Apache HertzBeat SnakeYaml·´ÐòÁл¯Â©¶´À´Ï®£¬mansion88Ã÷ÉýÌṩ½â¾ö·½°¸
·¢²¼Ê±¼ä 2024-09-28Apache HertzBeat ÊÇ¿ªÔ´µÄʵʱ¼à¿Ø¹¤¾ß£¬ÊÜÓ°Ïì°æ±¾ÖÐδ¶ÔÓû§¿É¿ØµÄ yaml ÎļþÓÐЧ¹ýÂË£¬¾¹ýÉí·ÝÑéÖ¤µÄ¹¥»÷Õ߿ɹ¹Ôì¶ñÒâµÄ yaml ÎļþÔ¶³ÌÖ´ÐÐÈÎÒâ´úÂë¡£
2024Äê9Ô£¬mansion88Ã÷Éý¼à¿Øµ½Apache HertzBeat¹Ù·½·¢²¼ÁËCVE-2024-42323 £¬snakeYaml µÄ RCE ¼ÓÔØ¶ñÒâ yamlÊý¾Ý¡£¸Ã©¶´CVSS3.1ĿǰÆÀ·ÖΪ8.8·Ö£¬²¢ÇÒÆä×ÛºÏÆÀ¼¶Îª¡°¸ßΣ¡±¡£

©¶´¸´ÏÖ


Ó°Ïì°æ±¾
Apache Hertbeat < 1.6.0
½â¾ö·½°¸
Ò»¡¢¹Ù·½ÐÞ¸´·½°¸
Ŀǰ¹Ù·½ÒÑÓпɸüа汾£¬½¨ÒéÊÜÓ°ÏìÓû§Éý¼¶ÖÁ×îа汾:
Apache Hertbeat >= 1.6.0
¹Ù·½ÏÂÔØµØÖ·£º
https://hertzbeat.apache.org/zh-cn/docs/download/
¶þ¡¢mansion88Ã÷Éý½â¾ö·½°¸
1¡¢mansion88Ã÷Éý¼ì²âÀà²úÆ··½°¸
ÌìãÙÈëÇÖ¼ì²âÓë¹ÜÀíϵͳ£¨IDS£©¡¢ÌìãÙ³¬Èںϼì²â̽Õ루CSP£©¡¢ÌìãÙÍþв·ÖÎöÒ»Ìå»ú£¨TAR£©¡¢ÌìÇåWEB°²È«Ó¦ÓÃÍø¹Ø£¨WAF£©Éý¼¶µ½20240927°æ±¾Ê¼þ¿â£¬ÌìÇåÈëÇÖ·ÀÓùϵͳ£¨IPS£©Éý¼¶µ½×îа汾ʼþ¿â£¬¼´¿ÉÓÐЧ¼ì²â»ò·À»¤¸Ã©¶´Ôì³ÉµÄ¹¥»÷·çÏÕ¡£Ê¼þ¿âÏÂÔØµØÖ·£º
https://venustech.download.venuscloud.cn/
2¡¢mansion88Ã÷ÉýÖն˲úÆ··½°¸
Ìì«‘Öն˰²È«Ò»Ì廯£¨EDR£©Ìṩ©¶´µÄרÏîÑéÖ¤¼ì²éÄÜÁ¦¿É¶Ô©¶´×¤ÁôÖն˽øÐÐÈ«ÍøÍ¬²½ÑéÖ¤£¬Í¬Ê±ÊµÊ±¼à¿Ø²¢¸æ¾¯Òì³£×Ó¸¸½ø³Ì¡¢¼à¿ØÖ÷»úÒì³£ÍâÁ¬¼ì²â£¬Ô¤·À©¶´¹¥»÷·çÏÕ¡£

3¡¢mansion88Ã÷Éý©ɨ²úÆ··½°¸
£¨1£©¡°mansion88Ã÷Éý©¶´É¨ÃèϵͳV6.0¡±²úÆ·ÒÑÖ§³Ö¶Ô¸Ã©¶´½øÐÐɨÃè¡£

£¨2£©mansion88Ã÷Éý©¶´É¨Ãèϵͳ608XϵÁа汾ÒÑÖ§³Ö¶Ô¸Ã©¶´½øÐÐɨÃè¡£

4¡¢mansion88Ã÷Éý×ʲúÓë´àÈõÐÔ¹ÜÀíÆ½Ì¨²úÆ··½°¸
mansion88Ã÷Éý×ʲúÓë´àÈõÐÔ¹ÜÀíÆ½Ì¨ÊµÊ±²É¼¯²¢¸üÐÂÇ鱨ÐÅÏ¢£¬¶ÔÈë¿â×ʲú©¶´Apache HertzBeat SnakeYaml·´ÐòÁл¯Â©¶´£¨CVE-2024-42323£©½øÐйÜÀí¡£

5¡¢mansion88Ã÷Éý°²È«¹ÜÀíºÍÌ¬ÊÆ¸Ð֪ƽ̨²úÆ··½°¸
Óû§¿ÉÒÔͨ¹ýÌ©ºÏ°²È«¹ÜÀíºÍÌ¬ÊÆ¸Ð֪ƽ̨£¬½øÐйØÁª²ßÂÔÅäÖ㬽áºÏʵ¼Ê»·¾³ÖÐϵͳÈÕÖ¾ºÍ°²È«É豸µÄ¸æ¾¯ÐÅÏ¢½øÐгÖÐø¼à¿Ø£¬´Ó¶ø·¢ÏÖ¡°Apache HertzBeat SnakeYaml·´ÐòÁл¯Â©¶´£¨CVE-2024-42323£©¡±µÄ©¶´ÀûÓù¥»÷ÐÐΪ¡£
£¨1£©ÔÚÌ©ºÏµÄƽ̨ÖУ¬Í¨¹ý´àÈõÐÔ·¢ÏÖ¹¦ÄÜÕë¶Ô¡°Apache HertzBeat SnakeYaml·´ÐòÁл¯Â©¶´£¨CVE-2024-42323£©¡±Â©¶´É¨ÃèÈÎÎñ£¬ÅŲé¹ÜÀíÍøÂçÖÐÊÜ´Ë©¶´Ó°ÏìµÄÖØÒª×ʲú¡£

£¨2£©Æ½Ì¨¡°¹ØÁª·ÖÎö¡±Ä£¿éÖУ¬Ìí¼Ó¡°L2_Apache HertzBeat SnakeYaml·´ÐòÁл¯Â©¶´¡±£¬Í¨¹ýmansion88Ã÷Éý¼ì²âÉ豸¡¢Ä¿±êÖ÷»úϵͳµÈÉ豸µÄ¸æ¾¯ÈÕÖ¾£¬·¢ÏÖÍⲿ¹¥»÷ÐÐΪ¡£

ͨ¹ý·ÖÎö¹æÔò×Ô¶¯½«"L2_Apache HertzBeat SnakeYaml·´ÐòÁл¯Â©¶´"©¶´ÀûÓõĿÉÒÉÐÐΪԴµØÖ·Ìí¼Óµ½¹Û²ìÁÐ±í¡°¸ß·çÏÕÁ¬½Ó¡±ÖУ¬×÷ΪÄÚ²¿Ç鱨Êý¾ÝʹÓá£
£¨3£©Ìí¼Ó¡°L3_Apache HertzBeat SnakeYaml·´ÐòÁл¯Â©¶´¡±£¬Ìõ¼þÈÕÖ¾Ãû³ÆµÈÓÚ»ò°üº¬¡°L2_Apache HertzBeat SnakeYaml·´ÐòÁл¯Â©¶´¡±£¬¹¥»÷½á¹ûµÈÓÚ¡°¹¥»÷³É¹¦¡±£¬Ä¿µÄµØÖ·ÒýÓÃ×ʲú©¶´»òÔ´µØÖ·Æ¥ÅäÍþвÇ鱨£¬´Ó¶øÌáÉý¹ØÁª¹æÔòµÄÖÃÐŶȡ£



¾©¹«Íø°²±¸11010802024551ºÅ