1.修复的CVE
CVE-2021-44832
Apache Log4j是美国阿帕奇(Apache)基金会的一款基于Java的开源日志记录工具。Apache Log4j2 2.0-beta7 到 2.17.0版本存在安全漏洞,该漏洞源于软件中对于JDBC Appender 和JNDI 缺少有效的防护与过滤。有权修改日志配置文件的攻击者可以构建恶意配置 将 JDBC Appender 与引用 JNDI URI 的数据源一起使用,该 JNDI URI 可以执行远程代码。
银河麒麟桌面操作系统V10 SP1
软件包:apache-log4j2
2.17.1-0.20.04.1(V10 SP1)
·银河麒麟桌面操作系统V10 SP1
liblog4j2-java
liblog4j2-java-doc
打开软件包源配置文件,根据仓库地址进行修改。
4.0.2桌面版本:
http://archive.cyjm16888.com/kylin/KYLIN-ALL 4.0.2-desktop main restricted universe multiverse
4.0.2-sp1桌面版本:
http://archive.cyjm16888.com/kylin/KYLIN-ALL 4.0.2sp1-desktop main restricted universe multiverse
4.0.2-sp2桌面版本:
http://archive.cyjm16888.com/kylin/KYLIN-ALL 4.0.2sp2-desktop main restricted universe multiverse
4.0.2-sp3桌面版本:
http://archive.cyjm16888.com/kylin/KYLIN-ALL 4.0.2sp3-desktop main restricted universe multiverse
4.0.2-sp4桌面版本:
http://archive.cyjm16888.com/kylin/KYLIN-ALL 4.0.2sp4-desktop main restricted universe multiverse
10.0版本:
http://archive.cyjm16888.com/kylin/KYLIN-ALL 10.0 main restricted universe multiverse
10SP1版本:
http://archive.cyjm16888.com/kylin/KYLIN-ALL 10.1 main restricted universe multiverse
配置完成后执行更新命令进行升级
$sudo apt update
通过软件包地址下载软件包,使用软件包升级命令根据受影响的组件包列表 升级相关的组件包。
$dpkg -i Packagelists
http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/universe/a/apache-log4j2/liblog4j2-java-doc_2.17.1-0.20.04.1_all.deb
http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/universe/a/apache-log4j2/liblog4j2-java_2.17.1-0.20.04.1_all.deb
http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/universe/a/apache-log4j2/liblog4j2-java-doc_2.17.1-0.20.04.1_all.deb
http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/universe/a/apache-log4j2/liblog4j2-java_2.17.1-0.20.04.1_all.deb
http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/universe/a/apache-log4j2/liblog4j2-java-doc_2.17.1-0.20.04.1_all.deb
http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/universe/a/apache-log4j2/liblog4j2-java_2.17.1-0.20.04.1_all.deb