Jackson 最新反序列化漏洞(CVE-2019-14361和CVE-2019-14439)

ELK下LOGSTASH中jackson由2.9.5升级到2.10.5
一、准备工作:
1、下载(三个文件包,记得保证版本一致)
jackson-annotations-2.10.5.jar
jackson-core-2.10.5.jar
jackson-databind-2.10.5.jar

下载地址:
https://repo1.maven.org/maven2/com/fasterxml/jackson/core/
资料来源:https://help.aliyun.com/noticelist/articleid/1060035134.html

2、备份服务器
cd /usr/local
tar zcvf logstash.6.3.2_20210619.tar.gz logstash
mv logstash.6.3.2_20210619.tar.gz /data/backspace/


二、升级
1、创建文件夹(6个)
mkdir -p mkdir -p /usr/local/logstash/vendor/bundle/jruby/2.3.0/gems/jrjackson-0.4.6-java/lib/com/fasterxml/jackson/core/jackson-core/2.10.5
mkdir -p /usr/local/logstash/vendor/bundle/jruby/2.3.0/gems/jrjackson-0.4.6-java/lib/com/fasterxml/jackson/core/jackson-databind/2.10.5
mkdir -p /usr/local/logstash/vendor/bundle/jruby/2.3.0/gems/jrjackson-0.4.6-java/lib/com/fasterxml/jackson/core/jackson-annotations/2.10.5
mkdir -p /usr/local/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-beats-5.0.16-java/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-core/2.10.5
mkdir -p /usr/local/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-beats-5.0.16-java/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.10.5
mkdir -p /usr/local/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-beats-5.0.16-java/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-annotations/2.10.5


2、上传文件(6个)
mkdir /data/soft
cd /data/soft
rz
cp jackson-core-2.10.5.jar /usr/local/logstash/vendor/bundle/jruby/2.3.0/gems/jrjackson-0.4.6-java/lib/com/fasterxml/jackson/core/jackson-core/2.10.5/
cp jackson-databind-2.10.5.jar /usr/local/logstash/vendor/bundle/jruby/2.3.0/gems/jrjackson-0.4.6-java/lib/com/fasterxml/jackson/core/jackson-databind/2.10.5/
cp jackson-annotations-2.10.5.jar /usr/local/logstash/vendor/bundle/jruby/2.3.0/gems/jrjackson-0.4.6-java/lib/com/fasterxml/jackson/core/jackson-annotations/2.10.5/
cp jackson-core-2.10.5.jar /usr/local/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-beats-5.0.16-java/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-core/2.10.5/
cp jackson-databind-2.10.5.jar /usr/local/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-beats-5.0.16-java/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.10.5/
cp jackson-annotations-2.10.5.jar /usr/local/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-beats-5.0.16-java/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-annotations/2.10.5/

3、修改文件 jrjackson_jars.rb(jackson-module-afterburner 参数不修改)
cd /usr/local/logstash/vendor/bundle/jruby/2.3.0/gems/jrjackson-0.4.6-java/lib
vim jrjackson_jars.rb?


4、把所有6个路径下的2.9.5这个目录移走

rm -rf /usr/local/logstash/vendor/bundle/jruby/2.3.0/gems/jrjackson-0.4.6-java/lib/com/fasterxml/jackson/core/jackson-core/2.9.5/jackson-core-2.9.5.jar
rm -rf /usr/local/logstash/vendor/bundle/jruby/2.3.0/gems/jrjackson-0.4.6-java/lib/com/fasterxml/jackson/core/jackson-databind/2.9.5/jackson-databind-2.9.5.jar
rm -rf /usr/local/logstash/vendor/bundle/jruby/2.3.0/gems/jrjackson-0.4.6-java/lib/com/fasterxml/jackson/core/jackson-annotations/2.9.5/jackson-annotations-2.9.5.jar
rm -rf /usr/local/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-beats-5.0.16-java/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-core/2.9.5/jackson-core-2.9.5.jar
rm -rf /usr/local/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-beats-5.0.16-java/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.9.5/jackson-databind-2.9.5.jar
rm -rf /usr/local/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-beats-5.0.16-java/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-annotations/2.9.5/jackson-annotations-2.9.5.jar


5、移走/usr/local/logstash/logstash-core/lib/jars/下面的三个旧版本文件
rm -rf /usr/local/logstash/logstash-core/lib/jars/jackson-core-2.9.5.jar
rm -rf /usr/local/logstash/logstash-core/lib/jars/jackson-databind-2.9.5.jar
rm -rf /usr/local/logstash/logstash-core/lib/jars/jackson-annotations-2.9.5.jar

6、把新版本文件放入/usr/local/logstash/logstash-core/lib/jars/
cd /data/soft
cp ./jackson-core-2.10.5.jar /usr/local/logstash/logstash-core/lib/jars/
cp ./jackson-databind-2.10.5.jar /usr/local/logstash/logstash-core/lib/jars/
cp ./jackson-annotations-2.10.5.jar /usr/local/logstash/logstash-core/lib/jars/

7、修改/usr/local/logstash/logstash-core/versions-gem-copy.yml,把jackson: 2.9.5改为 jackson:2.10.5

8、重启logstash。

Jackson 最新反序列化漏洞(CVE-2019-14361和CVE-2019-14439)

上一篇:FL studio系列教程(十四):如何在FL Studio播放列表中排列样式


下一篇:使用KVM技术实现yum源创建虚拟机,并且能够联通外网