tomcat-8.0.45/webapps/api/WEB-INF/lib/fastjson-1.2.39.jar, edition ：1.2.39

2022/2/7 0:34

To be repaired

In recent days, (2019 year 6 month 22 Japan ),Fastjson Expose Remote Code Execution Vulnerability , Can result in direct access to server permissions , At present, no official announcement has been issued to explain , The vulnerability was studied by internal security personnel , Large impact area , Please upgrade the R & D personnel in time .

Upgrade to 1.2.51 And above , It is recommended to maintain the latest version

https://github.com/alibaba/fastjson/issues/2513

2019/6/22 0:00

9.8

linux64_Linux.x86_64

Fastjson Remote code execution vulnerability

Application vulnerability

High-risk

route ：/home/apache-tomcat-8.0.45/webapps/api/WEB-INF/lib/fastjson-1.2.39.jar, edition ：1.2.39

2022/2/7 0:34

To be repaired

FastJSON In deserialization JSON There is a deserialization vulnerability in , Can cause remote command execution vulnerabilities .

1. Upgrade to 1.2.42 Version above ;
2. Intercept... In the request `@type` keyword , It is recommended to use Tencent cloud website housekeeper

https://github.com/alibaba/fastjson/tags

2017/12/12 0:00

9.8

linux64_Linux.x86_64

Fastjson Remote code execution vulnerability

Application vulnerability

High-risk

route ：/home/apache-tomcat-8.0.45/webapps/api/WEB-INF/lib/fastjson-1.2.39.jar, edition ：1.2.39

2022/2/7 0:34

To be repaired

FastJSON In deserialization JSON There is a deserialization vulnerability in , Can cause remote command execution vulnerabilities .

1. Upgrade to 1.2.48 Version above ;
2. Intercept... In the request `@type` keyword , It is recommended to use Tencent cloud website housekeeper

https://github.com/alibaba/fastjson/wiki/security_update_20170315

2019/7/30 0:00

9.8

linux64_Linux.x86_64

Fastjson Remote code execution vulnerability

Application vulnerability

High-risk

route ：/home/apache-tomcat-8.0.45/webapps/api/WEB-INF/lib/fastjson-1.2.39.jar, edition ：1.2.39

2022/2/7 0:34

To be repaired

Fastjson 1.2.69 There is a Remote Code Execution Vulnerability in the following versions , Hackers can use this vulnerability to gain server privileges , Bring great security risks to server security .

Upgrade to 1.2.69 And above

https://cloud.tencent.com/announce/detail/1112?from=timeline&isappinstalled=0

2020/5/28 0:00

9.8

linux64_Linux.x86_64

Fastjson Deserializing Remote Code Execution Vulnerability

Application vulnerability

High-risk

route ：/home/apache-tomcat-8.0.45/webapps/api/WEB-INF/lib/fastjson-1.2.39.jar, edition ：1.2.39

2022/2/7 0:34

To be repaired

fastjson Use the blacklist method to prevent the deserialization vulnerability , As a result, when hackers continue to discover new exploitable deserialization Gadgets Class time , You can easily bypass the blacklist defense mechanism , The deserialization vulnerability will reappear . remind fastjson Users should take security measures as soon as possible to prevent vulnerability attacks . Affects version fastjson<1.2.61, Security version fastjson >= 1.2.61.

fastjson since 1.2.5X The above is closed by default autotype, The default configuration is not affected by the vulnerability , This vulnerability can be ignored .

Upgrade to safe version , Refer to the download link ：https://repo1.maven.org/maven2/com/alibaba/fastjson/

https://github.com/alibaba/fastjson/releases/tag/1.2.61?spm=a2c4g.11174386.n2.4.1ac21051dKzZoe&file=1.2.61

2019/9/20 0:00

9.2

linux64_Linux.x86_64

Apache Tomcat The file contains a vulnerability （CVE-2020-1938）

Application vulnerability

High-risk

Tomcat Vulnerability ：
/home/apache-tomcat-8.0.45/lib/catalina.jar (version 8.0.45);

2022/2/7 0:34

To be repaired

Apache Tomcat The file contains a vulnerability （CVE-2020-1938）.Tomcat AJP Due to the implementation defects of the protocol, the related parameters are controllable , An attacker can exploit this vulnerability by constructing specific parameters , Read server webapp Any file under . If there is a file upload function on the server side at the same time , Attackers can further implement remote code execution , Bring great security risks to the server .

Upgrade to the following version .
Tomcat 6 Please upgrade to Tomcat 7/8/9 Corresponding security version .
Tomcat 7 Upgrade to 7.0.100 edition .
Tomcat 8 Upgrade to 8.5.51 edition .
Tomcat 9 Upgrade to 9.0.31 edition .

https://www.cnblogs.com/r00tuser/p/12343153.html

2020/2/20 0:00

CVE-2020-1938

9.8

版权声明
本文为[His Highness the peach blossom demon]所创，转载请带上原文链接，感谢
https://yzsam.com/2022/04/202204231258434722.html