zookeeper3.6.3升级jetty9.4.47解决安全漏洞CVE-2022-2048和CVE-2021-28169

Love The Way You Lie 2024-03-31 17:52 76阅读 0赞

客户扫描到zookeeper有CVE-2022-2048和CVE-2021-28169安全漏洞要求修复。  
漏洞和官方解决办法如下：  
一、\# [CVE-2022-2048][] Jetty升级到这几个修复版本9.4.47. 10.0.10, 11.0.10  
Eclipse Jetty 存在安全漏洞，该漏洞源于无效的 HTTP/2 请求可能占用连接导致拒绝服务，以下产品和版本受到影响：Eclipse Jetty 9.4.46及之前版本、10.0.9 及之前版本、11.0.9及之前版本。  
解决办法： Jetty升级到这几个修复版本9.4.47. 10.0.10, 11.0.10  
[https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j][https_github.com_eclipse_jetty.project_security_advisories_GHSA-wgmr-mf83-7x4j]  
![在这里插入图片描述][401072bc78454a3e82cced0aff3cbf1d.png]  
[https://github.com/eclipse/jetty.project/pull/7978/commits/af828e7d4937ea20a4b896f4ad77fc3edd7ff2c4][https_github.com_eclipse_jetty.project_pull_7978_commits_af828e7d4937ea20a4b896f4ad77fc3edd7ff2c4]  
![在这里插入图片描述][e6f99ed4045a4d189c1caed42ac78c71.png]

二、\# CVE-2021-28169 Jetty升级到这几个版本9.4.41, 10.0.3 and 11.0.3  
Eclipse Jetty 9.4.40及之前版本、10.0.2及之前版本和11.0.2及之前版本存在信息泄露漏洞。攻击者可利用该漏洞导致有关We应用程序实现的敏感信息泄露。  
[https://github.com/eclipse/jetty.project/security/advisories/GHSA-gwcr-j4wh-j3cq][https_github.com_eclipse_jetty.project_security_advisories_GHSA-gwcr-j4wh-j3cq]  
![在这里插入图片描述][d6f7d35b8a154deaa15ed826c4e90d2c.png]

三、总之升级到jetty 9.4.47可以修复这两个安全漏洞  
jetty 9.4.47下载地址: [https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-distribution/9.4.47.v20220610/][https_repo1.maven.org_maven2_org_eclipse_jetty_jetty-distribution_9.4.47.v20220610]  
https://download.csdn.net/download/shy\_snow/87269854  
个别jar也可以直接从maven仓库下载https://mvnrepository.com/artifact/org.eclipse.jetty/jetty-util-ajax  
替换zookeeper的lib目录下的7个jetty为9.4.47版本jar包后重启zookeeper,即可。  
![在这里插入图片描述][9cede26b249440c78188a5a3c2e7ce1d.png]

[CVE-2022-2048]: https://ubuntu.com/security/CVE-2022-2048
[https_github.com_eclipse_jetty.project_security_advisories_GHSA-wgmr-mf83-7x4j]: https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j
[401072bc78454a3e82cced0aff3cbf1d.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/366ad1bc1b09488f9df64bf6ac82bedd.png
[https_github.com_eclipse_jetty.project_pull_7978_commits_af828e7d4937ea20a4b896f4ad77fc3edd7ff2c4]: https://github.com/eclipse/jetty.project/pull/7978/commits/af828e7d4937ea20a4b896f4ad77fc3edd7ff2c4
[e6f99ed4045a4d189c1caed42ac78c71.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/d4862e328bfc4202bba2bae81f940e89.png
[https_github.com_eclipse_jetty.project_security_advisories_GHSA-gwcr-j4wh-j3cq]: https://github.com/eclipse/jetty.project/security/advisories/GHSA-gwcr-j4wh-j3cq
[d6f7d35b8a154deaa15ed826c4e90d2c.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/aa821a0cb3aa4fc59d6b665d2165b40d.png
[https_repo1.maven.org_maven2_org_eclipse_jetty_jetty-distribution_9.4.47.v20220610]: https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-distribution/9.4.47.v20220610/
[9cede26b249440c78188a5a3c2e7ce1d.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/4c26e9fe071640b5815fef1f3cab59d4.png