437 lines
20 KiB
HTML
437 lines
20 KiB
HTML
<!DOCTYPE html><html lang="zh-Hans" theme-color="default" theme-mode=""><head>
|
||
<meta charset="UTF-8">
|
||
<title>Spring Framework 远程代码执行漏洞风险通告 - JSKCloud</title>
|
||
<meta name="keywords" content="帮助文档">
|
||
<meta name="description" content="我们的帮助文档提供了丰富的资料和资源，包括产品手册、技术文档等。您可以轻松地找到所需的信息，帮助您更好地了解我们的产品和服务。我们不断更新和完善文档，确保您始终能够获得最新的信息。">
|
||
|
||
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||
<meta http-equiv="Content-Language" content="zh-cn">
|
||
|
||
|
||
|
||
<link rel="stylesheet" href="../../assets/92c1df3730f31c-iconfont.css">
|
||
<link rel="stylesheet" href="../../assets/7bd641cba5f6a0-reset.css">
|
||
<link rel="stylesheet" href="../../assets/478794f28834cd-style.css">
|
||
<link rel="stylesheet" href="../../assets/e5adc0b1fcadda-theme.css">
|
||
<link rel="stylesheet" href="../../assets/054352c1c64ab4-common.css">
|
||
<link rel="stylesheet" href="../../assets/51c94e2cd9af75-animate.css">
|
||
<script src="../../assets/dea655e39abf18-jquery-3.5.1.min.js"></script>
|
||
|
||
|
||
<link rel="stylesheet" href="../../assets/43319114264162-bootstrap.min.css">
|
||
<script src="../../assets/b7c64cb3919aba-bootstrap.min.js"></script>
|
||
|
||
<link rel="stylesheet" href="../../assets/c7ac28884e5076-swiper-bundle.min.css">
|
||
<script src="../../assets/130071f2a87d70-swiper-bundle.min.js"></script>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<link rel="stylesheet" href="../../assets/b828918322b016-document.css">
|
||
|
||
<style>
|
||
/* 移动端适配 */
|
||
@media (max-width: 768px) {
|
||
/* 横幅区域优化 */
|
||
.server-banner2.banner-document {
|
||
padding: 30px 0;
|
||
}
|
||
|
||
.server-banner2 .section-content {
|
||
padding: 0 15px;
|
||
}
|
||
|
||
.server-banner2 h1 {
|
||
font-size: 24px;
|
||
margin-bottom: 12px;
|
||
}
|
||
|
||
.server-banner-desc2 {
|
||
font-size: 14px;
|
||
line-height: 1.6;
|
||
margin-bottom: 25px;
|
||
}
|
||
|
||
/* 搜索框适配 */
|
||
.input-search {
|
||
width: 100%;
|
||
flex-direction: column;
|
||
}
|
||
|
||
#document-input {
|
||
width: 100% !important;
|
||
margin-bottom: 10px;
|
||
height: 44px !important;
|
||
}
|
||
|
||
.search-btn {
|
||
width: 100% !important;
|
||
/* height: 44px !important;
|
||
line-height: 44px !important; */
|
||
text-align: center;
|
||
}
|
||
|
||
/* 文档列表适配 */
|
||
.docement-list {
|
||
margin: 0;
|
||
flex-direction: column;
|
||
}
|
||
|
||
.docement-list .document-box {
|
||
width: 100%;
|
||
min-height: auto;
|
||
margin: 10px 0;
|
||
padding: 20px;
|
||
box-sizing: border-box;
|
||
}
|
||
|
||
.document-box .document-header {
|
||
padding-bottom: 15px;
|
||
}
|
||
|
||
.document-box a {
|
||
font-size: 14px;
|
||
line-height: 1.6;
|
||
height: auto;
|
||
}
|
||
|
||
/* 隐藏桌面端导航 */
|
||
.page .nav-left {
|
||
display: none;
|
||
}
|
||
|
||
.page .nav-right,
|
||
.page .content-page {
|
||
padding-left: 0;
|
||
left: 0;
|
||
}
|
||
|
||
/* 内容区域优化 */
|
||
.page .page-content {
|
||
padding: 20px 15px;
|
||
margin-left: 0;
|
||
height: auto;
|
||
}
|
||
|
||
.document-cont {
|
||
padding: 20px 0 !important;
|
||
}
|
||
|
||
/* 文档详情适配 */
|
||
.document-details .document-view-item .document-view-cont {
|
||
padding: 15px;
|
||
}
|
||
|
||
.document-details .document-view-item .document-view-cont a {
|
||
width: 100%;
|
||
padding-right: 0;
|
||
}
|
||
}
|
||
|
||
/* 小屏幕优化 (≤480px) */
|
||
@media (max-width: 480px) {
|
||
.document-box {
|
||
padding: 15px !important;
|
||
}
|
||
|
||
.document-header img {
|
||
width: 24px !important;
|
||
height: 24px !important;
|
||
}
|
||
|
||
.document-details .document-view-head {
|
||
padding-left: 15px !important;
|
||
}
|
||
|
||
.page .page-content .document-head h2 {
|
||
font-size: 20px;
|
||
}
|
||
}
|
||
</style>
|
||
<link rel="canonical" href="4.html"><link rel="alternate" hreflang="zh-Hans" href="4.html"><link rel="alternate" hreflang="zh-Hant" href="../../zh-hk/announce/4.html"><link rel="alternate" hreflang="en" href="../../en/announce/4.html"><link rel="stylesheet" href="../../assets/site.css"><link rel="stylesheet" href="../../assets/b0317f003749a5-css2.css"><link rel="stylesheet" href="../../assets/de0a696a420db8-css2.css"><link rel="stylesheet" href="../../assets/13192273b45a60-css2.css"></head>
|
||
|
||
<body data-static-site="jskcloud"><header><style>
|
||
/* 语言选择器样式 */
|
||
.language-selector {
|
||
position: relative;
|
||
margin-right: 20px;
|
||
cursor: pointer;
|
||
z-index: 99999;
|
||
}
|
||
|
||
.language-selected {
|
||
display: flex;
|
||
align-items: center;
|
||
padding: 8px 12px;
|
||
border-radius: 6px;
|
||
background-color: rgba(255, 255, 255, 0.1);
|
||
transition: all 0.3s ease;
|
||
}
|
||
|
||
.language-selected:hover {
|
||
background-color: rgba(255, 255, 255, 0.2);
|
||
}
|
||
|
||
.language-flag {
|
||
margin-right: 8px;
|
||
font-size: 16px;
|
||
}
|
||
|
||
.language-code {
|
||
font-weight: 500;
|
||
margin-right: 8px;
|
||
}
|
||
|
||
.language-arrow {
|
||
transition: transform 0.3s ease;
|
||
}
|
||
|
||
.language-selector.active .language-arrow {
|
||
transform: rotate(180deg);
|
||
}
|
||
|
||
.language-dropdown {
|
||
position: absolute;
|
||
top: 100%;
|
||
/* right: 0; */
|
||
width: 140px;
|
||
background: #fff;
|
||
border-radius: 8px;
|
||
box-shadow: 0 4px 12px rgba(0, 0, 0, 0.15);
|
||
opacity: 0;
|
||
visibility: hidden;
|
||
transform: translateY(10px);
|
||
transition: all 0.3s ease;
|
||
z-index: 1000;
|
||
}
|
||
|
||
.language-selector.active .language-dropdown {
|
||
opacity: 1;
|
||
visibility: visible;
|
||
transform: translateY(0);
|
||
}
|
||
|
||
.language-option {
|
||
display: flex;
|
||
align-items: center;
|
||
padding: 10px 12px;
|
||
color: #333;
|
||
transition: all 0.2s ease;
|
||
}
|
||
|
||
.language-option:hover {
|
||
background-color: #f5f5f5;
|
||
}
|
||
|
||
.language-option .language-flag {
|
||
margin-right: 10px;
|
||
}
|
||
|
||
.language-name {
|
||
font-size: 14px;
|
||
}
|
||
</style>
|
||
<div class="nav-shadow">
|
||
<div class="section-content nav-header">
|
||
<div class="nav-left">
|
||
<div class="nav-icon">
|
||
<a href="../index.html"><img src="../../assets/f47e84e194e9c4-c47cdbdba8c01d82740fc430f77aaa6f1792437534-222.png" alt=""></a>
|
||
</div>
|
||
<div class="nav-menu">
|
||
<div>
|
||
<a href="../index.html">
|
||
<div class="nav-item">产品中心</div>
|
||
</a>
|
||
<div class="nav-cont">
|
||
<div class="section-content">
|
||
<div class="nav-cont-menu animated slideInDown">
|
||
<div class="nav-content ">
|
||
<a href="../cloud.html">
|
||
<div class="nav-item-box">
|
||
<div class="item-box-title">
|
||
<div class="title">云服务器</div>
|
||
</div>
|
||
</div>
|
||
</a>
|
||
<a href="../dedicated.html">
|
||
<div class="nav-item-box">
|
||
<div class="item-box-title">
|
||
<div class="title">独立服务器</div>
|
||
</div>
|
||
</div>
|
||
</a>
|
||
<a href="../balance.html">
|
||
<div class="nav-item-box">
|
||
<div class="item-box-title">
|
||
<div class="title">负载均衡</div>
|
||
</div>
|
||
</div>
|
||
</a>
|
||
<a href="../box.html">
|
||
<div class="nav-item-box">
|
||
<div class="item-box-title">
|
||
<div class="title">BOX服务器</div>
|
||
</div>
|
||
</div>
|
||
</a>
|
||
|
||
</div>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
<div>
|
||
<a href="../index.html">
|
||
<div class="nav-item">关于我们</div>
|
||
</a>
|
||
<div class="nav-cont">
|
||
<div class="section-content">
|
||
<div class="nav-cont-menu animated slideInDown">
|
||
<div class="nav-content ">
|
||
<a href="../about.html">
|
||
<div class="nav-item-box">
|
||
<div class="item-box-title">
|
||
<div class="title">公司简介</div>
|
||
</div>
|
||
</div>
|
||
</a>
|
||
<a href="../contact.html">
|
||
<div class="nav-item-box">
|
||
<div class="item-box-title">
|
||
<div class="title">联系我们</div>
|
||
</div>
|
||
</div>
|
||
</a>
|
||
|
||
</div>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
<div class="mobile-menu-btn" id="mobileMenuBtn"></div>
|
||
</div>
|
||
<div class="nav-right">
|
||
|
||
|
||
<div class="language-selector">
|
||
<div class="language-selected">
|
||
<span class="language-flag">🌐</span>
|
||
<span class="language-code">简体中文</span>
|
||
<svg class="language-arrow" width="10" height="6" viewBox="0 0 10 6" fill="none" xmlns="http://www.w3.org/2000/svg">
|
||
<path d="M1 1L5 5L9 1" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"></path>
|
||
</svg>
|
||
</div>
|
||
<div class="language-dropdown">
|
||
<a class="language-option" data-lang="en" href="../../en/announce/4.html" lang="en" hreflang="en">English</a>
|
||
<a class="language-option" data-lang="zh-cn" href="4.html" lang="zh-cn" hreflang="zh-cn" aria-current="true">简体中文</a>
|
||
<a class="language-option" data-lang="zh-hk" href="../../zh-hk/announce/4.html" lang="zh-hk" hreflang="zh-hk">繁體中文</a>
|
||
|
||
</div>
|
||
</div>
|
||
|
||
|
||
|
||
</div>
|
||
</div>
|
||
</div>
|
||
|
||
|
||
|
||
|
||
<div class="aside-tools">
|
||
<div class="tools-list">
|
||
<div class="tools-item">
|
||
<a class="static-contact-trigger" href="https://t.me/JSKCDN999" target="_blank" aria-label="通过 Telegram 联系 JSKCloud" rel="noopener noreferrer"><img src="../../assets/82c093ab92edb0-f801662fa2daa58d6b518f4642a32aed1742560323-tg.jpg" alt=""></a>
|
||
<div class="tools-box">
|
||
<div class="tools-box-s"><h5>联系客服</h5><p><a target="_blank" href="https://t.me/JSKCDN999" rel="noopener noreferrer">@JSKCDN999</a></p></div>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
|
||
</header><main class="static-main"><article class="static-article"><h1>Spring Framework 远程代码执行漏洞风险通告</h1><div class="static-date">2023-03-31</div>
|
||
<div data-version="3.0.0" data-hash="3ab54d8887ec458f6210a6b791a03809"> </div>
|
||
<div>
|
||
<div class="document">
|
||
<div class="section">
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">尊敬的主题云用户：</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px; text-indent: 21pt;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">您好！Spring官方发布安全公告，披露Spring Framework存在缺陷，导致运行在JDK 9及以上版本的环境上存在一处远程代码执行漏洞（CVE-2022-22965），该漏洞可导致远程写入、执行任意代码。</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">【漏洞评级】</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">高风险</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">【漏洞描述】</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">CVE-2022-22965</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">据官方说明，目前已被泄漏的漏洞利用主要影响在 JDK 9+ 上运行的 Spring MVC 和 Spring WebFlux 应用程序。漏洞的成功利用需要应用程序作为 WAR 部署在 Tomcat 上运行。</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">【影响范围】</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">影响版本：</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">Spring Framework 5.3.x < 5.3.18</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">Spring Framework 5.2.x < 5.2.20</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">并且使用了JDK版本 >= 9</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">（其他Spring Framework低版本均有可能受影响）</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">【修复方案】</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">目前官方已发布安全版本，建议受影响的用户升级Spring Framework至安全版本：</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">https://github.com/spring-projects/spring-framework/tags</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">【参考链接】</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">https://tanzu.vmware.com/security/cve-2022-22965</span></p>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
|
||
<a class="static-back" href="../announce.html">返回列表</a></article></main><footer class="section footer index">
|
||
|
||
<div class="section-content section-p">
|
||
|
||
|
||
<div class="footer-content">
|
||
<div class="footer-nav">
|
||
<div class="footer-logo">
|
||
<img src="../../assets/f47e84e194e9c4-c47cdbdba8c01d82740fc430f77aaa6f1792437534-222.png" alt="">
|
||
</div>
|
||
<div class="footer-nav-left">
|
||
<div class="footer-nav-box">
|
||
<div class="footer-nav-head">产品中心</div>
|
||
<div class="footer-nav-cont">
|
||
<div class="footer-nav-item"><a class="link-hover" href="../cloud.html">云服务器</a></div>
|
||
<div class="footer-nav-item"><a class="link-hover" href="../dedicated.html">独立服务器</a></div>
|
||
<div class="footer-nav-item"><a class="link-hover" href="../balance.html">负载均衡</a></div>
|
||
<div class="footer-nav-item"><a class="link-hover" href="../box.html">Box服务器</a></div>
|
||
</div>
|
||
</div>
|
||
<div class="footer-nav-box">
|
||
<div class="footer-nav-head">技术支持</div>
|
||
<div class="footer-nav-cont">
|
||
<div class="footer-nav-item"><a class="link-hover" href="../document.html">技术文档</a></div>
|
||
</div>
|
||
</div>
|
||
<div class="footer-nav-box">
|
||
<div class="footer-nav-head">关于我们</div>
|
||
<div class="footer-nav-cont">
|
||
<div class="footer-nav-item"><a class="link-hover" href="../about.html">公司简介</a></div>
|
||
<div class="footer-nav-item"><a class="link-hover" href="../contact.html">联系我们</a></div>
|
||
</div>
|
||
</div>
|
||
|
||
</div>
|
||
|
||
<div class="footer-nav-right">
|
||
<div class="footer-nav-box"><div class="footer-nav-head">联系我们</div><div class="footer-nav-cont"><div class="footer-nav-item">JSKCloud.net</div><div class="footer-nav-item mt-20"><a class="link-hover" href="https://t.me/JSKCDN999" target="_blank" rel="noopener noreferrer">Telegram @JSKCDN999</a></div></div></div>
|
||
</div>
|
||
</div>
|
||
|
||
|
||
<div class="footer-record">
|
||
<div class="left-info">
|
||
<a href="../index.html" rel="nofollow"> Copyright@2017-2024 JSK cloud TECHNOLOGY PTE. LTD 版权所有 All Rights Reserved</a>
|
||
<a href="../index.html" rel="nofollow"> </a>
|
||
<span> </span>
|
||
</div>
|
||
<span> </span>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
|
||
</footer><script src="../../assets/site.js" defer=""></script></body></html> |