Apache HertzBeat SnakeYaml·´ÐòÁл¯Îó²îÀ´Ï®£¬ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍøÌṩ½â¾ö¼Æ»®
Ðû²¼Ê±¼ä 2024-09-28Apache HertzBeat ÊÇ¿ªÔ´µÄʵʱ¼à¿Ø¹¤¾ß£¬ÊÜÓ°Ïì°æ±¾ÖÐδ¶ÔÓû§¿É¿ØµÄ yaml ÎļþÓÐÓùýÂË£¬¾ÓÉÉí·ÝÑéÖ¤µÄ¹¥»÷Õ߿ɽṹ¶ñÒâµÄ yaml ÎļþÔ¶³ÌÖ´ÐÐí§Òâ´úÂë¡£
2024Äê9Ô£¬ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍø¼à¿Øµ½Apache HertzBeat¹Ù·½Ðû²¼ÁËCVE-2024-42323 £¬snakeYaml µÄ RCE ¼ÓÔضñÒâ yamlÊý¾Ý¡£¸ÃÎó²îCVSS3.1ÏÖÔÚÆÀ·ÖΪ8.8·Ö£¬²¢ÇÒÆä×ÛºÏÆÀ¼¶Îª¡°¸ßΣ¡±¡£
Îó²î¸´ÏÖ
Ó°Ïì°æ±¾
Apache Hertbeat < 1.6.0
½â¾ö¼Æ»®
Ò»¡¢¹Ù·½ÐÞ¸´¼Æ»®
ÏÖÔÚ¹Ù·½ÒÑÓпɸüа汾£¬½¨ÒéÊÜÓ°ÏìÓû§Éý¼¶ÖÁ×îа汾:
Apache Hertbeat >= 1.6.0
¹Ù·½ÏÂÔصص㣺
https://hertzbeat.apache.org/zh-cn/docs/download/
¶þ¡¢ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍø½â¾ö¼Æ»®
1¡¢ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍø¼ì²âÀà²úÆ·¼Æ»®
ÌìãÙÈëÇÖ¼ì²âÓëÖÎÀíϵͳ£¨IDS£©¡¢ÌìãÙ³¬Èںϼì²â̽Õ루CSP£©¡¢ÌìãÙÍþвÆÊÎöÒ»Ìå»ú£¨TAR£©¡¢ÌìÇåWEBÇå¾²Ó¦ÓÃÍø¹Ø£¨WAF£©Éý¼¶µ½20240927°æ±¾ÊÂÎñ¿â£¬ÌìÇåÈëÇÖ·ÀÓùϵͳ£¨IPS£©Éý¼¶µ½×îа汾ÊÂÎñ¿â£¬¼´¿ÉÓÐÓüì²â»ò·À»¤¸ÃÎó²îÔì³ÉµÄ¹¥»÷Σº¦¡£ÊÂÎñ¿âÏÂÔصص㣺
https://venustech.download.venuscloud.cn/
2¡¢ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍøÖն˲úÆ·¼Æ»®
Ìì«‘ÖÕ¶ËÇå¾²Ò»Ì廯£¨EDR£©ÌṩÎó²îµÄרÏîÑéÖ¤¼ì²éÄÜÁ¦¿É¶ÔÎó²îפÁôÖն˾ÙÐÐÈ«Íøͬ²½ÑéÖ¤£¬Í¬Ê±ÊµÊ±¼à¿Ø²¢¸æ¾¯Òì³£×Ó¸¸Àú³Ì¡¢¼à¿ØÖ÷»úÒì³£ÍâÁ¬¼ì²â£¬Ô¤·ÀÎó²î¹¥»÷Σº¦¡£
3¡¢ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍø©ɨ²úÆ·¼Æ»®
£¨1£©¡°ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍøÎó²îɨÃèϵͳV6.0¡±²úÆ·ÒÑÖ§³Ö¶Ô¸ÃÎó²î¾ÙÐÐɨÃè¡£

£¨2£©ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍøÎó²îɨÃèϵͳ608XϵÁа汾ÒÑÖ§³Ö¶Ô¸ÃÎó²î¾ÙÐÐɨÃè¡£

4¡¢ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍø×ʲúÓëųÈõÐÔÖÎÀíƽ̨²úÆ·¼Æ»®
ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍø×ʲúÓëųÈõÐÔÖÎÀíƽ̨ʵʱÊÕÂÞ²¢¸üÐÂÇ鱨ÐÅÏ¢£¬¶ÔÈë¿â×ʲúÎó²îApache HertzBeat SnakeYaml·´ÐòÁл¯Îó²î£¨CVE-2024-42323£©¾ÙÐÐÖÎÀí¡£

5¡¢ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍøÇå¾²ÖÎÀíºÍ̬ÊƸÐ֪ƽ̨²úÆ·¼Æ»®
Óû§¿ÉÒÔͨ¹ýÌ©ºÏÇå¾²ÖÎÀíºÍ̬ÊƸÐ֪ƽ̨£¬¾ÙÐйØÁªÕ½ÂÔÉèÖã¬ÍŽáÏÖÕæÏàÐÎÖÐϵͳÈÕÖ¾ºÍÇå¾²×°±¸µÄ¸æ¾¯ÐÅÏ¢¾ÙÐÐÒ»Á¬¼à¿Ø£¬´Ó¶ø·¢Ã÷¡°Apache HertzBeat SnakeYaml·´ÐòÁл¯Îó²î£¨CVE-2024-42323£©¡±µÄÎó²îʹÓù¥»÷ÐÐΪ¡£
£¨1£©ÔÚÌ©ºÏµÄƽ̨ÖУ¬Í¨¹ýųÈõÐÔ·¢Ã÷¹¦Ð§Õë¶Ô¡°Apache HertzBeat SnakeYaml·´ÐòÁл¯Îó²î£¨CVE-2024-42323£©¡±Îó²îɨÃèʹÃü£¬ÅŲéÖÎÀíÍøÂçÖÐÊÜ´ËÎó²îÓ°ÏìµÄÖ÷Òª×ʲú¡£
£¨2£©Æ½Ì¨¡°¹ØÁªÆÊÎö¡±Ä£¿éÖУ¬Ìí¼Ó¡°L2_Apache HertzBeat SnakeYaml·´ÐòÁл¯Îó²î¡±£¬Í¨¹ýÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍø¼ì²â×°±¸¡¢Ä¿µÄÖ÷»úϵͳµÈ×°±¸µÄ¸æ¾¯ÈÕÖ¾£¬·¢Ã÷Íⲿ¹¥»÷ÐÐΪ¡£

̫ͨ¹ýÎö¹æÔò×Ô¶¯½«"L2_Apache HertzBeat SnakeYaml·´ÐòÁл¯Îó²î"Îó²îʹÓõĿÉÒÉÐÐΪԴµØµãÌí¼Óµ½ÊÓ²ìÁÐ±í¡°¸ßΣº¦ÅþÁ¬¡±ÖУ¬×÷ΪÄÚ²¿Ç鱨Êý¾ÝʹÓá£
£¨3£©Ìí¼Ó¡°L3_Apache HertzBeat SnakeYaml·´ÐòÁл¯Îó²î¡±£¬Ìõ¼þÈÕÖ¾Ãû³Æ¼´ÊÇ»ò°üÀ¨¡°L2_Apache HertzBeat SnakeYaml·´ÐòÁл¯Îó²î¡±£¬¹¥»÷Ч¹û¼´ÊÇ¡°¹¥»÷Àֳɡ±£¬Ä¿µÄµØµãÒýÓÃ×ʲúÎó²î»òÔ´µØµãÆ¥ÅäÍþвÇ鱨£¬´Ó¶øÌáÉý¹ØÁª¹æÔòµÄÖÃÐŶȡ£