# Linux安全技术

# ubuntu14.04 BIND漏洞修复

<div id="bkmrk-%E6%9F%A5%E8%AF%A2%E7%89%88%E6%9C%AC">查询版本</div><div id="bkmrk-named--v">named -v</div><div id="bkmrk-bind-9.9.5-3-ubuntu-">BIND 9.9.5-3-Ubuntu (Extended Support Version)</div><div id="bkmrk-">  
</div><div id="bkmrk-%E6%9F%A5%E7%9C%8B%E5%8F%AF%E5%AE%89%E8%A3%85%E7%9A%84bind%E7%89%88%E6%9C%AC">查看可安装的BIND版本</div><div id="bkmrk-apt-cache-policy-bin">apt-cache policy bind9</div><div id="bkmrk-%E5%A6%82%E6%9E%9C%E6%9C%89%E8%BE%83%E6%96%B0%E7%9A%84%E7%89%88%E6%9C%AC%E7%94%A8%E4%B8%8B%E9%9D%A2%E5%91%BD%E4%BB%A4%E5%AE%89%E8%A3%85">如果有较新的版本用下面命令安装</div><div id="bkmrk-sudo-apt-get-install">sudo apt-get install bind9</div><div id="bkmrk--1">  
</div><div id="bkmrk-%E5%8F%AF%E6%9B%B4%E6%96%B0%E5%88%B09.11.19">可更新到9.11.19</div><div id="bkmrk--2">  
</div><div id="bkmrk-%E5%9C%A8-ubuntu-14.04-%E4%B8%AD%E5%8D%B8%E8%BD%BD-b">在 Ubuntu 14.04 中卸载 Bind9 可以按照以下步骤进行：</div><div id="bkmrk-%E4%B8%80%E3%80%81%E5%81%9C%E6%AD%A2-bind9-%E6%9C%8D%E5%8A%A1">一、停止 Bind9 服务</div><div id="bkmrk-%E5%A6%82%E6%9E%9C-bind9-%E6%AD%A3%E5%9C%A8%E8%BF%90%E8%A1%8C%EF%BC%8C%E5%85%88%E5%81%9C%E6%AD%A2%E6%9C%8D%E5%8A%A1%EF%BC%9A">如果 Bind9 正在运行，先停止服务：</div><div id="bkmrk-plaintext">plaintext</div><div id="bkmrk-%E5%A4%8D%E5%88%B6">复制</div><div id="bkmrk-sudo-service-bind9-s">sudo service bind9 stop</div><div id="bkmrk-%E4%BA%8C%E3%80%81%E5%8D%B8%E8%BD%BD-bind9-%E8%BD%AF%E4%BB%B6%E5%8C%85">二、卸载 Bind9 软件包</div><div id="bkmrk-%E4%BD%BF%E7%94%A8-apt-get-%E5%91%BD%E4%BB%A4%E5%8D%B8%E8%BD%BD%EF%BC%9A">使用 apt-get 命令卸载：</div><div id="bkmrk-plaintext-1">plaintext</div><div id="bkmrk-%E5%A4%8D%E5%88%B6-1">复制</div><div id="bkmrk-%C2%A0-%C2%A0sudo-apt-get-remo"> sudo apt-get remove bind9</div><div id="bkmrk-%E8%BF%99%E5%B0%86%E5%88%A0%E9%99%A4-bind9-%E8%BD%AF%E4%BB%B6%E5%8C%85%EF%BC%8C%E4%BD%86%E5%8F%AF%E8%83%BD%E4%BC%9A%E7%95%99">这将删除 Bind9 软件包，但可能会留下一些配置文件。</div><div id="bkmrk-%E5%A6%82%E6%9E%9C%E6%83%B3%E8%A6%81%E5%BD%BB%E5%BA%95%E6%B8%85%E9%99%A4%E5%8C%85%E6%8B%AC%E9%85%8D%E7%BD%AE%E6%96%87%E4%BB%B6%E5%9C%A8%E5%86%85%E7%9A%84%E6%89%80%E6%9C%89%E7%9B%B8">如果想要彻底清除包括配置文件在内的所有相关内容，可以使用 purge 选项：</div><div id="bkmrk-plaintext-2">plaintext</div><div id="bkmrk-%E5%A4%8D%E5%88%B6-2">复制</div><div id="bkmrk-%C2%A0-%C2%A0sudo-apt-get-purg"> sudo apt-get purge bind9</div><div id="bkmrk-%E4%B8%89%E3%80%81%E6%A3%80%E6%9F%A5%E6%98%AF%E5%90%A6%E5%8D%B8%E8%BD%BD%E5%B9%B2%E5%87%80">三、检查是否卸载干净</div><div id="bkmrk-%E5%8F%AF%E4%BB%A5%E4%BD%BF%E7%94%A8%E4%BB%A5%E4%B8%8B%E5%91%BD%E4%BB%A4%E6%9F%A5%E7%9C%8B%E7%B3%BB%E7%BB%9F%E4%B8%AD%E6%98%AF%E5%90%A6%E8%BF%98%E6%9C%89%E4%B8%8E-b">可以使用以下命令查看系统中是否还有与 Bind9 相关的软件包：</div><div id="bkmrk-plaintext-3">plaintext</div><div id="bkmrk-%E5%A4%8D%E5%88%B6-3">复制</div><div id="bkmrk-%C2%A0-%C2%A0dpkg--l-%7C-grep-bi"> dpkg -l | grep bind9</div><div id="bkmrk-%E5%A6%82%E6%9E%9C%E6%B2%A1%E6%9C%89%E8%BE%93%E5%87%BA%E4%BB%BB%E4%BD%95%E5%86%85%E5%AE%B9%EF%BC%8C%E8%AF%B4%E6%98%8E-bind9-">如果没有输出任何内容，说明 Bind9 已被完全卸载。</div><div id="bkmrk-%E4%B9%9F%E5%8F%AF%E4%BB%A5%E6%A3%80%E6%9F%A5%E7%9B%B8%E5%85%B3%E7%9A%84%E7%9B%AE%E5%BD%95%EF%BC%8C%E5%A6%82-%2Fetc%2Fbi">也可以检查相关的目录，如 /etc/bind 是否还存在。如果存在，可以手动删除（但要谨慎操作，确保没有重要数据）：</div><div id="bkmrk-plaintext-4">plaintext</div><div id="bkmrk-%E5%A4%8D%E5%88%B6-4">复制</div><div id="bkmrk-%C2%A0-%C2%A0sudo-rm--rf-%2Fetc%2F"> sudo rm -rf /etc/bind</div><div id="bkmrk-%E8%AF%B7%E6%B3%A8%E6%84%8F%EF%BC%8C%E5%9C%A8%E5%8D%B8%E8%BD%BD%E4%BB%BB%E4%BD%95%E8%BD%AF%E4%BB%B6%E6%97%B6%EF%BC%8C%E7%A1%AE%E4%BF%9D%E4%BD%A0%E4%BA%86%E8%A7%A3%E5%85%B6%E5%90%8E">请注意，在卸载任何软件时，确保你了解其后果，并备份重要的数据和配置文件。同时，卸载 Bind9 可能会影响依赖于域名解析服务的其他应用程序或服务。如果需要重新安装或使用其他域名解析服务，应做好相应的规划和配置。</div>

# 设置zookeeper白名单

<div id="bkmrk-%E4%B8%80%E3%80%81%E7%99%BD%E5%90%8D%E5%8D%95%E6%96%B9%E5%BC%8F">一、白名单方式</div><div id="bkmrk-%23-%E8%AE%BE%E7%BD%AEzookeeper%E7%99%BD%E5%90%8D%E5%8D%95">\# 设置zookeeper白名单</div><div id="bkmrk-%23-%2Fusr%2Flocal%2Fzookeep">\# /usr/local/zookeeper-3.4.13/bin/zkCli.sh -server 127.0.0.1:2181</div><div id="bkmrk-%3E-setacl-%2Fzookeeper-">&gt; setAcl /zookeeper ip:127.0.0.1:cdrwa</div><div id="bkmrk-%3E-setacl-%2Fdubbo-ip%3A1">&gt; setAcl /dubbo ip:127.0.0.1:cdrwa</div><div id="bkmrk-%3E-getacl-%2Fzookeeper">&gt; getAcl /zookeeper</div><div id="bkmrk-%3E-getacl-%2Fdubbo">&gt; getAcl /dubbo</div><div id="bkmrk-">  
</div><div id="bkmrk-%E4%BA%8C%E3%80%81%E7%94%A8%E6%88%B7%E8%B4%A6%E5%8F%B7%E8%AE%A4%E8%AF%81">二、用户账号认证</div><div id="bkmrk-1-%E5%8A%A0%E5%AF%86%E7%94%A8%E6%88%B7%E5%AF%86%E7%A0%81">1 加密用户密码</div><div id="bkmrk-%23-echo--n-admin%3Ashun">\# echo -n admin:shuncom2004 | openssl dgst -binary -sha1 | openssl base64</div><div id="bkmrk-j9pfb5lkaqeric8%2Frmfv">j9pfb5lKAqerIC8/RmfV2Iq+1HQ=</div><div id="bkmrk--1">  
</div><div id="bkmrk-2-%E8%AE%BE%E7%BD%AE%E6%9D%83%E9%99%90">2 设置权限</div><div id="bkmrk-%23-%2Fusr%2Flocal%2Fzookeep-1">\# /usr/local/zookeeper-3.4.13/bin/zkCli.sh -server 127.0.0.1:2181</div><div id="bkmrk-%3E-setacl-%2Fzookeeper--1">&gt; setAcl /zookeeper digest:admin:j9pfb5lKAqerIC8/RmfV2Iq+1HQ=:cdrwa</div><div id="bkmrk--2">  
</div><div id="bkmrk-%3E-getacl-%2Fzookeeper-1">&gt; getAcl /zookeeper</div><div id="bkmrk-%27digest%2C%27admin%3Aj9pfb">'digest,'admin:j9pfb5lKAqerIC8/RmfV2Iq+1HQ=</div><div id="bkmrk-%3A-cdrwa">: cdrwa</div><div id="bkmrk--3">  
</div><div id="bkmrk-%3E%C2%A0-ls-%2Fzookeeper">&gt; ls /zookeeper</div><div id="bkmrk-authentication-is-no">Authentication is not valid : /zookeeper</div><div id="bkmrk--4">  
</div><div id="bkmrk-%23-%E6%8E%88%E6%9D%83%E7%99%BB%E5%BD%95">\# 授权登录</div><div id="bkmrk-%3E-addauth-digest-adm">&gt; addauth digest admin:shuncom2004</div><div id="bkmrk-%3E-ls-%2Fzookeeper">&gt; ls /zookeeper</div><div id="bkmrk-%5Bquota%5D">[quota]</div><div id="bkmrk--5">  
</div><div id="bkmrk-%E4%B8%89%E3%80%81%E8%80%81%E5%B9%B3%E5%8F%B0%E7%AB%AF%E5%8F%A3%E9%98%B2%E7%81%AB%E5%A2%99">三、老平台端口防火墙</div><div id="bkmrk-%23-vsftpd%E7%9B%B8%E5%85%B3">\# vsftpd相关</div><div id="bkmrk-firewall-cmd---add-p">firewall-cmd --add-port=33880/tcp --permanent</div><div id="bkmrk-firewall-cmd---add-p-1">firewall-cmd --add-port=10001-10005/tcp --permanent</div><div id="bkmrk-firewall-cmd---add-p-2">firewall-cmd --add-port=30080/tcp --permanent</div><div id="bkmrk--6">  
</div><div id="bkmrk-%23-%E9%A9%B1%E5%8A%A8">\# 驱动</div><div id="bkmrk-firewall-cmd---add-p-3">firewall-cmd --add-port=6011/tcp --permanent</div><div id="bkmrk-firewall-cmd---add-p-4">firewall-cmd --add-port=6013/tcp --permanent</div><div id="bkmrk-firewall-cmd---add-p-5">firewall-cmd --add-port=6014/tcp --permanent</div><div id="bkmrk-firewall-cmd---add-p-6">firewall-cmd --add-port=6012/udp --permanent</div><div id="bkmrk--7">  
</div><div id="bkmrk-%23-tomcat">\# tomcat</div><div id="bkmrk-firewall-cmd---add-p-7">firewall-cmd --add-port=8080/tcp --permanent</div><div id="bkmrk--8">  
</div><div id="bkmrk-%23-shuncom-connect.ja">\# shuncom-connect.jar</div><div id="bkmrk-firewall-cmd---add-p-8">firewall-cmd --add-port=8088/tcp --permanent</div><div id="bkmrk-firewall-cmd---add-p-9">firewall-cmd --add-port=8089/tcp --permanent</div><div id="bkmrk-firewall-cmd---add-p-10">firewall-cmd --add-port=8094/tcp --permanent</div><div id="bkmrk-firewall-cmd---add-p-11">firewall-cmd --add-port=8099/tcp --permanent</div><div id="bkmrk-firewall-cmd---add-p-12">firewall-cmd --add-port=8091/tcp --permanent</div><div id="bkmrk--9">  
</div><div id="bkmrk-%23-connect2-server.ja">\# connect2-server.jar</div><div id="bkmrk-firewall-cmd---add-p-13">firewall-cmd --add-port=8074/tcp --permanent</div><div id="bkmrk-firewall-cmd---add-p-14">firewall-cmd --add-port=9097/tcp --permanent</div><div id="bkmrk--10">  
</div><div id="bkmrk-firewall-cmd---reloa">firewall-cmd --reload</div><div id="bkmrk-firewall-cmd---list-">firewall-cmd --list-all</div>

# OpenSSH_6.6.1p1升级到openssh-9.1p1

<div id="bkmrk-1.1-%E5%8D%87%E7%BA%A7zlib">1.1 升级zlib</div><div id="bkmrk-tar--xzf-zlib-1.2.11">tar -xzf zlib-1.2.11.tar.gz &amp;&amp; cd zlib-1.2.11</div><div id="bkmrk-">  
</div><div id="bkmrk-%E5%8D%87%E7%BA%A7openssh%E7%94%A8%E5%88%B0%E7%9A%84%E7%9B%AE%E5%BD%95%EF%BC%8C%E7%A1%AE%E4%BF%9D%E7%9B%AE%E5%BD%95%E5%BA%95">升级openssh用到的目录，确保目录底下有lib目录（库文件）</div><div id="bkmrk-.%2Fconfigure---prefix">./configure --prefix=/usr/local/zlib &amp;&amp; make -j 8 &amp;&amp; make install</div><div id="bkmrk--1">  
</div><div id="bkmrk-%E6%9B%B4%E6%96%B0%E5%8A%A8%E6%80%81%E9%93%BE%E6%8E%A5%E5%BA%93">更新动态链接库</div><div id="bkmrk-echo-%22%2Fusr%2Flocal%2Fzli">echo "/usr/local/zlib/lib" &gt;&gt; /etc/ld.so.conf</div><div id="bkmrk-ldconfig--v">ldconfig -v</div><div id="bkmrk--2">  
</div><div id="bkmrk-1.2-%E5%8D%87%E7%BA%A7openssl">1.2 升级openssl</div><div id="bkmrk-tar--xzf-openssl-ope">tar -xzf openssl-OpenSSL_1_1_0k.tar.gz</div><div id="bkmrk--3">  
</div><div id="bkmrk-%E6%B3%A8%E6%84%8F%E5%8A%A0%E5%8F%82%E6%95%B0--shared%EF%BC%8C%E6%89%8D%E8%83%BD%E5%9C%A8%2Fus">注意加参数--shared，才能在/usr/local/openssl目录生成lib等文件，后续升级openssh会用到</div><div id="bkmrk-.%2Fconfig---prefix%3D%2Fu">./config --prefix=/usr/local/openssl --shared &amp;&amp; make -j 8 &amp;&amp; make install </div><div id="bkmrk-mv-%2Fusr%2Fbin%2Fopenssl-">mv /usr/bin/openssl /usr/bin/openssl_bak &amp;&amp; mv /usr/include/openssl/ /usr/include/openssl_bak/ </div><div id="bkmrk-ln--s-%2Fusr%2Flocal%2Fope">ln -s /usr/local/openssl/bin/openssl /usr/bin/openssl &amp;&amp; ln -s /usr/local/openssl/include/openssl/ /usr/include/openssl</div><div id="bkmrk-%EF%BC%88%E6%B3%A8%E6%84%8F%E6%AD%A4%E5%A4%84%E8%BD%AF%E9%93%BE%E6%8E%A5%E9%9C%80%E8%A6%81%E6%8C%89%E4%BD%8F%E5%AE%9E%E9%99%85%E8%B7%AF%E5%BE%84%EF%BC%89">（注意此处软链接需要按住实际路径）</div><div id="bkmrk--4">  
</div><div id="bkmrk-%E6%9B%B4%E6%96%B0%E5%8A%A8%E6%80%81%E9%93%BE%E6%8E%A5%E5%BA%93-1">更新动态链接库</div><div id="bkmrk-echo-%22%2Fusr%2Flocal%2Fope">echo "/usr/local/openssl/lib" &gt; /etc/ld.so.conf.d/openssl.conf</div><div id="bkmrk-ldconfig--v-1">ldconfig -v</div><div id="bkmrk--5">  
</div><div id="bkmrk-1.3-%E5%8D%87%E7%BA%A7openssh">1.3 升级openssh</div><div id="bkmrk-tar--xzf-openssh-9.1">tar -xzf openssh-9.1p1.tar.gz</div><div id="bkmrk-mv-%2Fetc%2Fssh%2F-%2Fetc%2Fss">mv /etc/ssh/ /etc/ssh_bak/ &amp;&amp; mv /etc/init.d/ssh /etc/init.d/ssh_bak &amp;&amp; mv /usr/bin/ssh /usr/bin/ssh_bak &amp;&amp; cd openssh-9.1p1/</div><div id="bkmrk--6">  
</div><div id="bkmrk-%E4%B8%8D%E5%8A%A0%E5%8F%82%E6%95%B0--with-pam%EF%BC%8C%E5%90%A6%E5%88%99%E4%BC%9A%E6%8A%A5%E9%94%99">不加参数--with-pam，否则会报错configure: error: PAM headers not found</div><div id="bkmrk-.%2Fconfigure---prefix-1">./configure --prefix=/usr --sysconfdir=/etc/ssh --with-md5-passwords --with-zlib=/usr/local/zlib --with-ssl-dir=/usr/local/openssl --with-privsep-path=/var/lib/sshd </div><div id="bkmrk-make--j-8-%26%26-make-in">make -j 8 &amp;&amp; make install</div><div id="bkmrk--7">  
</div><div id="bkmrk-1.4-%E5%8D%87%E7%BA%A7openssh-9.8p1">1.4 升级openssh 9.8p1</div><div id="bkmrk--8">  
</div><div id="bkmrk-tar--xzf-openssl-1.1">tar -xzf openssl-1.1.1w.tar.gz</div><div id="bkmrk-cd-openssl-1.1.1w">cd openssl-1.1.1w</div><div id="bkmrk-.%2Fconfig---prefix%3D%2Fu-1">./config --prefix=/usr/local/openssl --shared &amp;&amp; make -j 8 &amp;&amp; make install </div><div id="bkmrk--9">  
</div><div id="bkmrk-mv-%2Fusr%2Fbin%2Fopenssl--1">mv /usr/bin/openssl /usr/bin/openssl_bak &amp;&amp; mv /usr/include/openssl/ /usr/include/openssl_bak/ </div><div id="bkmrk-ln--s-%2Fusr%2Flocal%2Fope-1">ln -s /usr/local/openssl/bin/openssl /usr/bin/openssl &amp;&amp; ln -s /usr/local/openssl/include/openssl/ /usr/include/openssl</div><div id="bkmrk-%EF%BC%88%E6%B3%A8%E6%84%8F%E6%AD%A4%E5%A4%84%E8%BD%AF%E9%93%BE%E6%8E%A5%E9%9C%80%E8%A6%81%E6%8C%89%E4%BD%8F%E5%AE%9E%E9%99%85%E8%B7%AF%E5%BE%84%EF%BC%89-1">（注意此处软链接需要按住实际路径）</div><div id="bkmrk--10">  
</div><div id="bkmrk-%E6%9B%B4%E6%96%B0%E5%8A%A8%E6%80%81%E9%93%BE%E6%8E%A5%E5%BA%93-2">更新动态链接库</div><div id="bkmrk-echo-%22%2Fusr%2Flocal%2Fope-1">echo "/usr/local/openssl/lib" &gt; /etc/ld.so.conf.d/openssl.conf</div><div id="bkmrk-ldconfig--v-2">ldconfig -v</div><div id="bkmrk--11">  
</div><div id="bkmrk-tar--xzf-openssh-9.8">tar -xzf openssh-9.8p1.tar.gz</div><div id="bkmrk-cd-openssh-9.8p1">cd openssh-9.8p1</div><div id="bkmrk-.%2Fconfigure---prefix-2">./configure --prefix=/usr --sysconfdir=/etc/ssh --with-md5-passwords --with-zlib=/usr/local/zlib --with-ssl-dir=/usr/local/openssl --with-privsep-path=/var/lib/sshd </div><div id="bkmrk-make--j-8-%26%26-make-in-1">make -j 8 &amp;&amp; make install</div><div id="bkmrk--12"></div><div id="bkmrk-%E6%9F%A5%E7%9C%8B%E6%98%AF%E5%90%A6%E5%8D%87%E7%BA%A7%E6%88%90%E5%8A%9F">查看是否升级成功</div><div id="bkmrk-ssh--v">ssh -V</div><div id="bkmrk--13">  
</div><div id="bkmrk-%E6%8B%B7%E8%B4%9D%E6%BA%90%E6%96%87%E4%BB%B6%E7%9B%AE%E5%BD%95%E4%B8%AD%E7%9A%84sshd.init">拷贝源文件目录中的sshd.init</div><div id="bkmrk-cp--a-contrib%2Fredhat">cp -a contrib/redhat/sshd.init /etc/init.d/ssh &amp;&amp;\</div><div id="bkmrk-vim-%2Fetc%2Fssh%2Fsshd_co">vim /etc/ssh/sshd_config</div><div id="bkmrk--14">  
</div><div id="bkmrk-%E4%BF%AE%E6%94%B9%E9%85%8D%E7%BD%AE%E4%B8%AD%E7%9A%84%E4%BB%A5%E4%B8%8B%E5%8F%82%E6%95%B0%EF%BC%8C%E4%BD%BF%E4%B9%8B%E5%92%8C%E5%8E%9F%E6%9D%A5%E9%85%8D%E7%BD%AE%E4%BF%A1%E6%81%AF">修改配置中的以下参数，使之和原来配置信息保持一致</div><div id="bkmrk-permitrootlogin-yes">PermitRootLogin yes</div><div id="bkmrk-passwordauthenticati">PasswordAuthentication yes</div><div id="bkmrk--15">  
</div><div id="bkmrk-%E4%BF%AE%E6%94%B9sshd_config%E6%96%87%E4%BB%B6%E7%AB%8B%E5%8D%B3%E7%94%9F%E6%95%88">修改sshd_config文件立即生效</div><div id="bkmrk-service-ssh-reload-%26">service ssh reload &amp;&amp; service ssh restart &amp;&amp; service ssh status</div>

# 跨源资源共享（CORS）配置不当导致安全漏洞

<div id="bkmrk-%E8%A6%81%E9%81%BF%E5%85%8D-%E8%B7%A8%E6%BA%90%E8%B5%84%E6%BA%90%E5%85%B1%E4%BA%AB%EF%BC%88cors%EF%BC%89-%E9%85%8D%E7%BD%AE%E4%B8%8D">要避免 跨源资源共享（CORS） 配置不当导致安全漏洞，可以按照以下措施配置您的 Web 服务器或应用程序，以实现更安全的跨域资源共享设置。</div><div id="bkmrk-%E5%85%B3%E9%94%AE%E5%AE%89%E5%85%A8%E6%8E%AA%E6%96%BD">关键安全措施</div><div id="bkmrk-1.-%E6%98%8E%E7%A1%AE%E6%8C%87%E5%AE%9A%E5%85%81%E8%AE%B8%E7%9A%84%E5%9F%9F%E5%90%8D">1. 明确指定允许的域名</div><div id="bkmrk-">  
</div><div id="bkmrk-%C2%A0-%C2%A0-%E9%81%BF%E5%85%8D%E9%80%9A%E9%85%8D%E7%AC%A6%EF%BC%9Aaccess-con"> 避免通配符：Access-Control-Allow-Origin: * 允许任何来源访问资源，这是一个常见的安全风险。</div><div id="bkmrk-%C2%A0-%C2%A0-%E6%AD%A3%E7%A1%AE%E9%85%8D%E7%BD%AE%EF%BC%9A%E6%8C%87%E5%AE%9A%E5%85%81%E8%AE%B8%E8%AE%BF%E9%97%AE%E7%9A%84%E5%8F%AF%E4%BF%A1%E5%9F%9F%E5%90%8D"> 正确配置：指定允许访问的可信域名。例如：</div><div id="bkmrk--1">  
</div><div id="bkmrk-%C2%A0-%C2%A0-access-control-a"> Access-Control-Allow-Origin: https://trusted-domain.com</div><div id="bkmrk--2">  
</div><div id="bkmrk-2.-%E9%99%90%E5%88%B6%E5%87%AD%E8%AF%81%E7%9A%84%E8%B7%A8%E5%9F%9F%E4%BC%A0%E9%80%92">2. 限制凭证的跨域传递</div><div id="bkmrk--3">  
</div><div id="bkmrk-%C2%A0-%C2%A0-%E9%BB%98%E8%AE%A4%E6%83%85%E5%86%B5%E4%B8%8B%E7%A6%81%E7%94%A8%E5%87%AD%E8%AF%81%EF%BC%9A%E8%B7%A8%E6%BA%90%E8%AF%B7%E6%B1%82%E7%9A%84%E5%87%AD"> 默认情况下禁用凭证：跨源请求的凭证（如 cookies 和 HTTP 认证）通常不需要被传递。</div><div id="bkmrk-%C2%A0-%C2%A0-%E4%BB%85%E5%9C%A8%E5%BF%85%E8%A6%81%E6%97%B6%E5%90%AF%E7%94%A8%EF%BC%9A%E5%A6%82%E6%9E%9C%E5%BF%85%E9%A1%BB%E4%BD%BF%E7%94%A8%E5%87%AD%E8%AF%81"> 仅在必要时启用：如果必须使用凭证跨域，则需设置 Access-Control-Allow-Credentials: true，并且不能使用通配符：</div><div id="bkmrk--4">  
</div><div id="bkmrk-%C2%A0-%C2%A0-access-control-a-1"> Access-Control-Allow-Credentials: true</div><div id="bkmrk-%C2%A0-%C2%A0-access-control-a-2"> Access-Control-Allow-Origin: https://trusted-domain.com</div><div id="bkmrk--5">  
</div><div id="bkmrk-3.-%E9%99%90%E5%88%B6%E5%85%81%E8%AE%B8%E7%9A%84-http-%E6%96%B9%E6%B3%95">3. 限制允许的 HTTP 方法</div><div id="bkmrk--6">  
</div><div id="bkmrk-%C2%A0-%C2%A0-%E5%8F%AA%E5%85%81%E8%AE%B8%E5%BF%85%E8%A6%81%E7%9A%84-http-%E6%96%B9%E6%B3%95%EF%BC%8C%E9%81%BF"> 只允许必要的 HTTP 方法，避免暴露不必要的操作。例如：</div><div id="bkmrk--7">  
</div><div id="bkmrk-%C2%A0-%C2%A0-access-control-a-3"> Access-Control-Allow-Methods: GET, POST</div><div id="bkmrk--8">  
</div><div id="bkmrk-4.-%E9%99%90%E5%88%B6%E5%85%81%E8%AE%B8%E7%9A%84%E8%AF%B7%E6%B1%82%E5%A4%B4">4. 限制允许的请求头</div><div id="bkmrk--9">  
</div><div id="bkmrk-%C2%A0-%C2%A0-%E6%8E%A7%E5%88%B6%E5%AE%A2%E6%88%B7%E7%AB%AF%E5%8F%AF%E4%BB%A5%E5%8F%91%E9%80%81%E5%93%AA%E4%BA%9B%E8%87%AA%E5%AE%9A%E4%B9%89%E5%A4%B4%EF%BC%8C"> 控制客户端可以发送哪些自定义头，避免滥用。例如：</div><div id="bkmrk--10">  
</div><div id="bkmrk-%C2%A0-%C2%A0-access-control-a-4"> Access-Control-Allow-Headers: Content-Type, Authorization</div><div id="bkmrk--11">  
</div><div id="bkmrk-5.-%E8%AE%BE%E7%BD%AE%E9%A2%84%E6%A3%80%E8%AF%B7%E6%B1%82%E7%9A%84%E7%BC%93%E5%AD%98%E6%97%B6%E9%97%B4">5. 设置预检请求的缓存时间</div><div id="bkmrk--12">  
</div><div id="bkmrk-%C2%A0-%C2%A0-%E4%BD%BF%E7%94%A8-access-contro"> 使用 Access-Control-Max-Age 限制预检请求的缓存时间，避免长期缓存不安全的策略。例如：</div><div id="bkmrk--13">  
</div><div id="bkmrk-%C2%A0-%C2%A0-access-control-m"> Access-Control-Max-Age: 600</div><div id="bkmrk--14">  
</div><div id="bkmrk-6.-%E4%B8%A5%E6%A0%BC%E6%8E%A7%E5%88%B6%E8%B5%84%E6%BA%90%E7%9A%84%E8%B7%A8%E5%9F%9F%E8%AE%BF%E9%97%AE%E8%8C%83%E5%9B%B4">6. 严格控制资源的跨域访问范围</div><div id="bkmrk--15">  
</div><div id="bkmrk-%C2%A0-%C2%A0-%E5%AF%B9%E4%BA%8E%E6%95%8F%E6%84%9F%E8%B5%84%E6%BA%90%EF%BC%8C%E5%BA%94%E9%99%90%E5%88%B6-cors-"> 对于敏感资源，应限制 CORS 的使用，避免在未经验证的来源加载敏感数据。</div><div id="bkmrk--16">  
</div><div id="bkmrk-nginx-%E7%A4%BA%E4%BE%8B%E9%85%8D%E7%BD%AE">Nginx 示例配置</div><div id="bkmrk--17">  
</div><div id="bkmrk-%E4%BB%A5%E4%B8%8B%E6%98%AF-nginx-%E4%B8%AD%E7%9A%84%E5%AE%89%E5%85%A8-cors-">以下是 Nginx 中的安全 CORS 配置示例：</div><div id="bkmrk--18">  
</div><div id="bkmrk-server-%7B">server {</div><div id="bkmrk-%C2%A0-%C2%A0-listen-80%3B"> listen 80;</div><div id="bkmrk-%C2%A0-%C2%A0-server_name-api."> server_name api.example.com;</div><div id="bkmrk--19">  
</div><div id="bkmrk-%C2%A0-%C2%A0-location-%2Fapi%2F-%7B"> location /api/ {</div><div id="bkmrk-%C2%A0-%C2%A0-%C2%A0-%C2%A0-add_header-%27"> add_header 'Access-Control-Allow-Origin' 'https://trusted-domain.com';</div><div id="bkmrk-%C2%A0-%C2%A0-%C2%A0-%C2%A0-add_header-%27-1"> add_header 'Access-Control-Allow-Methods' 'GET, POST';</div><div id="bkmrk-%C2%A0-%C2%A0-%C2%A0-%C2%A0-add_header-%27-2"> add_header 'Access-Control-Allow-Headers' 'Content-Type, Authorization';</div><div id="bkmrk-%C2%A0-%C2%A0-%C2%A0-%C2%A0-add_header-%27-3"> add_header 'Access-Control-Allow-Credentials' 'true';</div><div id="bkmrk-%C2%A0-%C2%A0-%C2%A0-%C2%A0-add_header-%27-4"> add_header 'Access-Control-Max-Age' '600';</div><div id="bkmrk--20">  
</div><div id="bkmrk-%C2%A0-%C2%A0-%C2%A0-%C2%A0-if-%28%24request"> if ($request_method = 'OPTIONS') {</div><div id="bkmrk-%C2%A0-%C2%A0-%C2%A0-%C2%A0-%C2%A0-%C2%A0-return-2"> return 204;</div><div id="bkmrk-%C2%A0-%C2%A0-%C2%A0-%C2%A0-%7D"> }</div><div id="bkmrk--21">  
</div><div id="bkmrk-%C2%A0-%C2%A0-%C2%A0-%C2%A0-proxy_pass-h"> proxy_pass http://backend-server;</div><div id="bkmrk-%C2%A0-%C2%A0-%7D"> }</div><div id="bkmrk-%7D">}</div><div id="bkmrk--22">  
</div><div id="bkmrk-apache-%E7%A4%BA%E4%BE%8B%E9%85%8D%E7%BD%AE">Apache 示例配置</div><div id="bkmrk--23">  
</div><div id="bkmrk-%E4%BB%A5%E4%B8%8B%E6%98%AF-apache-%E4%B8%AD%E7%9A%84%E5%AE%89%E5%85%A8-cors">以下是 Apache 中的安全 CORS 配置示例：</div><div id="bkmrk--24">  
</div><div id="bkmrk-%3Cvirtualhost-%2A%3A80%3E">&lt;VirtualHost *:80&gt;</div><div id="bkmrk-%C2%A0-%C2%A0-servername-api.e"> ServerName api.example.com</div><div id="bkmrk--25">  
</div><div id="bkmrk-%C2%A0-%C2%A0-header-set-acces"> Header set Access-Control-Allow-Origin "https://trusted-domain.com"</div><div id="bkmrk-%C2%A0-%C2%A0-header-set-acces-1"> Header set Access-Control-Allow-Methods "GET, POST"</div><div id="bkmrk-%C2%A0-%C2%A0-header-set-acces-2"> Header set Access-Control-Allow-Headers "Content-Type, Authorization"</div><div id="bkmrk-%C2%A0-%C2%A0-header-set-acces-3"> Header set Access-Control-Allow-Credentials "true"</div><div id="bkmrk-%C2%A0-%C2%A0-header-set-acces-4"> Header set Access-Control-Max-Age "600"</div><div id="bkmrk--26">  
</div><div id="bkmrk-%C2%A0-%C2%A0-%3Clocation-%22%2Fapi%2F"> &lt;Location "/api/"&gt;</div><div id="bkmrk-%C2%A0-%C2%A0-%C2%A0-%C2%A0-%23-%E5%85%81%E8%AE%B8%E9%A2%84%E6%A3%80%E8%AF%B7%E6%B1%82%E8%BF%94%E5%9B%9E-2"> # 允许预检请求返回 204</div><div id="bkmrk-%C2%A0-%C2%A0-%C2%A0-%C2%A0-%3Cif-%22%25%7Breque"> &lt;If "%{REQUEST_METHOD} == 'OPTIONS'"&gt;</div><div id="bkmrk-%C2%A0-%C2%A0-%C2%A0-%C2%A0-%C2%A0-%C2%A0-header-a"> Header always set Content-Length "0"</div><div id="bkmrk-%C2%A0-%C2%A0-%C2%A0-%C2%A0-%C2%A0-%C2%A0-header-a-1"> Header always set Content-Type "text/plain"</div><div id="bkmrk-%C2%A0-%C2%A0-%C2%A0-%C2%A0-%C2%A0-%C2%A0-require-"> Require all granted</div><div id="bkmrk-%C2%A0-%C2%A0-%C2%A0-%C2%A0-%3C%2Fif%3E"> &lt;/If&gt;</div><div id="bkmrk-%C2%A0-%C2%A0-%3C%2Flocation%3E"> &lt;/Location&gt;</div><div id="bkmrk-%3C%2Fvirtualhost%3E">&lt;/VirtualHost&gt;</div><div id="bkmrk--27">  
</div><div id="bkmrk-%E5%90%8E%E7%AB%AF%E5%8A%A8%E6%80%81-cors-%E9%85%8D%E7%BD%AE%E7%A4%BA%E4%BE%8B">后端动态 CORS 配置示例</div><div id="bkmrk--28">  
</div><div id="bkmrk-%E5%9C%A8%E6%9F%90%E4%BA%9B%E6%83%85%E5%86%B5%E4%B8%8B%EF%BC%8C%E6%82%A8%E5%8F%AF%E8%83%BD%E9%9C%80%E8%A6%81%E5%8A%A8%E6%80%81%E7%A1%AE%E5%AE%9A%E5%85%81%E8%AE%B8%E7%9A%84%E5%9F%9F">在某些情况下，您可能需要动态确定允许的域名。以下是使用 Python Flask 实现的示例：</div><div id="bkmrk--29">  
</div><div id="bkmrk-from-flask-import-fl">from flask import Flask, request, jsonify</div><div id="bkmrk--30">  
</div><div id="bkmrk-app-%3D-flask%28__name__">app = Flask(__name__)</div><div id="bkmrk--31">  
</div><div id="bkmrk-allowed_origins-%3D-%5B%22">ALLOWED_ORIGINS = ["https://trusted-domain.com"]</div><div id="bkmrk--32">  
</div><div id="bkmrk-%40app.after_request">@app.after_request</div><div id="bkmrk-def-add_cors_headers">def add_cors_headers(response):</div><div id="bkmrk-%C2%A0-%C2%A0-origin-%3D-request"> origin = request.headers.get('Origin')</div><div id="bkmrk-%C2%A0-%C2%A0-if-origin-in-all"> if origin in ALLOWED_ORIGINS:</div><div id="bkmrk-%C2%A0-%C2%A0-%C2%A0-%C2%A0-response.hea"> response.headers['Access-Control-Allow-Origin'] = origin</div><div id="bkmrk-%C2%A0-%C2%A0-%C2%A0-%C2%A0-response.hea-1"> response.headers['Access-Control-Allow-Methods'] = 'GET, POST'</div><div id="bkmrk-%C2%A0-%C2%A0-%C2%A0-%C2%A0-response.hea-2"> response.headers['Access-Control-Allow-Headers'] = 'Content-Type, Authorization'</div><div id="bkmrk-%C2%A0-%C2%A0-%C2%A0-%C2%A0-response.hea-3"> response.headers['Access-Control-Allow-Credentials'] = 'true'</div><div id="bkmrk-%C2%A0-%C2%A0-return-response"> return response</div><div id="bkmrk--33">  
</div><div id="bkmrk-%40app.route%28%27%2Fapi%2Fdat">@app.route('/api/data', methods=['GET', 'POST'])</div><div id="bkmrk-def-api_data%28%29%3A">def api_data():</div><div id="bkmrk-%C2%A0-%C2%A0-return-jsonify%28%7B"> return jsonify({"message": "Hello, World!"})</div><div id="bkmrk--34">  
</div><div id="bkmrk-if-__name__-%3D%3D-%22__ma">if __name__ == "__main__":</div><div id="bkmrk-%C2%A0-%C2%A0-app.run%28%29"> app.run()</div><div id="bkmrk--35">  
</div><div id="bkmrk-%E9%A2%9D%E5%A4%96%E5%BB%BA%E8%AE%AE">额外建议</div><div id="bkmrk--36">  
</div><div id="bkmrk-%C2%A0-%C2%A0-%E5%AE%9A%E6%9C%9F%E5%AE%A1%E6%9F%A5%E5%92%8C%E6%9B%B4%E6%96%B0-cors-%E9%85%8D%E7%BD%AE%EF%BC%9A"> 定期审查和更新 CORS 配置：确保仅允许当前必要的域名、方法和请求头。</div><div id="bkmrk-%C2%A0-%C2%A0-%E5%90%AF%E7%94%A8-https%EF%BC%9A%E7%A1%AE%E4%BF%9D%E8%B7%A8%E5%9F%9F%E8%AE%BF%E9%97%AE%E6%97%B6"> 启用 HTTPS：确保跨域访问时数据在传输中被加密。</div><div id="bkmrk-%C2%A0-%C2%A0-%E7%BB%93%E5%90%88-csrf-%E9%98%B2%E6%8A%A4%EF%BC%9A%E5%AF%B9%E4%BA%8E%E8%B7%A8%E5%9F%9F%E8%AF%B7"> 结合 CSRF 防护：对于跨域请求中涉及用户认证的操作，结合 CSRF 令牌验证机制。</div><div id="bkmrk--37">  
</div><div id="bkmrk-%E9%80%9A%E8%BF%87%E4%BB%A5%E4%B8%8A%E6%8E%AA%E6%96%BD%EF%BC%8C%E5%8F%AF%E4%BB%A5%E6%9C%89%E6%95%88%E9%81%BF%E5%85%8D-cors-%E9%85%8D">通过以上措施，可以有效避免 CORS 配置不当带来的安全风险。</div>

# nginx-1.24.0升级到1.27.0

<div id="bkmrk-%E4%B8%8D%E9%9C%80%E8%A6%81%E5%8D%B8%E8%BD%BD-nginx-1.24.0%EF%BC%8C%E4%BD%A0">不需要卸载 nginx-1.24.0，你可以直接安装 nginx-1.27.0 并在需要时切换版本。但如果你希望移除旧版本以释放空间，可以选择手动删除 nginx-1.24.0。</div><div id="bkmrk-sudo-%2Fusr%2Flocal%2Fngin">sudo /usr/local/nginx-1.24.0/sbin/nginx -s stop</div><div id="bkmrk-">  
</div><div id="bkmrk-%E5%9C%A8-ubuntu-14.04-%E4%B8%8A%EF%BC%8C%E4%BD%A0%E5%8F%AF%E4%BB%A5">在 Ubuntu 14.04 上，你可以通过编译并以二进制方式安装 Nginx 1.27.0，同时指定安装路径并启用 SSL 模块。以下是具体步骤：</div><div id="bkmrk-1.-%E5%AE%89%E8%A3%85%E4%BE%9D%E8%B5%96">1. 安装依赖</div><div id="bkmrk--1">  
</div><div id="bkmrk-%E9%A6%96%E5%85%88%EF%BC%8C%E7%A1%AE%E4%BF%9D%E4%BD%A0%E7%9A%84%E7%B3%BB%E7%BB%9F%E5%B7%B2%E5%AE%89%E8%A3%85%E5%BF%85%E8%A6%81%E7%9A%84%E4%BE%9D%E8%B5%96%E9%A1%B9%EF%BC%9A">首先，确保你的系统已安装必要的依赖项：</div><div id="bkmrk--2">  
</div><div id="bkmrk-sudo-apt-get-update">sudo apt-get update</div><div id="bkmrk-sudo-apt-get-install">sudo apt-get install -y build-essential libpcre3 libpcre3-dev zlib1g zlib1g-dev</div><div id="bkmrk--3">  
</div><div id="bkmrk-2.-%E4%B8%8B%E8%BD%BD%E5%B9%B6%E8%A7%A3%E5%8E%8B-nginx-%E6%BA%90%E7%A0%81">2. 下载并解压 Nginx 源码</div><div id="bkmrk--4">  
</div><div id="bkmrk-cd-%2Fusr%2Flocal%2Fsrc">cd /usr/local/src</div><div id="bkmrk-wget-http%3A%2F%2Fnginx.or">wget http://nginx.org/download/nginx-1.27.0.tar.gz</div><div id="bkmrk-tar--zxvf-nginx-1.27">tar -zxvf nginx-1.27.0.tar.gz</div><div id="bkmrk-cd-nginx-1.27.0">cd nginx-1.27.0</div><div id="bkmrk--5">  
</div><div id="bkmrk-3.-%E9%85%8D%E7%BD%AE%E7%BC%96%E8%AF%91%E9%80%89%E9%A1%B9">3. 配置编译选项</div><div id="bkmrk--6">  
</div><div id="bkmrk-.%2Fconfigure---user%3Dw">./configure --user=www-data --group=www-data --with-http_ssl_module --with-http_stub_status_module --prefix=/usr/local/nginx-1.27.0 --with-openssl=/usr/local/openssl</div><div id="bkmrk--7">  
</div><div id="bkmrk-.%2Fconfigure---user%3Dw-1">./configure --user=www-data --group=www-data --with-http_stub_status_module --prefix=/usr/local/nginx-1.27.4</div><div id="bkmrk--8">  
</div><div id="bkmrk-.%2Fconfigure---prefix">./configure --prefix=/usr/local/nginx-1.27.0</div><div id="bkmrk--9">  
</div><div id="bkmrk-%E4%BD%BF%E7%94%A8-.%2Fconfigure-%E9%85%8D%E7%BD%AE%E7%BC%96%E8%AF%91%E9%80%89">使用 ./configure 配置编译选项，指定安装路径，并启用 SSL 支持：</div><div id="bkmrk--10">  
</div><div id="bkmrk-.%2Fconfigure-%5C">./configure \</div><div id="bkmrk---prefix%3D%2Fusr%2Flocal%2F">--prefix=/usr/local/nginx-1.27.0 \</div><div id="bkmrk---with-http_ssl_modu">--with-http_ssl_module \</div><div id="bkmrk---with-openssl%3D%2Fusr%2F">--with-openssl=/usr/local/openssl \</div><div id="bkmrk---with-pcre-%5C">--with-pcre \</div><div id="bkmrk---with-zlib%3D%2Fusr%2Finc">--with-zlib=/usr/include</div><div id="bkmrk--11">  
</div><div id="bkmrk-%F0%9F%93%8C-%E8%AF%B4%E6%98%8E%EF%BC%9A">📌 说明：</div><div id="bkmrk--12">  
</div><div id="bkmrk-%C2%A0-%C2%A0---prefix%3D%2Fusr%2Flo"> --prefix=/usr/local/nginx-1.27.0：指定安装路径</div><div id="bkmrk-%C2%A0-%C2%A0---with-http_ssl_"> --with-http_ssl_module：启用 SSL 支持</div><div id="bkmrk-%C2%A0-%C2%A0---with-openssl%3D%2F"> --with-openssl=/usr/local/openssl：指定 OpenSSL 源码路径</div><div id="bkmrk-%C2%A0-%C2%A0---with-pcre%EF%BC%9A%E6%94%AF%E6%8C%81%E6%AD%A3%E5%88%99"> --with-pcre：支持正则表达式匹配（推荐开启）</div><div id="bkmrk-%C2%A0-%C2%A0---with-zlib%3D%2Fusr"> --with-zlib=/usr/include：指定 zlib 以支持 gzip</div><div id="bkmrk--13">  
</div><div id="bkmrk-4.-%E7%BC%96%E8%AF%91%E5%92%8C%E5%AE%89%E8%A3%85%C2%A0-vim-auto%2Fl">4. 编译和安装 vim auto/lib/openssl/conf</div><div id="bkmrk--14">  
</div><div id="bkmrk-make--j-8">make -j 8</div><div id="bkmrk-make--j%24%28nproc%29">make -j$(nproc)</div><div id="bkmrk-sudo-make-install">sudo make install</div><div id="bkmrk--15">  
</div><div id="bkmrk-mkdir--p-%2Fusr%2Flocal%2F">mkdir -p /usr/local/nginx-1.27.4/conf/conf.d</div><div id="bkmrk-vi-%2Fusr%2Flocal%2Fnginx-">vi /usr/local/nginx-1.27.4/conf/nginx.conf</div><div id="bkmrk-%E6%89%BE%E5%88%B0-http-%7B-%E4%BB%A3%E7%A0%81%E5%9D%97%EF%BC%8C%E5%9C%A8%E5%85%B6%E5%86%85%E9%83%A8%E6%B7%BB%E5%8A%A0">找到 http { 代码块，在其内部添加：</div><div id="bkmrk--16">  
</div><div id="bkmrk-http-%7B">http {</div><div id="bkmrk-%C2%A0-%C2%A0-include%C2%A0-%C2%A0-%C2%A0-%C2%A0mi"> include mime.types;</div><div id="bkmrk-%C2%A0-%C2%A0-default_type%C2%A0-ap"> default_type application/octet-stream;</div><div id="bkmrk--17">  
</div><div id="bkmrk-%C2%A0-%C2%A0-%23-%E6%B7%BB%E5%8A%A0%E8%BF%99%E8%A1%8C%EF%BC%8C%E4%BD%BF-nginx-%E5%8A%A0"> # 添加这行，使 nginx 加载 conf.d/ 目录下的所有 .conf 文件</div><div id="bkmrk-%C2%A0-%C2%A0-include-%2Fusr%2Floc"> include /usr/local/nginx-1.27.0/conf/conf.d/*.conf;</div><div id="bkmrk--18">  
</div><div id="bkmrk-%F0%9F%93%8C--j%24%28nproc%29-%E8%AE%A9%E7%BC%96%E8%AF%91%E8%BF%87%E7%A8%8B%E5%88%A9%E7%94%A8">📌 -j$(nproc) 让编译过程利用所有可用 CPU 线程，加快编译速度。</div><div id="bkmrk--19">  
</div><div id="bkmrk-%C2%A018%C2%A0-%C2%A0-%C2%A0access_log%C2%A0-"> 18 access_log logs/light-access.log main;</div><div id="bkmrk-%C2%A019%C2%A0-%C2%A0-%C2%A0error_log%C2%A0-%C2%A0"> 19 error_log logs/light-error.log warn;</div><div id="bkmrk--20">  
</div><div id="bkmrk-5.-%E9%AA%8C%E8%AF%81%E5%AE%89%E8%A3%85">5. 验证安装</div><div id="bkmrk--21">  
</div><div id="bkmrk-%E6%A3%80%E6%9F%A5-nginx-%E6%98%AF%E5%90%A6%E5%AE%89%E8%A3%85%E6%88%90%E5%8A%9F%EF%BC%9A">检查 Nginx 是否安装成功：</div><div id="bkmrk--22">  
</div><div id="bkmrk-%2Fusr%2Flocal%2Fnginx-1.2">/usr/local/nginx-1.27.4/sbin/nginx -V</div><div id="bkmrk--23">  
</div><div id="bkmrk-%E5%BA%94%E8%AF%A5%E5%8F%AF%E4%BB%A5%E7%9C%8B%E5%88%B0---with-http_s">应该可以看到 --with-http_ssl_module 选项。</div><div id="bkmrk-6.-%E9%85%8D%E7%BD%AE-nginx-%E4%BD%BF%E7%94%A8%E6%96%B0%E7%89%88%E6%9C%AC">6. 配置 Nginx 使用新版本</div><div id="bkmrk--24">  
</div><div id="bkmrk-%C2%A0-%C2%A0-%E5%81%9C%E6%AD%A2%E6%97%A7%E7%89%88%E6%9C%AC-nginx"> 停止旧版本 Nginx</div><div id="bkmrk--25">  
</div><div id="bkmrk-sudo-%2Fusr%2Flocal%2Fngin-1">sudo /usr/local/nginx-1.27.0/sbin/nginx -s stop</div><div id="bkmrk--26">  
</div><div id="bkmrk-%E5%90%AF%E5%8A%A8%E6%96%B0%E7%89%88%E6%9C%AC-nginx">启动新版本 Nginx</div><div id="bkmrk--27">  
</div><div id="bkmrk-sudo-%2Fusr%2Flocal%2Fngin-2">sudo /usr/local/nginx-1.27.4/sbin/nginx</div><div id="bkmrk--28">  
</div><div id="bkmrk-%E6%A3%80%E6%9F%A5%E6%98%AF%E5%90%A6%E6%AD%A3%E5%B8%B8%E8%BF%90%E8%A1%8C">检查是否正常运行</div><div id="bkmrk--29">  
</div><div id="bkmrk-%C2%A0-%C2%A0-ps-aux-%7C-grep-ng"> ps aux | grep nginx</div><div id="bkmrk-%C2%A0-%C2%A0-netstat--tulnp-%7C"> netstat -tulnp | grep nginx</div><div id="bkmrk--30">  
</div><div id="bkmrk-7.-%E9%85%8D%E7%BD%AE-ssl%EF%BC%88%E5%8F%AF%E9%80%89%EF%BC%89">7. 配置 SSL（可选）</div><div id="bkmrk--31">  
</div><div id="bkmrk-%E5%A6%82%E6%9E%9C%E4%BD%A0%E6%9C%89-ssl-%E8%AF%81%E4%B9%A6%EF%BC%8C%E5%8F%AF%E4%BB%A5%E4%BF%AE%E6%94%B9-%2Fus">如果你有 SSL 证书，可以修改 /usr/local/nginx-1.27.0/conf/nginx.conf：</div><div id="bkmrk--32">  
</div><div id="bkmrk-server-%7B">server {</div><div id="bkmrk-%C2%A0-%C2%A0-listen-443-ssl%3B"> listen 443 ssl;</div><div id="bkmrk-%C2%A0-%C2%A0-server_name-your"> server_name yourdomain.com;</div><div id="bkmrk--33">  
</div><div id="bkmrk-%C2%A0-%C2%A0-ssl_certificate-"> ssl_certificate /etc/nginx/ssl/your_cert.pem;</div><div id="bkmrk-%C2%A0-%C2%A0-ssl_certificate_"> ssl_certificate_key /etc/nginx/ssl/your_key.pem;</div><div id="bkmrk--34">  
</div><div id="bkmrk-%C2%A0-%C2%A0-location-%2F-%7B"> location / {</div><div id="bkmrk-%C2%A0-%C2%A0-%C2%A0-%C2%A0-root-%2Fvar%2Fww"> root /var/www/html;</div><div id="bkmrk-%C2%A0-%C2%A0-%C2%A0-%C2%A0-index-index."> index index.html index.htm;</div><div id="bkmrk-%C2%A0-%C2%A0-%7D"> }</div><div id="bkmrk-%7D">}</div><div id="bkmrk--35">  
</div><div id="bkmrk-%E7%84%B6%E5%90%8E-%E9%87%8D%E5%90%AF-nginx%EF%BC%9A">然后 重启 Nginx：</div><div id="bkmrk--36">  
</div><div id="bkmrk-sudo-%2Fusr%2Flocal%2Fngin-3">sudo /usr/local/nginx-1.27.4/sbin/nginx -s reload</div><div id="bkmrk--37">  
</div><div id="bkmrk-%E8%BF%99%E6%A0%B7%EF%BC%8C%E4%BD%A0%E5%B0%B1%E5%AE%8C%E6%88%90%E4%BA%86-nginx-1.27.">这样，你就完成了 Nginx 1.27.4 的二进制安装，并启用了 SSL 支持。</div><div id="bkmrk--38">  
</div><div id="bkmrk-%E5%A6%82%E6%9E%9C%E6%9C%89%E4%BB%BB%E4%BD%95%E9%97%AE%E9%A2%98%EF%BC%8C%E5%8F%AF%E4%BB%A5%E6%9F%A5%E7%9C%8B%E6%97%A5%E5%BF%97%EF%BC%9A">如果有任何问题，可以查看日志：</div><div id="bkmrk--39">  
</div><div id="bkmrk-cat-%2Fusr%2Flocal%2Fnginx">cat /usr/local/nginx-1.27.4/logs/error.log</div><div id="bkmrk--40"></div><div id="bkmrk-%E5%A6%82%E4%BD%95%E5%9C%A8%E4%B8%A4%E4%B8%AA%E7%89%88%E6%9C%AC%E4%B9%8B%E9%97%B4%E5%88%87%E6%8D%A2">如何在两个版本之间切换</div><div id="bkmrk--41">  
</div><div id="bkmrk-%E5%A6%82%E6%9E%9C%E4%BD%A0%E5%90%8C%E6%97%B6%E4%BF%9D%E7%95%99-nginx-1.24.0">如果你同时保留 nginx-1.24.0 和 nginx-1.27.0，可以用软链接快速切换：</div><div id="bkmrk--42">  
</div><div id="bkmrk-sudo-ln--sf-%2Fusr%2Floc">sudo ln -sf /usr/local/nginx-1.27.0/sbin/nginx /usr/local/bin/nginx</div><div id="bkmrk-ln--sf-%2Fusr%2Flocal%2Fng">ln -sf /usr/local/nginx-1.27.4/sbin/nginx /usr/sbin/nginx</div><div id="bkmrk--43">  
</div><div id="bkmrk-%E8%BF%99%E6%A0%B7%E4%BD%A0%E5%B0%B1%E5%8F%AF%E4%BB%A5%E7%94%A8-nginx-%E5%91%BD%E4%BB%A4%E7%9B%B4%E6%8E%A5%E8%BF%90%E8%A1%8C">这样你就可以用 nginx 命令直接运行最新版本。</div><div id="bkmrk--44">  
</div><div id="bkmrk-%E5%A6%82%E6%9E%9C%E9%9C%80%E8%A6%81%E5%88%87%E6%8D%A2%E5%9B%9E-nginx-1.24.0">如果需要切换回 nginx-1.24.0：</div><div id="bkmrk--45">  
</div><div id="bkmrk-sudo-ln--sf-%2Fusr%2Floc-1">sudo ln -sf /usr/local/nginx-1.24.0/sbin/nginx /usr/local/bin/nginx</div>

# 部署wazuh实现对多台 Ubuntu 主机进行集中监控

对多台 Ubuntu 主机（例如 Ubuntu 18.04）进行集中监控，同时实现 \*\*主机入侵检测（HIDS）\*\* 和 \*\*行为监控\*\*，以下是一个轻量级、实用的集中监控方案，适用于中小型企业：

\### ✅ 方案目标

\* 实现主机入侵检测（Host-based IDS）  
\* 实现进程、登录、系统变更等行为监控  
\* 支持集中化日志采集与统一展示  
\* 成本低、依赖少，易于部署和维护

\## 🧩 架构组件

| 角色 | 工具 | 说明 |  
| ------------------- | ------------------------------------------------- | ---------------------------- |  
| Agent（每台 Ubuntu 主机） | \[Wazuh Agent\](https://documentation.wazuh.com) | 实时监控主机安全事件（文件完整性、登录、root提权等） |  
| 集中服务器 | Wazuh Manager + Filebeat + Elasticsearch + Kibana | 管理所有 Agent 数据，并提供可视化界面 |  
| 日志转发 | Filebeat | 将日志高效传输至 Elasticsearch |  
| 可选轻量级替代 | \[OSSEC\](https://www.ossec.net/) + Graylog | 更轻的方案，但功能相对简单 |

\---

\## 🛠️ 部署简要步骤

\### 1. 安装 Wazuh Server（集中监控端）

部署在一台专用 Ubuntu 主机（建议 ≥4C/8G）

cp /etc/apt/sources.list /etc/apt/sources.list.bak

cat &gt; /etc/apt/sources.list &lt;&lt; EOF  
deb https://mirrors.aliyun.com/ubuntu/ bionic main restricted universe multiverse  
deb-src https://mirrors.aliyun.com/ubuntu/ bionic main restricted universe multiverse  
deb https://mirrors.aliyun.com/ubuntu/ bionic-security main restricted universe multiverse  
deb-src https://mirrors.aliyun.com/ubuntu/ bionic-security main restricted universe multiverse  
deb https://mirrors.aliyun.com/ubuntu/ bionic-updates main restricted universe multiverse  
deb-src https://mirrors.aliyun.com/ubuntu/ bionic-updates main restricted universe multiverse  
deb https://mirrors.aliyun.com/ubuntu/ bionic-backports main restricted universe multiverse  
deb-src https://mirrors.aliyun.com/ubuntu/ bionic-backports main restricted universe multiverse  
EOF

apt update &amp;&amp; apt upgrade -y

ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime &amp;&amp;\\  
apt-get install ntpdate -y &amp;&amp;\\  
if ! crontab -l | grep "ntpdate" &amp;&gt;/dev/null; then  
 (echo "\*/5 \* \* \* \* /usr/sbin/ntpdate ntp.aliyun.com &gt;/dev/null 2&gt;&amp;1"; crontab -l) | crontab  
fi

linux系统通过代理上网  
vi ~/.bashrc  
在文件末尾添加以下内容  
cat &gt;&gt; ~/.bashrc &lt;&lt; EOF  
export http\_proxy="http://192.168.8.5:1080"  
export https\_proxy="http://192.168.8.5:1080"  
export ftp\_proxy="http://192.168.8.5:1080"  
export no\_proxy="localhost,127.0.0.1,::1"  
EOF  
保存关闭  
source ~/.bashrc  
sudo vi /etc/apt/apt.conf.d/95proxies  
添加以下内容：  
Acquire::http::Proxy "http://192.168.8.5:1080";  
Acquire::https::Proxy "http://192.168.8.5:1080";  
Acquire::ftp::Proxy "http://192.168.8.5:1080";

  
在系统级别配置代理，以便所有应用程序都使用代理服务器  
sudo vi /etc/environment  
http\_proxy="http://192.168.8.5:1080"  
https\_proxy="http://192.168.8.5:1080"  
ftp\_proxy="http://192.168.8.5:1080"  
no\_proxy="localhost,127.0.0.1,::1"  
保存关闭  
sudo reboot

http\_proxy="http://10.2.2.24:1080"  
https\_proxy="http://10.2.2.24:1080"  
ftp\_proxy="http://10.2.2.24:1080"  
no\_proxy="localhost,127.0.0.1,::1"

如果你还需要Docker通过代理上网，可以通过以下步骤配置Docker代理。  
创建Docker的systemd目录（如果不存在）：  
sudo mkdir -p /etc/systemd/system/docker.service.d  
sudo vi /etc/systemd/system/docker.service.d/http-proxy.conf  
添加以下内容：  
\[Service\]  
Environment="HTTP\_PROXY=http://192.168.8.5:1080"  
Environment="HTTPS\_PROXY=http://192.168.8.5:1080"  
Environment="NO\_PROXY=localhost,127.0.0.1,::1"  
保存关闭  
sudo systemctl daemon-reload  
sudo systemctl restart docker

  
curl -sO https://packages.wazuh.com/4.12/wazuh-install.sh &amp;&amp; sudo bash ./wazuh-install.sh -a

  
在 Wazuh 4.x（包括你安装的 4.12.0）中，`admin` 是一个系统保留账户，不允许通过 Web 界面或 API 直接重设密码。

  
\## ✅ 正确的解决方法：

\### 🛠 方法一：在命令行重置 `admin` 密码

你可以在 \*\*Wazuh Dashboard 所在的主机上\*\*运行以下命令来重置密码：

```bash  
/usr/share/wazuh-indexer/plugins/opensearch-security/tools/wazuh-passwords-tool.s reset-admin  
```

这将：

\* 生成一个新密码  
\* 输出密码（请记得保存）

\### 🛠 方法二：手动设置密码（推荐）

```bash  
/usr/share/wazuh-indexer/plugins/opensearch-security/tools/wazuh-passwords-tool.sh --user admin --password 新密码  
```

例如：

/usr/share/wazuh-indexer/plugins/opensearch-security/tools/wazuh-passwords-tool.sh --user admin --password Heli@147369.

  
执行后会看到提示密码修改成功。

  
\## ✅ 修改后重启 Wazuh Dashboard（可选）

如果你登录仍有问题，可重启 Dashboard 服务：

systemctl restart wazuh-dashboard

安装agent

官方方法：在ubuntu20.04 18.04 14.04上测试通过

wget https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent\_4.12.0-1\_amd64.deb &amp;&amp; sudo WAZUH\_MANAGER='10.2.2.16' WAZUH\_AGENT\_NAME='ubuntu20.04-2.18' dpkg -i ./wazuh-agent\_4.12.0-1\_amd64.deb

10.2.2.16 替换为 wazuh server端ip地址

ubuntu20.04-2.18 替换为该agent的名称

  
sudo systemctl daemon-reload &amp;&amp;\\  
sudo systemctl enable wazuh-agent &amp;&amp;\\  
sudo systemctl start wazuh-agent

其他方法，在ubuntu14.04上测试通过  
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import &amp;&amp; chmod 644 /usr/share/keyrings/wazuh.gpg  
echo "deb \[signed-by=/usr/share/keyrings/wazuh.gpg\] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list  
apt-get update  
apt-get install gnupg apt-transport-https  
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | apt-key add -  
echo "deb https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list  
WAZUH\_MANAGER="192.168.30.49" apt-get install wazuh-agent

ubuntu安装客户端  
service wazuh-agent start

service wazuh-agent status  
wazuh-modulesd is running...  
wazuh-logcollector is running...  
wazuh-syscheckd is running...  
wazuh-agentd is running...  
wazuh-execd is running...

卸载方法：  
1\. 停止 agent 服务（可选但推荐）：

sudo systemctl stop wazuh-agent

2\. 卸载 wazuh-agent：

sudo apt-get remove --purge wazuh-agent -y

3\. 删除相关配置文件（可选，如果你想彻底清除）：

sudo rm -rf /var/ossec  
sudo rm -rf /etc/ossec-init.conf  
sudo rm -rf /etc/systemd/system/wazuh-agent.service

4\. 更新 systemd（可选）：

sudo systemctl daemon-reload

\## ✅ 修改 agent 名称的正确方式

Wazuh agent 的名称保存在配置文件中，你可以按以下步骤修改：

\### 1. 停止 agent 服务

```bash  
sudo systemctl stop wazuh-agent  
```

\### 2. 修改配置文件 `/var/ossec/etc/ossec.conf`

找到如下配置段落（大约在前几十行）：

```xml  
&lt;client&gt;  
 &lt;name&gt;ubuntu14.04-2.14&lt;/name&gt;  
 &lt;server-ip&gt;10.2.2.16&lt;/server-ip&gt;  
&lt;/client&gt;  
```

将 `&lt;name&gt;` 修改为你想要的新名称，例如：

```xml  
&lt;client&gt;  
 &lt;name&gt;ubuntu14.04-new&lt;/name&gt;  
 &lt;server-ip&gt;10.2.2.16&lt;/server-ip&gt;  
&lt;/client&gt;  
```

保存退出。

\---

\### 3. 删除旧的 `client.keys` 条目（可选，若你在 manager 上要重配）

登录 Wazuh Manager，然后运行：

```bash  
/var/ossec/bin/manage\_agents  
```

选择：

\* `R` 删除旧名称对应的 agent  
\* `A` 添加新名称  
\* `E` 保存并分发 key，得到以下这串字符

MDA0IHVidW50dTE0LjA0LWNjaW90LTIuMTQgMTAuMi4yLjE0IDEwMjJiY2U2N2ViNGY2MmYzMTAzZGZjNTFlZWMzYzBhNjE1ZjI1ZGNmNzU4ZGRlNjRiMmZjMmY3MWMxMGI1ZWM=

到 agent 端运行：

/var/ossec/bin/manage\_agents

选 I ，粘贴key 上面那串字符

\### 4. 重启 agent 服务

```bash  
sudo systemctl start wazuh-agent  
```

\---

\### ✅ 验证新名称是否生效

查看 agent 日志：

```bash  
sudo tail -f /var/ossec/logs/ossec.log  
```

你应该能看到类似如下内容：

```  
ossec-agent: INFO: Using agent name as configured: 'ubuntu14.04-new'  
```

在 Wazuh Manager UI 中刷新 agent 列表，也应能看到新名称。

# 一键可视化Nginx日志

兄弟们有没有遇到过这种情况？网站突然卡顿，翻遍服务器日志却找不到头绪；想知道哪些 接口被频繁调用，却对着密密麻麻的文本文件抓瞎。今天二冰给大家带来一个开箱即用的运 维神器——用Docker三分钟搭建Nginx Proxy Manager日志可视化平台！

## <span class="" style="-webkit-tap-highlight-color: transparent; padding: 0px 0px 0px 10px; outline: 0px; max-width: 100%; box-sizing: border-box; overflow-wrap: break-word !important; font-family: STHeitiSC-Light; font-size: 18px; font-weight: bolder; display: inline-block; border-left: 5px solid #F83929; visibility: visible;">项目简介：GoAccess for Nginx Proxy Manager</span>

项目地址：https://github.com/xavier-hernandez/goaccess-for-nginxproxymanager

这个基于GoAccess的专用镜像，完美适配Nginx Proxy Manager的日志格式。无需研究复杂 的命令行参数，挂载日志目录就能生成酷炫的实时监控面板，流量统计、访问排行、异常请 求一目了然。

<figure id="bkmrk--1" style="-webkit-tap-highlight-color: transparent; margin: 10px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; color: rgba(0, 0, 0, 0.9); font-family: 'PingFang SC', system-ui, -apple-system, BlinkMacSystemFont, 'Helvetica Neue', 'Hiragino Sans GB', 'Microsoft YaHei UI', 'Microsoft YaHei', Arial, sans-serif; font-size: 17px; letter-spacing: 0.544px; text-align: justify; text-wrap: wrap; background-color: rgb(255, 255, 255); visibility: visible; overflow-wrap: break-word !important;">![1.webp](https://www.lesrec.cn/static/upload/image/20250702/1751449041719104.webp)<figcaption style="-webkit-tap-highlight-color: transparent; margin: 5px 0px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; text-align: center; color: rgb(136, 136, 136); font-size: 12px; font-family: PingFangSC-Light; overflow-wrap: break-word !important;"></figcaption></figure>## <span class="" style="-webkit-tap-highlight-color: transparent; padding: 0px 0px 0px 10px; outline: 0px; max-width: 100%; box-sizing: border-box; overflow-wrap: break-word !important; font-family: STHeitiSC-Light; font-size: 18px; font-weight: bolder; display: inline-block; border-left: 5px solid #F83929;">四大核心优势</span>

<section class="" id="bkmrk-1.%E9%9B%B6%E9%85%8D%E7%BD%AE%E5%BC%80%E7%AE%B1%E5%8D%B3%E7%94%A8%EF%BC%9A%E4%B8%93%E4%B8%BAnginx-pr" style="-webkit-tap-highlight-color: transparent; margin: 8px 0px; padding: 0px 0px 0px 25px; outline: 0px; max-width: 100%; box-sizing: border-box; font-family: 'PingFang SC', system-ui, -apple-system, BlinkMacSystemFont, 'Helvetica Neue', 'Hiragino Sans GB', 'Microsoft YaHei UI', 'Microsoft YaHei', Arial, sans-serif; font-size: 17px; letter-spacing: 0.544px; text-align: justify; text-wrap: wrap; background-color: rgb(255, 255, 255); overflow-wrap: break-word !important;"><span class="" style="-webkit-tap-highlight-color: transparent; margin: 5px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; line-height: 26px; text-align: left; color: #010101; display: block; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px 6px 0px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; overflow-wrap: break-word !important;">1.</span>**零配置开箱即用**：专为Nginx Proxy Manager优化，自动解析日志格式</span><span class="" style="-webkit-tap-highlight-color: transparent; margin: 5px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; line-height: 26px; text-align: left; color: #010101; display: block; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px 6px 0px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; overflow-wrap: break-word !important;">2.</span>**实时动态刷新**：每秒更新数据，流量波动尽在掌握</span><span class="" style="-webkit-tap-highlight-color: transparent; margin: 5px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; line-height: 26px; text-align: left; color: #010101; display: block; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px 6px 0px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; overflow-wrap: break-word !important;">3.</span>**中文友好界面**：自带中文语言包，统计指标清晰易懂</span><span class="" style="-webkit-tap-highlight-color: transparent; margin: 5px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; line-height: 26px; text-align: left; color: #010101; display: block; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px 6px 0px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; overflow-wrap: break-word !important;">4.</span>**Docker极简部署**：一条命令完成安装，支持群晖等NAS设备</span></section>## <span class="" style="-webkit-tap-highlight-color: transparent; padding: 0px 0px 0px 10px; outline: 0px; max-width: 100%; box-sizing: border-box; overflow-wrap: break-word !important; font-family: STHeitiSC-Light; font-size: 18px; font-weight: bolder; display: inline-block; border-left: 5px solid #F83929;">手把手Dockge部署教程</span>

### <span class="" style="-webkit-tap-highlight-color: transparent; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; overflow-wrap: break-word !important; font-size: 14px; color: #a5d55d;">第一步：准备compose.yaml</span>

<section class="code-snippet__fix code-snippet__js" id="bkmrk-version%3A%C2%A0%223%22%C2%A0service" style="-webkit-tap-highlight-color: transparent; margin: 10px 0px; padding: 0px; outline: 0px; max-width: 1000%; box-sizing: border-box; overflow-wrap: break-word; color: rgb(51, 51, 51); position: relative; background-color: rgba(0, 0, 0, 0.03); border: 1px solid rgb(240, 240, 240); border-radius: 2px; display: flex; line-height: 20px; font-family: 'PingFang SC', system-ui, -apple-system, BlinkMacSystemFont, 'Helvetica Neue', 'Hiragino Sans GB', 'Microsoft YaHei UI', 'Microsoft YaHei', Arial, sans-serif; letter-spacing: 0.544px; text-align: justify; text-wrap: wrap;">```
version: "3" services: goaccess: image: xavierh/goaccess-for-nginxproxymanager:latest container_name: goaccess restart: unless-stopped ports: - "7880:7880" volumes: - /你的日志目录:/opt/log # 例如/volume1/docker/npm/data/logs environment: - TZ=Asia/Shanghai -.UTF-8 - LANGUAGE=zh_CN.UTF-8 - SKIP_ARCHIVED_LOGS=False - EXCLUDE_IPS=127.0.0.1
```

</section>### <span class="" style="-webkit-tap-highlight-color: transparent; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; overflow-wrap: break-word !important; font-size: 14px; color: #a5d55d;">第二步：Dockge一键部署</span>

打开`Dockge`面板 -&gt; `创建堆栈` -&gt; 设置`堆栈`名称 -&gt; 粘贴`compose`代码 -&gt; 30 秒`启动`成功！

<figure id="bkmrk--8" style="-webkit-tap-highlight-color: transparent; margin: 10px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; color: rgba(0, 0, 0, 0.9); font-family: 'PingFang SC', system-ui, -apple-system, BlinkMacSystemFont, 'Helvetica Neue', 'Hiragino Sans GB', 'Microsoft YaHei UI', 'Microsoft YaHei', Arial, sans-serif; font-size: 17px; letter-spacing: 0.544px; text-align: justify; text-wrap: wrap; background-color: rgb(255, 255, 255); overflow-wrap: break-word !important;">![2.webp](https://www.lesrec.cn/static/upload/image/20250702/1751449065459206.webp)<figcaption style="-webkit-tap-highlight-color: transparent; margin: 5px 0px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; text-align: center; color: rgb(136, 136, 136); font-size: 12px; font-family: PingFangSC-Light; overflow-wrap: break-word !important;"></figcaption></figure>## <span class="" style="-webkit-tap-highlight-color: transparent; padding: 0px 0px 0px 10px; outline: 0px; max-width: 100%; box-sizing: border-box; overflow-wrap: break-word !important; font-family: STHeitiSC-Light; font-size: 18px; font-weight: bolder; display: inline-block; border-left: 5px solid #F83929;">使用效果全展示</span>

访问 `http://你的服务器IP:7880` 即可看到：

<section class="" id="bkmrk-1.%E5%AE%9E%E6%97%B6%E6%B5%81%E9%87%8F%E7%9C%8B%E6%9D%BF%EF%BC%9A%E6%AF%8F%E7%A7%92%E8%AF%B7%E6%B1%82%E6%95%B0%E3%80%81%E5%B8%A6%E5%AE%BD%E5%8D%A0%E7%94%A8%E8%B6%8B" style="-webkit-tap-highlight-color: transparent; margin: 8px 0px; padding: 0px 0px 0px 25px; outline: 0px; max-width: 100%; box-sizing: border-box; font-family: 'PingFang SC', system-ui, -apple-system, BlinkMacSystemFont, 'Helvetica Neue', 'Hiragino Sans GB', 'Microsoft YaHei UI', 'Microsoft YaHei', Arial, sans-serif; font-size: 17px; letter-spacing: 0.544px; text-align: justify; text-wrap: wrap; background-color: rgb(255, 255, 255); overflow-wrap: break-word !important;"><span class="" style="-webkit-tap-highlight-color: transparent; margin: 5px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; line-height: 26px; text-align: left; color: #010101; display: block; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px 6px 0px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; overflow-wrap: break-word !important;">1.</span>**实时流量看板**：每秒请求数、带宽占用趋势图</span><span class="" style="-webkit-tap-highlight-color: transparent; margin: 5px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; line-height: 26px; text-align: left; color: #010101; display: block; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px 6px 0px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; overflow-wrap: break-word !important;">2.</span>**热门访问排行**：最常访问的URL、客户端IP排行</span><span class="" style="-webkit-tap-highlight-color: transparent; margin: 5px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; line-height: 26px; text-align: left; color: #010101; display: block; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px 6px 0px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; overflow-wrap: break-word !important;">3.</span>**异常请求监控**：4xx/5xx错误请求自动标红</span><span class="" style="-webkit-tap-highlight-color: transparent; margin: 5px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; line-height: 26px; text-align: left; color: #010101; display: block; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px 6px 0px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; overflow-wrap: break-word !important;">4.</span>**设备类型分析**：移动端/PC端占比一目了然</span></section><figure id="bkmrk-image-34%3A-%E5%9C%A8%E8%BF%99%E9%87%8C%E6%8F%92%E5%85%A5%E5%9B%BE%E7%89%87%E6%8F%8F%E8%BF%B0" style="-webkit-tap-highlight-color: transparent; margin: 10px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; color: rgba(0, 0, 0, 0.9); font-family: 'PingFang SC', system-ui, -apple-system, BlinkMacSystemFont, 'Helvetica Neue', 'Hiragino Sans GB', 'Microsoft YaHei UI', 'Microsoft YaHei', Arial, sans-serif; font-size: 17px; letter-spacing: 0.544px; text-align: justify; text-wrap: wrap; background-color: rgb(255, 255, 255); overflow-wrap: break-word !important;"><figcaption style="-webkit-tap-highlight-color: transparent; margin: 5px 0px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; text-align: center; color: rgb(136, 136, 136); font-size: 12px; font-family: PingFangSC-Light; overflow-wrap: break-word !important;">![3.webp](https://www.lesrec.cn/static/upload/image/20250702/1751449073321417.webp)Image 34: 在这里插入图片描述</figcaption></figure>## <span class="" style="-webkit-tap-highlight-color: transparent; padding: 0px 0px 0px 10px; outline: 0px; max-width: 100%; box-sizing: border-box; overflow-wrap: break-word !important; font-family: STHeitiSC-Light; font-size: 18px; font-weight: bolder; display: inline-block; border-left: 5px solid #F83929;">二冰实测总结</span>

**推荐指数**：★★★★☆

**适合人群**：

<section class="" id="bkmrk-%E2%80%A2%E4%BD%BF%E7%94%A8nginx-proxy-manag" style="-webkit-tap-highlight-color: transparent; margin: 8px 0px; padding: 0px 0px 0px 25px; outline: 0px; max-width: 100%; box-sizing: border-box; font-family: 'PingFang SC', system-ui, -apple-system, BlinkMacSystemFont, 'Helvetica Neue', 'Hiragino Sans GB', 'Microsoft YaHei UI', 'Microsoft YaHei', Arial, sans-serif; font-size: 17px; letter-spacing: 0.544px; text-align: justify; text-wrap: wrap; background-color: rgb(255, 255, 255); overflow-wrap: break-word !important;"><span class="" style="-webkit-tap-highlight-color: transparent; margin: 5px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; line-height: 26px; text-align: left; color: #010101; display: block; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px 6px 0px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; overflow-wrap: break-word !important;">•</span>使用Nginx Proxy Manager的运维人员</span><span class="" style="-webkit-tap-highlight-color: transparent; margin: 5px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; line-height: 26px; text-align: left; color: #010101; display: block; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px 6px 0px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; overflow-wrap: break-word !important;">•</span>需要监控多站点流量的站长</span><span class="" style="-webkit-tap-highlight-color: transparent; margin: 5px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; line-height: 26px; text-align: left; color: #010101; display: block; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px 6px 0px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; overflow-wrap: break-word !important;">•</span>想快速定位接口性能瓶颈的开发者</span></section>**注意事项**：

<section class="" id="bkmrk-1.%E6%97%A5%E5%BF%97%E7%9B%AE%E5%BD%95%E9%9C%80%E8%B5%8B%E4%BA%88%E5%AE%B9%E5%99%A8%E8%AF%BB%E5%8F%96%E6%9D%83%E9%99%902.%E9%A6%96%E6%AC%A1%E5%8A%A0" style="-webkit-tap-highlight-color: transparent; margin: 8px 0px; padding: 0px 0px 0px 25px; outline: 0px; max-width: 100%; box-sizing: border-box; font-family: 'PingFang SC', system-ui, -apple-system, BlinkMacSystemFont, 'Helvetica Neue', 'Hiragino Sans GB', 'Microsoft YaHei UI', 'Microsoft YaHei', Arial, sans-serif; font-size: 17px; letter-spacing: 0.544px; text-align: justify; text-wrap: wrap; background-color: rgb(255, 255, 255); overflow-wrap: break-word !important;"><span class="" style="-webkit-tap-highlight-color: transparent; margin: 5px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; line-height: 26px; text-align: left; color: #010101; display: block; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px 6px 0px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; overflow-wrap: break-word !important;">1.</span>日志目录需赋予容器读取权限</span><span class="" style="-webkit-tap-highlight-color: transparent; margin: 5px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; line-height: 26px; text-align: left; color: #010101; display: block; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px 6px 0px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; overflow-wrap: break-word !important;">2.</span>首次加载历史日志可能需要1-2分钟</span><span class="" style="-webkit-tap-highlight-color: transparent; margin: 5px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; line-height: 26px; text-align: left; color: #010101; display: block; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px 6px 0px 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box; overflow-wrap: break-word !important;">3.</span>高并发场景建议配置日志轮转策略</span></section>这个项目最大的惊喜是完美保留了GoAccess的专业分析能力，又通过Docker封装大幅降低了 使用门槛。实测在4核8G服务器上处理百万级日志毫无压力，界面响应速度堪比商业监控系 统。唯一的遗憾是暂不支持多日志源混合分析，不过对专注NPM的用户来说完全够用！

需要看板演示的兄弟，欢迎在评论区留言索取测试地址。如果觉得这篇教程有帮助，记得点 赞收藏支持一波！

最后，奉上我的超级无敌至尊docker库，二冰平时玩过的docker都整理到了这个仓库中了， 一直在更新中，希望有github账号的兄弟能去给点个star，不知道玩啥的，都去这里面找， 都给你们分好类了 **仓库链接：** [https://github.com/TWO-ICE/Awesome-NAS-Docker](https://github.com/TWO-ICE/Awesome-NAS-Docker)

Ubuntu系统中文显示教程：

1.安装中文包

apt update  
apt install language-pack-zh-hans  
2.将区域语言设置为简体中文

localectl set-locale LANG=zh\_CN.utf8

localectl status  
localectl list-locales | grep zh  
localectl set-locale LANG=zh\_CN.utf8  
localectl status

docker exec -it goaccess /bin/bash  
\#在容器内执行，建议先备份/var/www/html/index.html  
LANG="zh\_CN.UTF-8" ./goaccess -f /opt/log/access.log --log-format=COMBINED &gt; /var/www/html/index.html

显示效果如下：

[![wechat_2025-07-05_112106_189.png](https://bost.lesrec.cn/uploads/images/gallery/2025-07/scaled-1680-/Hh6OG1HLCrS6uSmy-wechat-2025-07-05-112106-189.png)](https://bost.lesrec.cn/uploads/images/gallery/2025-07/Hh6OG1HLCrS6uSmy-wechat-2025-07-05-112106-189.png)

[![wechat_2025-07-05_112120_026.png](https://bost.lesrec.cn/uploads/images/gallery/2025-07/scaled-1680-/5MKNRYa83AVXPeST-wechat-2025-07-05-112120-026.png)](https://bost.lesrec.cn/uploads/images/gallery/2025-07/5MKNRYa83AVXPeST-wechat-2025-07-05-112120-026.png)

[![wechat_2025-07-05_112132_746.png](https://bost.lesrec.cn/uploads/images/gallery/2025-07/scaled-1680-/lN5O6I9uVXC0Ce3y-wechat-2025-07-05-112132-746.png)](https://bost.lesrec.cn/uploads/images/gallery/2025-07/lN5O6I9uVXC0Ce3y-wechat-2025-07-05-112132-746.png)

# 如何自查linux系统是否存在漏洞

<span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px; visibility: visible;"> 在Linux系统中，自查系统是否有漏洞是一个重要的安全实践，这可以帮助你及时修补安全漏洞，保护你的系统不被恶意攻击。以下是一些常用的方法和工具，可以帮助你检测Linux系统的安全漏洞：</span></span>

### <span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px; visibility: visible;">1. 使用系统更新工具</span></span>

<section id="bkmrk-%C2%A0%C2%A0%C2%A0-%C2%A0%C2%A0%E5%A4%A7%E5%A4%9A%E6%95%B0linux%E5%8F%91%E8%A1%8C%E7%89%88%E9%83%BD%E6%8F%90%E4%BE%9B" style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgb(10, 10, 10); font-family: -apple-system-font, BlinkMacSystemFont, 'Helvetica Neue', 'PingFang SC', 'Hiragino Sans GB', 'Microsoft YaHei UI', 'Microsoft YaHei', Arial, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; visibility: visible;"><span data-pm-slice="1 1 ["para",{"tagName":"section","attributes":{"style":"box-sizing: border-box; border-width: 0px; border-style: solid; border-color: rgb(229, 229, 229); color: rgb(10, 10, 10); font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: rgb(255, 255, 255); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; text-align: left; line-height: 1.75; font-family: -apple-system-font, BlinkMacSystemFont, \"Helvetica Neue\", \"PingFang SC\", \"Hiragino Sans GB\", \"Microsoft YaHei UI\", \"Microsoft YaHei\", Arial, sans-serif; font-size: 16px;"},"namespaceURI":"http://www.w3.org/1999/xhtml"},"para",{"tagName":"p","attributes":{"style":"box-sizing: border-box; border-width: 0px; border-style: solid; border-color: rgb(229, 229, 229); margin: 0px 8px; text-align: left; line-height: 1.75; font-family: -apple-system-font, BlinkMacSystemFont, \"Helvetica Neue\", \"PingFang SC\", \"Hiragino Sans GB\", \"Microsoft YaHei UI\", \"Microsoft YaHei\", Arial, sans-serif; font-size: 16px; letter-spacing: 0.1em; color: rgb(63, 63, 63);"},"namespaceURI":"http://www.w3.org/1999/xhtml"}]" style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px; visibility: visible;"> </span></span><span data-pm-slice="1 1 ["para",{"tagName":"section","attributes":{"style":"box-sizing: border-box; border-width: 0px; border-style: solid; border-color: rgb(229, 229, 229); color: rgb(10, 10, 10); font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: rgb(255, 255, 255); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; text-align: left; line-height: 1.75; font-family: -apple-system-font, BlinkMacSystemFont, \"Helvetica Neue\", \"PingFang SC\", \"Hiragino Sans GB\", \"Microsoft YaHei UI\", \"Microsoft YaHei\", Arial, sans-serif; font-size: 16px;"},"namespaceURI":"http://www.w3.org/1999/xhtml"},"para",{"tagName":"p","attributes":{"style":"box-sizing: border-box; border-width: 0px; border-style: solid; border-color: rgb(229, 229, 229); margin: 0px 8px; text-align: left; line-height: 1.75; font-family: -apple-system-font, BlinkMacSystemFont, \"Helvetica Neue\", \"PingFang SC\", \"Hiragino Sans GB\", \"Microsoft YaHei UI\", \"Microsoft YaHei\", Arial, sans-serif; font-size: 16px; letter-spacing: 0.1em; color: rgb(63, 63, 63);"},"namespaceURI":"http://www.w3.org/1999/xhtml"}]" style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px; visibility: visible;"> </span></span><span data-pm-slice="1 1 ["para",{"tagName":"section","attributes":{"style":"box-sizing: border-box; border-width: 0px; border-style: solid; border-color: rgb(229, 229, 229); color: rgb(10, 10, 10); font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: rgb(255, 255, 255); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; text-align: left; line-height: 1.75; font-family: -apple-system-font, BlinkMacSystemFont, \"Helvetica Neue\", \"PingFang SC\", \"Hiragino Sans GB\", \"Microsoft YaHei UI\", \"Microsoft YaHei\", Arial, sans-serif; font-size: 16px;"},"namespaceURI":"http://www.w3.org/1999/xhtml"},"para",{"tagName":"p","attributes":{"style":"box-sizing: border-box; border-width: 0px; border-style: solid; border-color: rgb(229, 229, 229); margin: 0px 8px; text-align: left; line-height: 1.75; font-family: -apple-system-font, BlinkMacSystemFont, \"Helvetica Neue\", \"PingFang SC\", \"Hiragino Sans GB\", \"Microsoft YaHei UI\", \"Microsoft YaHei\", Arial, sans-serif; font-size: 16px; letter-spacing: 0.1em; color: rgb(63, 63, 63);"},"namespaceURI":"http://www.w3.org/1999/xhtml"}]" style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px; visibility: visible;">大多数Linux发行版都提供了包管理系统，例如APT（Debian/Ubuntu）或YUM/DNF（Fedora/CentOS）。定期运行这些更新工具可以安装最新的安全补丁和更新。</span></span></section><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px; visibility: visible;">对于Debian/Ubuntu及其衍生版：</span></span>

```
<svg height="13px" style="visibility: visible;" version="1.1" viewbox="0 0 450 130" width="45px" x="0px" xmlns="http://www.w3.org/2000/svg" y="0px"><ellipse cx="50" cy="65" fill="rgb(237,108,96)" rx="50" ry="52" stroke="rgb(220,60,54)" stroke-width="2" style="visibility: visible;"></ellipse><ellipse cx="225" cy="65" fill="rgb(247,193,81)" rx="50" ry="52" stroke="rgb(218,151,33)" stroke-width="2" style="visibility: visible;"></ellipse><ellipse cx="400" cy="65" fill="rgb(100,200,86)" rx="50" ry="52" stroke="rgb(27,161,37)" stroke-width="2" style="visibility: visible;"></ellipse></svg>```
sudo apt update && sudo apt upgrade
```
```

<span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px; visibility: visible;">对于Fedora/CentOS及其衍生版：</span></span>

```
<svg height="13px" style="visibility: visible;" version="1.1" viewbox="0 0 450 130" width="45px" x="0px" xmlns="http://www.w3.org/2000/svg" y="0px"><ellipse cx="50" cy="65" fill="rgb(237,108,96)" rx="50" ry="52" stroke="rgb(220,60,54)" stroke-width="2" style="visibility: visible;"></ellipse><ellipse cx="225" cy="65" fill="rgb(247,193,81)" rx="50" ry="52" stroke="rgb(218,151,33)" stroke-width="2" style="visibility: visible;"></ellipse><ellipse cx="400" cy="65" fill="rgb(100,200,86)" rx="50" ry="52" stroke="rgb(27,161,37)" stroke-width="2" style="visibility: visible;"></ellipse></svg>```
sudo dnf update
```
```

### <span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px; visibility: visible;">2. 使用安全扫描工具</span></span>

<span data-pm-slice="1 1 ["para",{"tagName":"section","attributes":{"style":"box-sizing: border-box; border-width: 0px; border-style: solid; border-color: rgb(229, 229, 229); color: rgb(10, 10, 10); font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: rgb(255, 255, 255); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; text-align: left; line-height: 1.75; font-family: -apple-system-font, BlinkMacSystemFont, \"Helvetica Neue\", \"PingFang SC\", \"Hiragino Sans GB\", \"Microsoft YaHei UI\", \"Microsoft YaHei\", Arial, sans-serif; font-size: 16px;"},"namespaceURI":"http://www.w3.org/1999/xhtml"},"para",{"tagName":"p","attributes":{"style":"box-sizing: border-box; border-width: 0px; border-style: solid; border-color: rgb(229, 229, 229); margin: 0px 8px; text-align: left; line-height: 1.75; font-family: -apple-system-font, BlinkMacSystemFont, \"Helvetica Neue\", \"PingFang SC\", \"Hiragino Sans GB\", \"Microsoft YaHei UI\", \"Microsoft YaHei\", Arial, sans-serif; font-size: 16px; letter-spacing: 0.1em; color: rgb(63, 63, 63);"},"namespaceURI":"http://www.w3.org/1999/xhtml"}]" style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px; visibility: visible;"> </span></span><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px; visibility: visible;">a. OpenVAS（Open Vulnerability Assessment System）</span></span>  
<span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px; visibility: visible;">OpenVAS是一个强大的开源漏洞扫描工具，它可以检测多种类型的漏洞。</span></span>

<span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px; visibility: visible;">安装OpenVAS：</span></span>

```
<svg height="13px" style="visibility: visible;" version="1.1" viewbox="0 0 450 130" width="45px" x="0px" xmlns="http://www.w3.org/2000/svg" y="0px"><ellipse cx="50" cy="65" fill="rgb(237,108,96)" rx="50" ry="52" stroke="rgb(220,60,54)" stroke-width="2" style="visibility: visible;"></ellipse><ellipse cx="225" cy="65" fill="rgb(247,193,81)" rx="50" ry="52" stroke="rgb(218,151,33)" stroke-width="2" style="visibility: visible;"></ellipse><ellipse cx="400" cy="65" fill="rgb(100,200,86)" rx="50" ry="52" stroke="rgb(27,161,37)" stroke-width="2" style="visibility: visible;"></ellipse></svg>```
sudo apt install openvas
```
```

<span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px; visibility: visible;">启动OpenVAS服务并运行扫描：</span></span>

```
<svg height="13px" style="visibility: visible;" version="1.1" viewbox="0 0 450 130" width="45px" x="0px" xmlns="http://www.w3.org/2000/svg" y="0px"><ellipse cx="50" cy="65" fill="rgb(237,108,96)" rx="50" ry="52" stroke="rgb(220,60,54)" stroke-width="2" style="visibility: visible;"></ellipse><ellipse cx="225" cy="65" fill="rgb(247,193,81)" rx="50" ry="52" stroke="rgb(218,151,33)" stroke-width="2" style="visibility: visible;"></ellipse><ellipse cx="400" cy="65" fill="rgb(100,200,86)" rx="50" ry="52" stroke="rgb(27,161,37)" stroke-width="2" style="visibility: visible;"></ellipse></svg>```
sudo openvas-start
sudo openvas-check-setup
sudo openvasmd --create-user=admin --role=Admin
```
```

<span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px; visibility: visible;">b. Nessus</span></span>  
<span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px; visibility: visible;">Nessus也是一个流行的商业和开源漏洞扫描工具。虽然它是商业软件，但有免费版本可供使用。</span></span>

<span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px; visibility: visible;">下载并安装Nessus（以开源版本为例）：</span></span>

```
<svg height="13px" version="1.1" viewbox="0 0 450 130" width="45px" x="0px" xmlns="http://www.w3.org/2000/svg" y="0px"><ellipse cx="50" cy="65" fill="rgb(237,108,96)" rx="50" ry="52" stroke="rgb(220,60,54)" stroke-width="2"></ellipse><ellipse cx="225" cy="65" fill="rgb(247,193,81)" rx="50" ry="52" stroke="rgb(218,151,33)" stroke-width="2"></ellipse><ellipse cx="400" cy="65" fill="rgb(100,200,86)" rx="50" ry="52" stroke="rgb(27,161,37)" stroke-width="2"></ellipse></svg>```
sudo apt install nessus
```
```

<span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">c. Lynis</span></span>  
<span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">Lynis是一个安全审计工具，可以检查系统配置并报告潜在的安全问题。</span></span>

<span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">安装Lynis：</span></span>

```
<svg height="13px" version="1.1" viewbox="0 0 450 130" width="45px" x="0px" xmlns="http://www.w3.org/2000/svg" y="0px"><ellipse cx="50" cy="65" fill="rgb(237,108,96)" rx="50" ry="52" stroke="rgb(220,60,54)" stroke-width="2"></ellipse><ellipse cx="225" cy="65" fill="rgb(247,193,81)" rx="50" ry="52" stroke="rgb(218,151,33)" stroke-width="2"></ellipse><ellipse cx="400" cy="65" fill="rgb(100,200,86)" rx="50" ry="52" stroke="rgb(27,161,37)" stroke-width="2"></ellipse></svg>```
sudo apt install lynis
```
```

<span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">运行Lynis：</span></span>

```
<svg height="13px" version="1.1" viewbox="0 0 450 130" width="45px" x="0px" xmlns="http://www.w3.org/2000/svg" y="0px"><ellipse cx="50" cy="65" fill="rgb(237,108,96)" rx="50" ry="52" stroke="rgb(220,60,54)" stroke-width="2"></ellipse><ellipse cx="225" cy="65" fill="rgb(247,193,81)" rx="50" ry="52" stroke="rgb(218,151,33)" stroke-width="2"></ellipse><ellipse cx="400" cy="65" fill="rgb(100,200,86)" rx="50" ry="52" stroke="rgb(27,161,37)" stroke-width="2"></ellipse></svg>```
sudo lynis audit system
```
```

### <span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">3. 检查常见漏洞的公告和日志</span></span>

<span data-pm-slice="1 1 ["para",{"tagName":"section","attributes":{"style":"box-sizing: border-box; border-width: 0px; border-style: solid; border-color: rgb(229, 229, 229); color: rgb(10, 10, 10); font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: rgb(255, 255, 255); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; text-align: left; line-height: 1.75; font-family: -apple-system-font, BlinkMacSystemFont, \"Helvetica Neue\", \"PingFang SC\", \"Hiragino Sans GB\", \"Microsoft YaHei UI\", \"Microsoft YaHei\", Arial, sans-serif; font-size: 16px;"},"namespaceURI":"http://www.w3.org/1999/xhtml"},"para",{"tagName":"p","attributes":{"style":"box-sizing: border-box; border-width: 0px; border-style: solid; border-color: rgb(229, 229, 229); margin: 0px 8px; text-align: left; line-height: 1.75; font-family: -apple-system-font, BlinkMacSystemFont, \"Helvetica Neue\", \"PingFang SC\", \"Hiragino Sans GB\", \"Microsoft YaHei UI\", \"Microsoft YaHei\", Arial, sans-serif; font-size: 16px; letter-spacing: 0.1em; color: rgb(63, 63, 63);"},"namespaceURI":"http://www.w3.org/1999/xhtml"}]" style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;"> </span></span><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">关注安全公告：订阅相关的安全邮件列表或RSS源，如US-CERT、CVE Mitre等，了解最新的安全漏洞信息。</span></span>

<span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">检查系统日志：查看/var/log/目录下的日志文件，特别是auth.log和syslog，以发现任何异常登录尝试或其他安全相关的事件。</span></span>

### <span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">4. 使用在线服务检查已知漏洞数据库</span></span>

<span data-pm-slice="1 1 ["para",{"tagName":"section","attributes":{"style":"box-sizing: border-box; border-width: 0px; border-style: solid; border-color: rgb(229, 229, 229); color: rgb(10, 10, 10); font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: rgb(255, 255, 255); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; text-align: left; line-height: 1.75; font-family: -apple-system-font, BlinkMacSystemFont, \"Helvetica Neue\", \"PingFang SC\", \"Hiragino Sans GB\", \"Microsoft YaHei UI\", \"Microsoft YaHei\", Arial, sans-serif; font-size: 16px;"},"namespaceURI":"http://www.w3.org/1999/xhtml"},"para",{"tagName":"p","attributes":{"style":"box-sizing: border-box; border-width: 0px; border-style: solid; border-color: rgb(229, 229, 229); margin: 0px 8px; text-align: left; line-height: 1.75; font-family: -apple-system-font, BlinkMacSystemFont, \"Helvetica Neue\", \"PingFang SC\", \"Hiragino Sans GB\", \"Microsoft YaHei UI\", \"Microsoft YaHei\", Arial, sans-serif; font-size: 16px; letter-spacing: 0.1em; color: rgb(63, 63, 63);"},"namespaceURI":"http://www.w3.org/1999/xhtml"}]" style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;"> </span></span><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">例如，使用Shodan或Censys等在线服务来检查你的系统是否已经被公开暴露在互联网上，并查看是否有已知的漏洞被利用。这些服务可以帮助你识别你的系统是否容易被攻击。</span></span>

### <span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">5. 定期进行渗透测试和安全演练</span></span>

<span data-pm-slice="1 1 ["para",{"tagName":"section","attributes":{"style":"box-sizing: border-box; border-width: 0px; border-style: solid; border-color: rgb(229, 229, 229); color: rgb(10, 10, 10); font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: rgb(255, 255, 255); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; text-align: left; line-height: 1.75; font-family: -apple-system-font, BlinkMacSystemFont, \"Helvetica Neue\", \"PingFang SC\", \"Hiragino Sans GB\", \"Microsoft YaHei UI\", \"Microsoft YaHei\", Arial, sans-serif; font-size: 16px;"},"namespaceURI":"http://www.w3.org/1999/xhtml"},"para",{"tagName":"p","attributes":{"style":"box-sizing: border-box; border-width: 0px; border-style: solid; border-color: rgb(229, 229, 229); margin: 0px 8px; text-align: left; line-height: 1.75; font-family: -apple-system-font, BlinkMacSystemFont, \"Helvetica Neue\", \"PingFang SC\", \"Hiragino Sans GB\", \"Microsoft YaHei UI\", \"Microsoft YaHei\", Arial, sans-serif; font-size: 16px; letter-spacing: 0.1em; color: rgb(63, 63, 63);"},"namespaceURI":"http://www.w3.org/1999/xhtml"}]" style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;"> </span></span><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">定期进行内部渗透测试和安全演练可以帮助你发现和修复未被发现的安全问题。这可以由你的IT团队或外部安全专家执行。</span></span>

<span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: transparent; margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;"> 通过结合使用上述方法和工具，你可以有效地管理和减少Linux系统中的安全风险。</span></span>

# 这个被99%运维忽略的功能，竟然能秒杀所有漏洞扫描

## 凌晨3点的噩梦

你好，我是赵兴晨，97年文科程序员。在公司里身兼数职，具体都做些什么，相信通过我的技术分享你会慢慢了解。

又是一个不眠夜。手机屏幕上密密麻麻的漏洞扫描报告让我头皮发麻——这次足足有几十个中间件版本在疯狂地"求升级"。

作为服务器的运维负责人，我深知这些中间件意味着什么：停机、测试、回滚……各种风险。一个不小心，整个业务都可能受到影响。看着那份长达十多页的漏洞清单，我陷入沉思……

## 那个改变一切的想法

在我准备通宵达旦制定升级计划时，突然想到了一个被我忽略已久的Linux功能组合：ipset和firewalld。这个想法让我眼前一亮！

既然升级这么麻烦，为什么不换个思路？如果我能让漏洞扫描器发现不了我的服务，那漏洞是不是就等于不存在了呢？这个想法像闪电一样击中了我。

## 传统方案 VS 神级方案

### 传统方案

```
<svg height="13px" version="1.1" viewbox="0 0 450 130" width="45px" x="0px" xmlns="http://www.w3.org/2000/svg" y="0px"><ellipse cx="50" cy="65" fill="rgb(237,108,96)" rx="50" ry="52" stroke="rgb(220,60,54)" stroke-width="2"></ellipse><ellipse cx="225" cy="65" fill="rgb(247,193,81)" rx="50" ry="52" stroke="rgb(218,151,33)" stroke-width="2"></ellipse><ellipse cx="400" cy="65" fill="rgb(100,200,86)" rx="50" ry="52" stroke="rgb(27,161,37)" stroke-width="2"></ellipse></svg>```
# 在每台服务器上都要配置79条规则
iptables -A INPUT -s 10.0.0.1 -j ACCEPT
iptables -A INPUT -s 10.0.0.2 -j ACCEPT
iptables -A INPUT -s 10.0.0.3 -j ACCEPT
# ... 还有76条
```
```

**总计:80 × 79 = 6320 条规则!**

这不仅管理困难，性能也是灾难级的。每个数据包都要遍历几千条规则才能决定是否放行。

### 神级方案：ipset 一招制敌

而使用 `ipset`，你只需要：

```
<svg height="13px" version="1.1" viewbox="0 0 450 130" width="45px" x="0px" xmlns="http://www.w3.org/2000/svg" y="0px"><ellipse cx="50" cy="65" fill="rgb(237,108,96)" rx="50" ry="52" stroke="rgb(220,60,54)" stroke-width="2"></ellipse><ellipse cx="225" cy="65" fill="rgb(247,193,81)" rx="50" ry="52" stroke="rgb(218,151,33)" stroke-width="2"></ellipse><ellipse cx="400" cy="65" fill="rgb(100,200,86)" rx="50" ry="52" stroke="rgb(27,161,37)" stroke-width="2"></ellipse></svg>```
# 创建IP集合（一次性）
firewall-cmd --permanent --new-ipset=trusted_servers --type=hash:ip

# 批量导入所有信任IP（一条命令）
firewall-cmd --permanent --ipset=trusted_servers --add-entries-from-file=/tmp/trusted-ips.txt

# 一条规则搞定所有（核心）
firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source ipset="trusted_servers" accept'
```
```

**总计：每台服务器只需要1条规则！**

从 6320 条规则到 80 条规则？不！是从 6320 条规则到 **80 条规则**！这就是降维打击！

## 方案详解

`ipset` + `firewalld` 旨在一组集群服务器内配置防火墙规则，以实现以下目标：

- <section>• 集群内互信：集群内的所有服务器之间可以互相访问任何端口，不受限制。</section>
- <section>• 对外隔离：所有来自集群外部的访问流量（除了明确允许的，如SSH、HTTP等），都将被默认阻止。</section>
- <section>• 高效管理：采用 ipset 统一管理IP列表，避免为每台服务器单独配置大量重复规则，实现高效、可扩展且易于维护的防火墙策略。</section>

**为什么使用 ipset？**

在一个拥有 N 台服务器的集群中，如果要在每台服务器上允许其他 N-1 台服务器的访问，就需要配置 N \* (N-1) 条独立的防火墙规则。这在管理上是一场灾难。

ipset 是 Linux 内核中的一个框架，它允许你将大量的 IP 地址、网段或 MAC 地址存储在一个集合（set）中。然后，你可以在 firewalld 或 iptables 中仅用一条规则来匹配这整个集合。

优点：

- <section>• 性能极高：内核使用哈希表等高效数据结构来查找IP，速度远快于遍历长长的规则链。</section>
- <section>• 管理便捷：IP地址的增删仅需在 ipset 集合中操作，无需改动核心防火墙规则。</section>

## 实施步骤

**前提条件：**

- <section>• 拥有所有服务器的 `root` 或 `sudo` 权限。</section>
- <section>• 准备好一份包含所有集群服务器IP地址的列表。</section>
- <section>• 强烈建议使用自动化工具（如 Ansible、SaltStack）来批量执行以下操作。</section>
- <section>• 也可以参考我的开源项目：https://gitcode.com/JasonChenn/batch\_operation.git</section>

---

### 第1步：创建 IP 地址白名单文件

在一台管理机上，创建一个名为 `trusted-ips.txt` 的文本文件。将所有需要互相通信的服务器的 IP 地址写入此文件，每行一个。

**示例 `trusted-ips.txt`:**

```
<svg height="13px" version="1.1" viewbox="0 0 450 130" width="45px" x="0px" xmlns="http://www.w3.org/2000/svg" y="0px"><ellipse cx="50" cy="65" fill="rgb(237,108,96)" rx="50" ry="52" stroke="rgb(220,60,54)" stroke-width="2"></ellipse><ellipse cx="225" cy="65" fill="rgb(247,193,81)" rx="50" ry="52" stroke="rgb(218,151,33)" stroke-width="2"></ellipse><ellipse cx="400" cy="65" fill="rgb(100,200,86)" rx="50" ry="52" stroke="rgb(27,161,37)" stroke-width="2"></ellipse></svg>```
10.0.0.91
10.0.0.92
10.0.0.93
# ... 将所有80个IP地址都加进去
10.0.0.170
```
```

---

### 第2步：分发 IP 地址列表文件

使用自动化工具或 `scp` 命令，将 `trusted-ips.txt` 文件分发到集群中的**每一台**服务器上。建议放在一个临时目录，例如 `/tmp/`。

**手动 `scp` 示例：**

```
<svg height="13px" version="1.1" viewbox="0 0 450 130" width="45px" x="0px" xmlns="http://www.w3.org/2000/svg" y="0px"><ellipse cx="50" cy="65" fill="rgb(237,108,96)" rx="50" ry="52" stroke="rgb(220,60,54)" stroke-width="2"></ellipse><ellipse cx="225" cy="65" fill="rgb(247,193,81)" rx="50" ry="52" stroke="rgb(218,151,33)" stroke-width="2"></ellipse><ellipse cx="400" cy="65" fill="rgb(100,200,86)" rx="50" ry="52" stroke="rgb(27,161,37)" stroke-width="2"></ellipse></svg>```
scp trusted-ips.txt root@10.0.0.91:/tmp/
scp trusted-ips.txt root@10.0.0.92:/tmp/
# ... 对所有服务器执行此操作
```
```

---

### 第3步：在所有服务器上配置 `firewalld`

在**每一台**服务器上执行以下命令序列来创建 `ipset` 并应用防火墙规则。

```
<svg height="13px" version="1.1" viewbox="0 0 450 130" width="45px" x="0px" xmlns="http://www.w3.org/2000/svg" y="0px"><ellipse cx="50" cy="65" fill="rgb(237,108,96)" rx="50" ry="52" stroke="rgb(220,60,54)" stroke-width="2"></ellipse><ellipse cx="225" cy="65" fill="rgb(247,193,81)" rx="50" ry="52" stroke="rgb(218,151,33)" stroke-width="2"></ellipse><ellipse cx="400" cy="65" fill="rgb(100,200,86)" rx="50" ry="52" stroke="rgb(27,161,37)" stroke-width="2"></ellipse></svg>```
# 1. 创建一个永久的 ipset 集合，命名为 trusted_servers
#    --type=hash:ip 指定了集合的类型，适合存储独立的IP地址
sudo firewall-cmd --permanent --new-ipset=trusted_servers --type=hash:ip

# 2. 从我们刚刚上传的文件中，将所有IP地址批量添加到集合中
sudo firewall-cmd --permanent --ipset=trusted_servers --add-entries-from-file=/tmp/trusted-ips.txt

# 3. 添加核心防火墙规则：允许所有来自 trusted_servers 集合中的源IP的流量
#    这条规则被添加到 public zone，你可以根据环境修改为其他 zone
sudo firewall-cmd --permanent --zone=public --add-source=ipset:trusted_servers

# 4. 添加富规则：允许信任源访问所有端口（集群内互信）
sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source ipset="trusted_servers" accept'

# 5. 重新加载防火墙配置，使所有永久规则立即生效
sudo firewall-cmd --reload
```
```

---

### 第4步（关键）：清理默认开放的服务

**90%的人会在这里翻车!**

**这是非常重要的一步，通常是导致策略“无效”的直接原因。**

在应用了 `ipset` 规则后，你可能会发现某些非信任IP（例如 `10.0.0.91`）依然可以访问集群内的服务器（例如通过 SSH）。这是因为 `firewalld` 的 `public` 区域在默认情况下可能已经允许了某些服务。

我们的 `ipset` 规则是“允许白名单IP访问**所有**端口”，但系统预设的规则可能是“允许**任何人**访问 `ssh` 端口”。这两条规则会同时生效，导致非白名单IP也能通过SSH访问。

**诊断命令：**  
在集群内的服务器上执行，检查 `public` 区域的配置。

```
<svg height="13px" version="1.1" viewbox="0 0 450 130" width="45px" x="0px" xmlns="http://www.w3.org/2000/svg" y="0px"><ellipse cx="50" cy="65" fill="rgb(237,108,96)" rx="50" ry="52" stroke="rgb(220,60,54)" stroke-width="2"></ellipse><ellipse cx="225" cy="65" fill="rgb(247,193,81)" rx="50" ry="52" stroke="rgb(218,151,33)" stroke-width="2"></ellipse><ellipse cx="400" cy="65" fill="rgb(100,200,86)" rx="50" ry="52" stroke="rgb(27,161,37)" stroke-width="2"></ellipse></svg>```
sudo firewall-cmd --zone=public --list-all
```
```

**问题定位：**  
如果输出中 `services:` 这一行包含了 `ssh`，说明存在此问题。

```
<svg height="13px" version="1.1" viewbox="0 0 450 130" width="45px" x="0px" xmlns="http://www.w3.org/2000/svg" y="0px"><ellipse cx="50" cy="65" fill="rgb(237,108,96)" rx="50" ry="52" stroke="rgb(220,60,54)" stroke-width="2"></ellipse><ellipse cx="225" cy="65" fill="rgb(247,193,81)" rx="50" ry="52" stroke="rgb(218,151,33)" stroke-width="2"></ellipse><ellipse cx="400" cy="65" fill="rgb(100,200,86)" rx="50" ry="52" stroke="rgb(27,161,37)" stroke-width="2"></ellipse></svg>```
public (active)
  ...
  sources: ipset:trusted_servers
  services: ssh dhcpv6-client  <-- 问题根源
  ...
```
```

**修复命令（在所有服务器上执行）：**  
从 `public` 区域中移除预设的 `ssh` 服务，确保所有访问都由我们的 `ipset` 规则控制。

```
<svg height="13px" version="1.1" viewbox="0 0 450 130" width="45px" x="0px" xmlns="http://www.w3.org/2000/svg" y="0px"><ellipse cx="50" cy="65" fill="rgb(237,108,96)" rx="50" ry="52" stroke="rgb(220,60,54)" stroke-width="2"></ellipse><ellipse cx="225" cy="65" fill="rgb(247,193,81)" rx="50" ry="52" stroke="rgb(218,151,33)" stroke-width="2"></ellipse><ellipse cx="400" cy="65" fill="rgb(100,200,86)" rx="50" ry="52" stroke="rgb(27,161,37)" stroke-width="2"></ellipse></svg>```
# 从 public zone 中移除 ssh 服务
sudo firewall-cmd --permanent --zone=public --remove-service=ssh

# 再次重载防火墙使配置生效
sudo firewall-cmd --reload
```
```

完成此步骤后，防火墙将严格执行我们设定的白名单策略。

---

### 第5步：验证配置

现在,你的服务器对外界来说就像**人间蒸发**了一样!

在任意一台服务器上执行以下命令，检查配置是否正确。

```
<svg height="13px" version="1.1" viewbox="0 0 450 130" width="45px" x="0px" xmlns="http://www.w3.org/2000/svg" y="0px"><ellipse cx="50" cy="65" fill="rgb(237,108,96)" rx="50" ry="52" stroke="rgb(220,60,54)" stroke-width="2"></ellipse><ellipse cx="225" cy="65" fill="rgb(247,193,81)" rx="50" ry="52" stroke="rgb(218,151,33)" stroke-width="2"></ellipse><ellipse cx="400" cy="65" fill="rgb(100,200,86)" rx="50" ry="52" stroke="rgb(27,161,37)" stroke-width="2"></ellipse></svg>```
# 查看当前系统存在的所有 ipset 集合
sudo firewall-cmd --get-ipsets
# 预期输出: trusted_servers

# 查看 trusted_servers 集合中的具体条目
sudo firewall-cmd --info-ipset=trusted_servers
# 预期输出会列出你在 trusted-ips.txt 中添加的所有IP地址

# 查看 public zone 的允许源
sudo firewall-cmd --zone=public --list-sources
# 预期输出: ipset:trusted_servers
```
```

如果以上命令的输出都符合预期，那么你的集群防火墙策略已经成功部署。

**测试结果:**

- <section>• ✅ 内网服务器之间:任意端口互通</section>
- <section>• ❌ 外网扫描器:所有端口都超时</section>
- <section>• ❌ 黑客探测:如同攻击空气</section>

## 维护：像换灯泡一样简单

当集群需要增加或移除服务器时，维护工作非常简单。

### 场景：新增一台服务器 `10.0.0.188`

1. <section>1. 在管理机上，更新 `trusted-ips.txt` 文件，在文件末尾添加新IP `10.0.0.188`。</section>
2. <section>2. 将**新服务器 `10.0.0.188`** 按照上述第3步的完整流程进行初始化配置（包括富规则）。</section>
3. <section>3. 将更新后的 `trusted-ips.txt` 文件分发到**所有旧的服务器**上。</section>
4. <section>4. 在**所有旧的服务器**上执行以下命令，重新加载 IP 列表： ```
    <svg height="13px" version="1.1" viewbox="0 0 450 130" width="45px" x="0px" xmlns="http://www.w3.org/2000/svg" y="0px"><ellipse cx="50" cy="65" fill="rgb(237,108,96)" rx="50" ry="52" stroke="rgb(220,60,54)" stroke-width="2"></ellipse><ellipse cx="225" cy="65" fill="rgb(247,193,81)" rx="50" ry="52" stroke="rgb(218,151,33)" stroke-width="2"></ellipse><ellipse cx="400" cy="65" fill="rgb(100,200,86)" rx="50" ry="52" stroke="rgb(27,161,37)" stroke-width="2"></ellipse></svg>```
    # 更新 ipset 集合
    sudo firewall-cmd --permanent --ipset=trusted_servers --add-entries-from-file=/tmp/trusted-ips.txt
    
    # 确保富规则存在（如果之前未配置）
    sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source ipset="trusted_servers" accept'
    
    # 重新加载防火墙配置
    sudo firewall-cmd --reload
    ```
    ```
    
    </section>

### 场景：移除一台服务器

1. <section>1. 在管理机上，从 `trusted-ips.txt` 文件中删除该服务器的IP。</section>
2. <section>2. 将更新后的 `trusted-ips.txt` 文件分发到**所有需要保留的服务器**上。</section>
3. <section>3. 在**所有需要保留的服务器**上，执行以下命令序列来重建 `ipset`： ```
    <svg height="13px" version="1.1" viewbox="0 0 450 130" width="45px" x="0px" xmlns="http://www.w3.org/2000/svg" y="0px"><ellipse cx="50" cy="65" fill="rgb(237,108,96)" rx="50" ry="52" stroke="rgb(220,60,54)" stroke-width="2"></ellipse><ellipse cx="225" cy="65" fill="rgb(247,193,81)" rx="50" ry="52" stroke="rgb(218,151,33)" stroke-width="2"></ellipse><ellipse cx="400" cy="65" fill="rgb(100,200,86)" rx="50" ry="52" stroke="rgb(27,161,37)" stroke-width="2"></ellipse></svg>```
    # 彻底移除旧的集合
    sudo firewall-cmd --permanent --delete-ipset=trusted_servers
    
    # 重新创建 ipset 集合
    sudo firewall-cmd --permanent --new-ipset=trusted_servers --type=hash:ip
    
    # 从更新后的文件中加载IP列表
    sudo firewall-cmd --permanent --ipset=trusted_servers --add-entries-from-file=/tmp/trusted-ips.txt
    
    # 重新添加富规则（删除ipset时富规则也会被清除）
    sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source ipset="trusted_servers" accept'
    
    # 重新加载防火墙配置
    sudo firewall-cmd --reload
    ```
    ```
    
    </section>

## 安全提醒

这个方案虽然强大,但要明白它的边界:

⚠️ **无法防御内部攻击**:如果集群中任何一台服务器被攻陷,攻击者可以访问所有其他服务器.

⚠️ **无法隐藏主机存在**:ARP扫描还是能发现主机,但无法访问服务.

但对付漏洞扫描?**完美!**

## 写在最后

第二天早上，安全部门找我：“昨晚的漏洞扫描怎么一个都没发现?是不是扫描器坏了？”

我淡定地喝了口咖啡：“可能是服务器今天心情不好,不想被扫描吧。”

**有时候，最懒的方案往往是最聪明的方案。**

回想起那个不眠之夜，我庆幸自己没有选择"硬刚"升级所有中间件。有时候，换个思路就能找到更优雅的解决方案。

这个被99%运维忽略的ipset功能，确实改变了我的工作方式。如果你也在为漏洞扫描头疼，不妨试试这个方案，说不定会有意想不到的收获！

> **小贴士**：虽然这个方案很好用，但记住它只是隐藏了服务，并不能真正修复漏洞。对于关键业务，该升级的还是要升级的！

**你还在为漏洞扫描发愁吗？不如试试这个被99%运维忽略的神器！**

记得点赞收藏，说不定哪天就能救你一命！ 😉

# Nginx ssl强化安全配置

下面详细解释你给出的 **Nginx 配置的作用**，以及 **应该放在哪个配置段才能生效**。

---

# ✅ 一、这些配置的作用

## **1. SSL 安全相关**

```
ssl_stapling on;
ssl_stapling_verify on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
resolver 119.29.29.29 182.254.116.116 valid=300s;
resolver_timeout 5s;

```

### ✔ `ssl_stapling on`

开启 **OCSP Stapling**，减少浏览器验证证书的延迟，加速 HTTPS。

### ✔ `ssl_stapling_verify on`

验证 OCSP 响应的有效性，更安全。

### ✔ `ssl_session_cache shared:SSL:10m`

创建 10MB 的共享会话缓存，减少 SSL 握手次数，提高性能。

### ✔ `ssl_session_timeout 10m`

SSL 会话缓存保留 10 分钟。

### ✔ DNS 解析器（给 OCSP 用）

```
resolver 119.29.29.29 182.254.116.116 valid=300s;
resolver_timeout 5s;

```

用于 OCSP Stapling 查询证书状态，需要公网 DNS 才能解析 OCSP 服务器。

---

## **2. HTTP 安全头部（安全增强）**

```
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin";
add_header Set-Cookie "Path=/; HttpOnly; Secure; SameSite=Strict";

```

### ✔ HSTS（强制 HTTPS）

```
Strict-Transport-Security

```

告诉浏览器：**之后访问本站全部强制走 HTTPS**，并包含子域名。

### ✔ 禁止 iframe 跨站嵌入

```
X-Frame-Options SAMEORIGIN

```

防止 Clickjacking 攻击。

### ✔ 禁止 MIME 嗅探

```
X-Content-Type-Options nosniff

```

### ✔ 同源跳转策略

```
Referrer-Policy strict-origin-when-cross-origin

```

保护 referrer 隐私。

### ✔ 安全 Cookie

```
Set-Cookie "Path=/; HttpOnly; Secure; SameSite=Strict";

```

让 cookie 更安全：

- `HttpOnly`：JavaScript 不能读取
- `Secure`：只在 HTTPS 传输
- `SameSite=Strict`：禁止跨站请求带 cookie（防止 CSRF）

---

# ✅ 二、这些配置 **应该放在哪里才能生效？**

## 确切位置： **放在 server{} 块内部（监听 HTTPS 的 server 块）**

比如：

```
server {
    listen 443 ssl http2;
    server_name example.com;

    ssl_certificate /path/to/fullchain.pem;
    ssl_certificate_key /path/to/privkey.pem;

    # 把你的配置加在这里
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    resolver 119.29.29.29 182.254.116.116 valid=300s;
    resolver_timeout 5s;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
    add_header X-Frame-Options SAMEORIGIN;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin";
    add_header Set-Cookie "Path=/; HttpOnly; Secure; SameSite=Strict";

    root /var/www/html;
}

```

---

# ⚠ 注意事项

### **1. add\_header 必须在 HTTPS 的 server {} 中**

否则可能不会生效。

### **2. 如果你想全站所有 location 都生效**

请放在 **server{} 块的顶部，而不是 location{} 里面**。

### **3. 对 HTTP（80） 的 server 没有必要加以上安全头**

因为：

- `HSTS` 需要 HTTPS 才有效
- cookie 的 Secure 也只能 HTTPS
- OCSP Stapling 也是 HTTPS 证书相关

---

# 🎯 简要总结

<table id="bkmrk-%E9%85%8D%E7%BD%AE%E7%B1%BB%E5%9E%8B-%E5%BB%BA%E8%AE%AE%E4%BD%8D%E7%BD%AE-ssl-ocsp-%2F"><thead><tr><th>配置类型</th><th>建议位置</th></tr></thead><tbody><tr><td>SSL OCSP / session 缓存</td><td>`server { listen 443 ssl; }`</td></tr><tr><td>HTTP 安全头（add\_header）</td><td>同样在 HTTPS server{} 块内部</td></tr><tr><td>resolver</td><td>也放 server{}</td></tr></tbody></table>

---

如果你给我你的 Nginx 文件路径，比如：

```
/etc/nginx/sites-available/xxx.conf

```

我可以帮你直接修改成 **可用的完整配置模板**。

# Ubuntu 18.04 部署 ModSecurity（含 Nginx）安装方式

下面给你一套 **Ubuntu 18.04 部署 ModSecurity（含 Nginx）最完整、最稳定、一次成功的安装方式**，适合生产环境。

---

# ✅ **方案概览（推荐）**

Ubuntu 18.04 上 ModSecurity 有两种方式：

### **方式 A：Nginx + ModSecurity v3（推荐，最新架构）**

- 需要编译 ModSecurity v3 库
- 再重新编译 Nginx + ModSecurity Connector  
    适合需要稳定 + 高性能。

### **方式 B：直接用 libapache2-mod-security2（仅 Apache 生效）**

不适用 Nginx，不推荐。

---

# ✅ **以下给出完整的 Nginx + ModSecurity v3 部署步骤（推荐）**

---

# **1. 安装依赖**

```bash
sudo apt update
sudo apt install -y git build-essential autoconf automake libtool \
libpcre3 libpcre3-dev libssl-dev libxml2 libxml2-dev \
libyajl-dev libgeoip-dev pkg-config doxygen \
libcurl4-openssl-dev liblua5.3-dev

```

---

# **2. 下载并编译 ModSecurity v3（库）**

```bash
cd /usr/local/src
sudo git clone --depth 1 https://github.com/SpiderLabs/ModSecurity
cd ModSecurity
sudo git submodule init
sudo git submodule update

sudo ./build.sh
sudo ./configure
sudo make
sudo make install

```

生成库文件：

```
/usr/local/modsecurity/lib/libmodsecurity.so

```

---

# **3. 下载并编译 Nginx + ModSecurity v3 Connector**

### 3.1 下载 Connector

```bash
cd /usr/local/src
sudo git clone --depth 1 https://github.com/SpiderLabs/ModSecurity-nginx

```

### 3.2 下载并重新编译 Nginx（必须）

（示例使用 nginx 1.18，换成你自己版本号即可）

```bash
NGINX_VERSION=1.18.0

cd /usr/local/src
sudo wget http://nginx.org/download/nginx-$NGINX_VERSION.tar.gz
sudo tar zxvf nginx-$NGINX_VERSION.tar.gz
cd nginx-$NGINX_VERSION

```

### 3.3 导出现有 Nginx 编译参数（非常重要）

```bash
nginx -V

```

你会看到一大串 `--with-xxx` 参数  
需要包含全部参数，并额外加：

```
--add-module=/usr/local/src/ModSecurity-nginx

```

例如：

```bash
sudo ./configure \
 --with-http_ssl_module \
 --with-http_v2_module \
 --add-module=/usr/local/src/ModSecurity-nginx

```

然后编译并替换 nginx：

```bash
sudo make
sudo cp objs/nginx /usr/sbin/nginx

```

---

# **4. 添加 ModSecurity 配置**

### 4.1 创建目录

```bash
sudo mkdir /etc/nginx/modsec
cd /etc/nginx/modsec

```

### 4.2 生成默认配置

```bash
sudo wget https://raw.githubusercontent.com/SpiderLabs/ModSecurity/v3/master/modsecurity.conf-recommended
sudo mv modsecurity.conf-recommended modsecurity.conf
sudo wget https://raw.githubusercontent.com/SpiderLabs/ModSecurity/v3/master/unicode.mapping

```

### 4.3 修改配置

```bash
sudo nano /etc/nginx/modsec/modsecurity.conf

```

修改：

```
SecRuleEngine On     # 开启防护模式

```

---

# **5. 加载 OWASP CRS 规则集（强烈推荐）**

```bash
cd /etc/nginx/modsec
sudo git clone https://github.com/coreruleset/coreruleset.git
sudo mv coreruleset rules
sudo cp rules/crs-setup.conf.example rules/crs-setup.conf

```

---

# **6. Nginx 中启用 ModSecurity**

编辑 nginx.conf 或 vhost：

```nginx
modsecurity on;
modsecurity_rules_file /etc/nginx/modsec/modsecurity.conf;

```

示例：

```nginx
server {
    listen 443 ssl;

    modsecurity on;
    modsecurity_rules_file /etc/nginx/modsec/modsecurity.conf;

    root /var/www/html;
}

```

---

# **7. 检查配置并重启 Nginx**

```bash
sudo nginx -t
sudo systemctl restart nginx

```

---

# 🚀 **8. 测试是否生效**

访问：

```
http://your_server/?id=' OR '1'='1

```

如返回 **403 Forbidden**，说明成功。

---

# 📌 若你提供当前 nginx -V 结果

我可以为你 **生成一条你直接复制粘贴即可编译成功的 configure 命令**，避免你手动拼接失败。

也可以根据你当前的生产环境，为你做：

✅ 自动安装脚本  
✅ 自动更新规则  
✅ 自动生成日志监控（fail2ban + CRS）  
✅ 满足 HTTPS + WAF 一次成功的完整工程方案

你需要我为你的环境直接生成一键安装脚本吗？

下面我根据你当前环境 **nginx:1.20.2 官方 Docker 镜像** 的编译参数，给你一套 **完全适配 Docker 环境的一键部署 ModSecurity v3 + CRS 规则** 的方案。

你现在用的是：

- **nginx:1.20.2 官方镜像（Debian）**
- 需要重新编译 Nginx + ModSecurity v3 Connector（因为官方镜像不带 WAF）
- 又是 Docker 环境 → **最佳方式是构建一个自定义镜像**

---

# ✅ **最稳定的方式：构建一个 “支持 ModSecurity 的 Nginx 1.20.2” 镜像**

下面我已经根据你的 **nginx -V 的 configure 参数** 自动生成了完整可直接使用的 **Dockerfile**。

你只需要复制即可使用。

---

# 🚀 **一、创建目录**

```bash
mkdir -p /home/shuncom/build/nginx-modsec
cd /home/shuncom/build/nginx-modsec

```

---

# 🚀 **二、创建 Dockerfile（直接复制即可）**

> 这个 Dockerfile 能构建出：  
> ✔ Nginx 1.20.2  
> ✔ ModSecurity v3  
> ✔ ModSecurity-nginx Connector  
> ✔ 完整支持 CRS 规则  
> ✔ 与你当前 nginx 配置完全兼容

---

## **Dockerfile：**

```dockerfile
FROM debian:bullseye

# 基础依赖
RUN apt update && apt install -y \
    git build-essential autoconf automake libtool \
    libpcre3 libpcre3-dev libssl-dev libxml2 libxml2-dev \
    libyajl-dev pkg-config doxygen curl wget \
    libcurl4-openssl-dev liblua5.3-dev ca-certificates && \
    apt clean

# 下载并编译 ModSecurity v3
RUN cd /usr/local/src && \
    git clone --depth 1 https://github.com/SpiderLabs/ModSecurity && \
    cd ModSecurity && git submodule update --init && \
    ./build.sh && ./configure && make && make install

# 下载 ModSecurity-nginx connector
RUN cd /usr/local/src && \
    git clone --depth 1 https://github.com/SpiderLabs/ModSecurity-nginx

# 下载 Nginx 1.20.2 源码
RUN cd /usr/local/src && \
    wget http://nginx.org/download/nginx-1.20.2.tar.gz && \
    tar zxvf nginx-1.20.2.tar.gz

# 按照你当前 nginx -V 参数编译 Nginx
RUN cd /usr/local/src/nginx-1.20.2 && \
    ./configure \
      --prefix=/etc/nginx \
      --sbin-path=/usr/sbin/nginx \
      --modules-path=/usr/lib/nginx/modules \
      --conf-path=/etc/nginx/nginx.conf \
      --error-log-path=/var/log/nginx/error.log \
      --http-log-path=/var/log/nginx/access.log \
      --pid-path=/var/run/nginx.pid \
      --lock-path=/var/run/nginx.lock \
      --http-client-body-temp-path=/var/cache/nginx/client_temp \
      --http-proxy-temp-path=/var/cache/nginx/proxy_temp \
      --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp \
      --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp \
      --http-scgi-temp-path=/var/cache/nginx/scgi_temp \
      --user=nginx \
      --group=nginx \
      --with-compat \
      --with-file-aio \
      --with-threads \
      --with-http_addition_module \
      --with-http_auth_request_module \
      --with-http_dav_module \
      --with-http_flv_module \
      --with-http_gunzip_module \
      --with-http_gzip_static_module \
      --with-http_mp4_module \
      --with-http_random_index_module \
      --with-http_realip_module \
      --with-http_secure_link_module \
      --with-http_slice_module \
      --with-http_ssl_module \
      --with-http_stub_status_module \
      --with-http_sub_module \
      --with-http_v2_module \
      --with-mail \
      --with-mail_ssl_module \
      --with-stream \
      --with-stream_realip_module \
      --with-stream_ssl_module \
      --with-stream_ssl_preread_module \
      --with-cc-opt='-g -O2 -ffile-prefix-map=/data/builder/debuild/nginx-1.20.2=. -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC' \
      --with-ld-opt='-Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie' \
      --add-module=/usr/local/src/ModSecurity-nginx && \
    make && make install

# 创建目录
RUN mkdir -p /etc/nginx/modsec /var/cache/nginx/

# 下载 ModSecurity 默认配置
RUN cd /etc/nginx/modsec && \
    wget https://raw.githubusercontent.com/SpiderLabs/ModSecurity/v3/master/modsecurity.conf-recommended && \
    mv modsecurity.conf-recommended modsecurity.conf && \
    wget https://raw.githubusercontent.com/SpiderLabs/ModSecurity/v3/master/unicode.mapping

# 下载 CRS 规则
RUN cd /etc/nginx/modsec && \
    git clone https://github.com/coreruleset/coreruleset.git && \
    mv coreruleset rules && \
    cp rules/crs-setup.conf.example rules/crs-setup.conf

CMD ["nginx", "-g", "daemon off;"]

```

---

# 🚀 **三、构建镜像**

```bash
cd /home/shuncom/build/nginx-modsec
docker build -t nginx:1.20.2-modsec .

```

---

# 🚀 **四、修改 docker-compose.yml 使用新镜像**

把你的：

```yaml
image: nginx:1.20.2

```

改成：

```yaml
image: nginx:1.20.2-modsec

```

---

# 🚀 **五、在 nginx.conf 启用 ModSecurity**

在你的 server 或 http 区块里加入：

```nginx
modsecurity on;
modsecurity_rules_file /etc/nginx/modsec/modsecurity.conf;

```

---

# 🚀 **六、重启服务**

```bash
docker-compose down
docker-compose up -d

```

---

# 🎉 **成功！你的 Nginx 已成功集成 ModSecurity v3 + CRS WAF。**

---

# 📌 可选：我可以帮你做以下增强

如果你需要，我可以继续为你：

### ✅ 自动放行健康检查和静态文件规则

### ✅ 自动过滤误报（特别是 CRS 默认误杀 POST JSON）

### ✅ 为你的业务创建豁免规则

### ✅ fail2ban 联动 WAF 拦截日志做自动封禁

### ✅ 给出完整的 `/etc/nginx/modsec/modsecurity.conf` 最佳实践

---

如果你愿意，我还可以：

👉 **直接给你一个适配你环境的“完整可运行” compose.yml + Dockerfile 打包工程目录**。

要继续吗？

好——我已经为你把 **自动放行健康检查/静态文件**、**CRS 对 POST JSON 的误报缓解**、**业务豁免规则**、**fail2ban 联动 ModSecurity 阻断日志自动封禁**，以及一份经常用到的 **`/etc/nginx/modsec/modsecurity.conf`（最佳实践版）** 都整理好了。你能直接把下面的片段复制到你当前容器/镜像里的对应位置（我按路径写好了）并逐条应用、测试。**先把 ModSecurity 设为 DetectionOnly（检测而不阻断）进行 24–72 小时观察，再切换到 On 阻断模式。**

---

# 说明与注意

1. **先备份** `/etc/nginx/modsec/modsecurity.conf` 与现有规则目录。
2. 在生产环境启用“阻断”模式前，先用 `SecRuleEngine DetectionOnly` 观察误报。
3. 我用的 rule id 范围（1000000～1000100）为自定义规则，和 CRS 原有 id 不冲突。
4. 下面给出的 nginx 示例为你 docker-compose 环境可用的配置片段。
5. 若你希望我把这些直接写入你生成的镜像/compose，我可以生成一个补丁包（不需要你再确认，直接应用也安全）——但我先把规则和说明放在这里，你可以分步执行。

---

# 1) 自动放行健康检查与静态文件（ModSecurity 规则）

把下面内容放到 `/etc/nginx/modsec/requests_exclusions.conf`，并在 `modsecurity.conf` 里 `Include` 这个文件（后面示例会显示如何 Include）。

```apacheconf
# /etc/nginx/modsec/requests_exclusions.conf
#
# 放行健康检查（URI 前缀、User-Agent 或来自负载均衡的特定 IP）
# 注意：用 phase:1 在最早阶段控制事务，id 必须唯一且 > 1000000 避免冲突

# 1) 放行 /health 和 /healthz 等健康检查路径（全部放行）
SecRule REQUEST_URI "@beginsWith /health" \
  "id:1000001,phase:1,pass,nolog,ctl:ruleEngine=Off"

SecRule REQUEST_URI "@beginsWith /healthz" \
  "id:1000002,phase:1,pass,nolog,ctl:ruleEngine=Off"

# 2) 放行特定探测 User-Agent（如 k8s kube-probe、ELB health）
SecRule REQUEST_HEADERS:User-Agent "kube-probe|ELB-HealthChecker" \
  "id:1000003,phase:1,pass,nolog,ctl:ruleEngine=Off"

# 3) 放行来自内网 LB 的 IP 列表（用空格分隔多个 IP）
# 例：10.0.0.5 为负载均衡器
SecRule REMOTE_ADDR "@ipMatch 10.0.0.5/32 10.0.1.0/24" \
  "id:1000004,phase:1,pass,nolog,ctl:ruleEngine=Off"

# 4) 静态文件（扩展名）直接放行（避免大文件/静态被误判）
SecRule REQUEST_URI "\.(?:css|js|png|jpg|jpeg|gif|webp|svg|ico|woff2?|ttf|map)(?:$|\?)" \
  "id:1000005,phase:1,pass,nolog,ctl:ruleEngine=Off"

```

解释：`ctl:ruleEngine=Off` 会关闭该次请求的规则检查（适用于确实只读、无风险的健康/静态请求）。如果你更保守，也可以把 `ctl:ruleEngine=DetectionOnly`。

---

# 2) 自动过滤 CRS 对 POST JSON 的误报（两种策略：优先推荐 Method A）

**目的**：避免 CRS 将正常的 `application/json` POST 内容识别为 SQLi/XSS 等（常见误报场景）。

## A）方案 A（推荐）—— 为 JSON 请求使用 JSON 解析器并降低 Body 规则

把以下放进 `/etc/nginx/modsec/json_tuning.conf`：

```apacheconf
# /etc/nginx/modsec/json_tuning.conf
# 在 phase:1 将 requestBodyProcessor 设为 JSON（更稳定），并对常见会误报的规则作“局部关闭/降低”或开启检测模式

# 1) 对所有 Content-Type: application/json 的请求：
SecRule REQUEST_HEADERS:Content-Type "application/json" \
  "id:1000010,phase:1,pass,nolog,ctl:requestBodyProcessor=JSON,ctl:ruleEngine=DetectionOnly"

# 2) 对特定 URI 前缀（例如 /api/）优先把评分阈值提升（如果你使用 Anomaly Scoring）
# 这里将 transaction 的评分阈值在后续阶段提高（示例：+10）
SecRule REQUEST_URI "@beginsWith /api/" \
  "id:1000011,phase:1,pass,nolog,ctl:requestBodyProcessor=JSON,ctl:ruleRemoveByTag=OWASP_CRS/WEB_ATTACK/PROTOCOL_VIOLATION"

# 说明：
# - 第一条把 JSON 请求的 body 解析器设为 JSON（比默认的 urlencoded/text 解析更稳）
# - 同时把 ruleEngine 设为 DetectionOnly（检测模式），以便观察具体哪个规则误报
# - 第二条示例展示了如何按 tag 移除一类 CRS 规则（替换成你实际要移除的 tag）

```

> 备注：如果你不想把整条 JSON 请求都设为 DetectionOnly，可把 `ctl:ruleEngine=DetectionOnly` 去掉，改为 `ctl:ruleRemoveById=xxxx,ctl:ruleRemoveByTag=tagname` 精确移除若干误报规则（但需要先通过检测模式查出误报的 rule id 或 tag）。

## B）方案 B（保守）—— 对指定接口禁用 request body 检查（节制使用）

例如 `/api/webhook/`，如果这类接口经常被误报，可以完全禁用 Body 检查：

```apacheconf
# /etc/nginx/modsec/json_tuning.conf (补充)
SecRule REQUEST_URI "@beginsWith /api/webhook" \
  "id:1000015,phase:1,pass,nolog,ctl:requestBodyAccess=Off,ctl:ruleEngine=DetectionOnly"

```

> 注意：`requestBodyAccess=Off` 会完全跳过对 body 的检查 —— 适合那些你非常信任且只需要 header 校验的 webhook。

---

# 3) 为业务创建豁免规则（按 URI、按 header、按 IP、按 cookie）

将下面文件保存为 `/etc/nginx/modsec/business_exceptions.conf`：

```apacheconf
# /etc/nginx/modsec/business_exceptions.conf

# 1) 特定管理后台路径放宽（示例）
SecRule REQUEST_URI "@beginsWith /admin/" \
  "id:1000020,phase:1,pass,nolog,ctl:ruleEngine=DetectionOnly"

# 2) API Key header 的服务间调用放行（例 header: X-Internal-API-Key）
SecRule REQUEST_HEADERS:X-Internal-API-Key "@rx ^[A-Za-z0-9\-_]{20,}$" \
  "id:1000021,phase:1,pass,nolog,ctl:ruleEngine=Off"

# 3) 对某些 Cookie（内网 SSO）放宽
SecRule REQUEST_COOKIES:SSO_SESSION "@rx ^[A-Za-z0-9\-_=]{10,}$" \
  "id:1000022,phase:1,pass,nolog,ctl:ruleEngine=DetectionOnly"

```

原则：**越明确的匹配越安全**（例如固定 URL 前缀、固定 header 名称或仅在内网 IP 生效）。

---

# 4) fail2ban 联动 WAF（通过 Nginx error.log 中 ModSecurity 拦截日志自动封禁）

## 4.1 在 modsecurity.conf 中保证拦截会在 nginx error.log 打出一句可匹配的日志

在 `modsecurity.conf` 中确保 `SecAuditLog` 与 nginx error\_log 配置合理；同时 nginx/ErrorLog 通常会打印 ModSecurity 拒绝语句，例如：

```
[error] 12345#0: *12345 ModSecurity: Access denied with code 403 (phase 2). Pattern match "..." at ARGS:username. [...]

```

（你的 nginx 已经以 `--error-log-path=/var/log/nginx/error.log` 编译）

## 4.2 fail2ban filter（文件： `/etc/fail2ban/filter.d/modsecurity.conf`）

```ini
# /etc/fail2ban/filter.d/modsecurity.conf
[Definition]
failregex = \[error\].*ModSecurity: Access denied with code 403.*client: <HOST>
            \[error\].*ModSecurity: Access denied with code 403.*client: <HOST>\]
ignoreregex =

```

> 说明：某些系统的 error.log 里格式不同，上面是常见匹配。你启动 DetectionOnly 后，可触发一次人工封堵，观察 nginx error.log 中实际行格式，再调整 `failregex`（我可以帮你精确化）。

## 4.3 fail2ban jail（文件： `/etc/fail2ban/jail.d/modsecurity.local`）

```ini
# /etc/fail2ban/jail.d/modsecurity.local
[modsecurity]
enabled  = true
filter   = modsecurity
action   = iptables-allports[name=ModSecurity, port="http,https"]
logpath  = /var/log/nginx/error.log
maxretry = 3
findtime = 600
bantime  = 3600

```

## 4.4 启动 / 重载 fail2ban

```bash
sudo systemctl restart fail2ban
# 检查状态
sudo fail2ban-client status modsecurity
sudo fail2ban-client status

```

**测试方法**：临时在 nginx 上触发一个可被 ModSecurity 拦截的请求（在检测模式下生成 error.log 行），观察 fail2ban 是否识别并封禁 IP。生产中建议把 `bantime` 和 `maxretry` 调到合适值。

---

# 5) 把这些文件包含进主 `modsecurity.conf`（示例）

在 `/etc/nginx/modsec/modsecurity.conf` 末尾添加：

```apacheconf
# include your tuning files (order matters: exclusions should be early)
Include /etc/nginx/modsec/requests_exclusions.conf
Include /etc/nginx/modsec/json_tuning.conf
Include /etc/nginx/modsec/business_exceptions.conf

```

（或在 `nginx.conf` 指定 `modsecurity_rules_file` 指向一个总入口规则文件，这个入口再 Include 上述子文件。）

---

# 6) 推荐的 `modsecurity.conf` 精简 / 最佳实践（关键条目）

下面是一个**精简但实用**的 `/etc/nginx/modsec/modsecurity.conf`（把常用且重要的选项都列上），你可以直接替换或合并到现有配置中。注意注释 —— **按需修改**。

> 将下面内容保存为 `/etc/nginx/modsec/modsecurity.conf`（替换原文件前请备份）。

```apacheconf
# /etc/nginx/modsec/modsecurity.conf (best-practice compact)

# 基本运行模式：先用 DetectionOnly 监测 24-72 小时，确认没大量误报再改为 On
SecRuleEngine DetectionOnly

# 日志与审计
SecAuditEngine RelevantOnly
SecAuditLog /var/log/modsec_audit.log
# Parts: A (request headers), B (request body), F (response headers), H (audit log trailer)...
SecAuditLogParts ABIJDEFHZ
SecAuditLogType Serial
SecAuditLogStorageDir /var/log/modsec_audit/

# 全局默认动作（Anomaly scoring 推荐）
SecDefaultAction "phase:1,log,pass"
SecDefaultAction "phase:2,log,deny,status:403"

# 请求体/响应体访问控制（默认开启请求体检查）
SecRequestBodyAccess On
SecRequestBodyLimit 13107200       # 12.5 MB （根据业务调整）
SecRequestBodyNoFilesLimit 131072  # 非文件 body 限制（128KB）
SecRequestBodyInMemoryLimit 131072 # 128KB

# 最大文件上传限制（CRS 有时也需要）
SecUploadDir /var/cache/modsecurity/uploads
SecRequestBodyLimitAction Reject

# 响应体分析（默认关闭，除非特定需求）
SecResponseBodyAccess Off
# 若开启，限制大小以免 OOM
SecResponseBodyLimit 5242880       # 5 MB

# utf-8 / unicode 映射
SecUnicodeMapFile /etc/nginx/modsec/unicode.mapping

# 安全策略：允许临时禁用某些规则
# (自定义 rules 文件在后面 Include)

# 兼容 CRS：指定 CRS path（CRS 安装后）
Include /etc/nginx/modsec/rules/*.conf

# 方便调试（生产建议关闭调试）
#SecDebugLog /var/log/modsec_debug.log
#SecDebugLogLevel 3

# 速率限制集成点（如与你的 nginx limit_req 联动）
# 若使用 Anomaly Scoring，设定阈值（示例）
#SecAction "id:900000,phase:1,pass,initcol:ip=%{REMOTE_ADDR},setvar:ip.score=0"

# 自定义 include（放在最后，保证你自定义的排除/豁免被加载）
Include /etc/nginx/modsec/requests_exclusions.conf
Include /etc/nginx/modsec/json_tuning.conf
Include /etc/nginx/modsec/business_exceptions.conf

```

> 说明：
> 
> - `SecAuditEngine RelevantOnly`：只记录含有触发或异常的事务，避免太大日志。也可改为 `On` 全记录（日志量大）。
> - `SecRequestBodyLimit` 必须高于你 APP 最大 POST 大小（例如文件上传）。
> - `SecResponseBodyAccess Off` 推荐默认关闭（响应体检查 CPU/内存消耗较高）。

---

# 7) nginx 侧的配置（把 modsecurity 打开并指定配置文件）

在你的 `nginx.conf` `http {}` 或具体 `server{}` 中加入：

```nginx
# 在 http {} 顶部（或 server/ location）
load_module modules/ngx_http_modsecurity_module.so;

modsecurity on;
modsecurity_rules_file /etc/nginx/modsec/modsecurity.conf;

```

（你在镜像里编译时，已经用 modsecurity-nginx connector 集成，确保 load\_module 路径与你镜像实际模块路径一致。官方编译为动态模块时需要 load\_module；静态编译可直接用 `modsecurity on;`）

---

# 8) 从 DetectionOnly 到 On 的迁移步骤（建议流程）

1. 在 `modsecurity.conf` 保持 `SecRuleEngine DetectionOnly`，启动并观察 48–72 小时。
2. 收集误报：`/var/log/modsec_audit.log` 与 nginx error.log。找出误报的 rule id（记录会标出匹配 id）。
3. 对高误报的 rule 使用 `ctl:ruleRemoveById=ID` 或写更精确的 `SecRule` 以排除。也可以把特定 URI 设为 `ruleEngine=Off`。
4. 调整 Anomaly Scoring 阈值（CRS 有 `threshold`）或把某些 router 设置为 DetectionOnly。
5. 确认误报控制在可接受范围后，将 `SecRuleEngine On` 切换为阻断模式。
6. 继续定期检查 audit logs，更新豁免规则。

---

# 9) 常见调优建议（实战小贴士）

- 把 `health` 与 `static` 放在最前面（phase:1），减轻 WAF 负担。
- 对 JSON heavy API：优先使用 JSON 解析器（`ctl:requestBodyProcessor=JSON`）。
- 大流量场景开启 `SecAuditEngine RelevantOnly`，并把 `SecAuditLog` 存到独立磁盘或集中收集（ELK）。
- 配合 `limit_req` / `limit_conn` 做 L7 防刷，并用 fail2ban 及时封禁扫描源。
- CRS 默认规则集经常更新，务必定期 `git pull` 并在预演环境运行测试。
- 保持规则 id 表的文档（哪些是你添加的、哪些被移除），便于审计。

---

# 10) 测试用例（快速验证）

- 健康检查：`curl -I http://yourhost/health` → 应该返回 200，不被 WAF 阻断
- 静态文件：`curl -I http://yourhost/static/image.jpg` → 200
- JSON POST：`curl -X POST -H 'Content-Type: application/json' -d '{"name":"a"}' http://yourhost/api/test` → 应该不被误报（先确认 DetectionOnly 模式里没有规则触发）
- 模拟注入（仅检测模式）：`curl "http://yourhost/?id=' or 1=1 --"` → 应触发日志（如果 DetectionOnly，会记录但不阻断）

---

如果你要，我可以**立刻**：

- 基于你当前 docker-compose 路径，生成一份补丁包，包括 Dockerfile 的小改动（把文件写入镜像）和 `docker-compose.override.yml` 的示例，或
- 根据你 48 小时检测日志（把一段 `modsec_audit.log` 的 sample 粘过来），我来直接帮你写精确的 `ctl:ruleRemoveById` 列表和 fail2ban 正则优化。

你想直接把这些规则放进容器（我给出准确命令）还是先试运行并把检测期的 audit 日志贴过来让我分析误报？

下面我给你总结一套 **Nginx + ModSecurity v3 + CRS WAF** 在实际生产环境中能实现的 **完整安全能力**（涵盖 OWASP Top 10、常见 Web 攻击、Bot 防护、协议校验、日志与响应体系），便于你评估是否满足你的公司平台安全需求。

---

# ⭐ **总体来看：ModSecurity v3 + CRS = 企业级 Web 反向代理型 WAF**

具备完整 **应用层防护**（L7 Security），覆盖：

- OWASP Top 10（SQL、XSS、文件包含、权限绕过…）
- 业务层安全保护（参数校验、攻击语义分析）
- 协议校验（HTTP RFC）
- 智能启发式攻击识别
- 日志、审计、行为分析
- 与 Nginx 完美集成，性能远优于 ModSec v2

---

# 🛡 **一、网络 &amp; 协议层安全**

ModSecurity v3 + CRS 对 HTTP 协议提供严格校验：

### ✔ HTTP RFC 规范校验

- 检查 HTTP 头是否合法
- 检查非法方法（如 `TRACE`、`CONNECT`）
- 检查过长 URI、Header、Body
- 防止 Request Smuggling（请求走私）
- 防止 Response Splitting（响应拆分）

### ✔ 防御异常连接行为

- FD（文件描述符）耗尽
- 无效 Content-Length
- Chunked 伪造攻击
- 不完整的 multipart 请求

---

# 🧬 **二、覆盖所有 OWASP Top 10 攻击类型**

## 1. SQL 注入（SQLi）

CRS 能检测：

- 单引号、注释符尝试
- `UNION SELECT`
- `OR 1=1`
- `sleep(5)` / 盲注
- MySQL / PostgreSQL / MSSQL 语义特征

**支持高级语义识别：绕过编码、空格替换、%00、HEX 编码、ASCII 编码等。**

---

## 2. XSS 跨站脚本攻击

包括：

- `<script>` 注入
- onload、onclick、javascript:、data:
- DOM XSS
- 编码绕过（HTML/URL/Base64）

---

## 3. 路径遍历 / 本地文件包含（LFI）

拦截：

- `/../../etc/passwd`
- `php://filter/resource=`
- `file:///`

---

## 4. 远程文件包含（RFI）

检测：

- `http://evil.com/shell.jpg`
- 远程 PHP 包含
- URL 伪装/重定向攻击

---

## 5. 命令注入（CMD Injection）

识别：

- `; rm -rf /`
- `| cat /etc/passwd`
- "`$()`"、"`"反引号
- PowerShell / Bash 命令

---

## 6. 代码注入

- PHP、JSP、Lua、Python 注入
- eval(), system(), exec()

---

## 7. Java 序列化漏洞攻击

- CommonsCollections payload
- JRMP
- ysoserial 攻击流量特征

---

## 8. 反序列化 / JSON 注入

- JSON 结构污染
- 注入脚本
- 流量中含反序列化特征序列

---

## 9. 可疑 UA/Referer 等异常行为

- BurpSuite、sqlmap
- Nmap、masscan
- Python requests, curl
- 自写攻击脚本流量模式

---

# 🧱 **三、Bot 管控能力（CRS + 规则策略）**

CRS 自带 Bot 检测：

- 自动识别扫描器（sqlmap、nmap、Nikto）
- 自动识别爬虫 UA
- 识别异常访问模式
- 可选：灰名单 + 速率限制
- 与 Nginx limit\_req 配合可实现 Anti-DDoS L7 防护

---

# 🗂 **四、文件上传防护**

拦截：

- 上传包含恶意 Payload 的文件
- PHP 藏木马
- 伪造图片 “JPG+PHP”
- multipart 边界异常
- Content-Type 伪造

可限制：

- 文件类型
- MIME / 后缀匹配
- 文件大小
- 文件内容特征匹配

---

# 🔐 **五、业务参数验证 / 防数据泄露 (DLP)**

CRS 能发现敏感信息：

- 身份证号
- 手机号码
- 银行卡号
- 邮箱地址泄露
- Base64 隐写数据
- 内部系统路径泄露

---

# 🧠 **六、启发式攻击检测（Heuristic Detection）**

CRS 具有“语义检测”：

- 判断攻击意图，而不仅是关键字
- 多规则分段评分 → 很难绕过
- 自动组合行为判断
- 流量模式检测（多次试探攻击）

这类智能特征识别能力比传统 Web 防火墙更强。

---

# 📊 **七、日志、审计、可视化、安全分析能力**

ModSecurity v3 支持：

### ✔ 全流量审计日志（可选）

包括：

- 请求头
- 请求 Body
- 响应头、Body
- 匹配的 WAF 规则
- 攻击来源 IP &amp; 时间

可以接入：

- ELK（Kibana）
- Loki / Grafana
- SIEM（如阿里云、Wazuh 等）

---

# 🛑 **八、误报处理能力（非常关键）**

- CRS 支持 “Anomaly Scoring 模式”（推荐，不会随便 403）
- 低误报、多级评分
- 业务参数豁免（白名单）
- 自定义规则（放行或增强）

**ModSecurity v3 + CRS 是市场上误报处理体验最好的开源 WAF。**

---

# 🚀 **九、可扩展能力（强大）**

你可以编写自己的规则：

- 阻止某类接口访问
- 参数只允许特定格式
- 某些 IP 禁止访问
- 某些路径强制加密
- 防止越权访问（基于 Referer / Cookie）

语法非常灵活，能满足绝大多数企业业务安全场景。

---

# 🏁 **总结：ModSecurity v3 + CRS 能提供什么？**

## ✔ 完整 OWASP Top 10 防护

## ✔ SQL/XSS/Upload/LFI/RFI/CMD 等注入防护

## ✔ Anti-Bot / Anti-Scanner

## ✔ 文件上传安全

## ✔ HTTP 协议规范校验

## ✔ 审计日志 / 攻击分析

## ✔ 灵活的业务规则扩展

## ✔ 企业级 Web 安全防护能力

适合：

- 企业内网平台
- B/S 架构项目
- Java/PHP/Python/Go 任意 Web 系统
- API 网关安全支持

---

# 📌 如果你需要

我可以继续提供：

### 🔧 1）你项目的 **专属 ModSecurity 配置最佳实践**（降低误报）

### 📁 2）自动优化后的 CRS 配置

### 🛡 3）适合生产环境的 WAF 规则模板

### 🔍 4）日志分析 + 告警体系

### ⚙ 5）你 Nginx 环境的“一键开启 WAF/CRS”配置

需要的话告诉我你的业务接口类型（REST、表单、上传等），我可以为你生成 **定制化规则**。

# 服务器为什么会发 RST

下面这部分我会**严格从 TCP 协议与 Linux 内核实现角度**来讲“**服务器为什么会发 RST**”，不做泛泛而谈，给你的是**能用于抓包分析、问题定性、对外解释的判断逻辑**。

---

# 一、一句话总览（给结论）

> **服务器发送 RST，不是“情绪行为”，而是 TCP 状态机在发现“当前报文与连接状态不一致”时的强制纠错机制。**

换句话说：

> **RST = “这个报文在我看来是非法的 / 不可能的 / 不被接受的”**

---

# 二、TCP 中 RST 的协议级定义

根据 **RFC 793 / RFC 1122**：

服务器**必须发送 RST**的典型条件：

1. 收到一个 **不存在连接的报文**
2. 收到一个 **序列号不可接受的报文**
3. 收到一个 **状态不合法的报文**
4. 应用层明确要求立即中断连接

RST 的作用只有一个：

> **立即终止 TCP 连接并释放所有状态**

---

# 三、服务器“主动”发送 RST 的核心判断逻辑（按内核顺序）

以下逻辑可理解为 **Linux TCP 内核的决策流程**。

---

## 1️⃣ 收到报文后，先查“连接是否存在”

### 判断点

- 是否能在内核 TCP 连接表中找到：
    
    ```
    src IP + src port + dst IP + dst port
    
    ```

### 结果

<table id="bkmrk-%E7%BB%93%E6%9E%9C-%E8%A1%8C%E4%B8%BA-%E6%89%BE%E5%88%B0-%E8%BF%9B%E5%85%A5%E4%B8%8B%E4%B8%80%E6%AD%A5-%E6%9C%AA%E6%89%BE%E5%88%B0-%E7%9B%B4"><thead><tr><th>结果</th><th>行为</th></tr></thead><tbody><tr><td>找到</td><td>进入下一步</td></tr><tr><td>未找到</td><td>**直接回 RST**</td></tr></tbody></table>

### 抓包特征

- RST 通常带 ACK
- ACK = 对方 seq + len

---

## 2️⃣ 连接存在，但 TCP 状态是否合法？

### 状态机合法性校验

例如：

<table id="bkmrk-%E5%BD%93%E5%89%8D%E7%8A%B6%E6%80%81-%E6%94%B6%E5%88%B0%E6%8A%A5%E6%96%87-%E8%A1%8C%E4%B8%BA-establi"><thead><tr><th>当前状态</th><th>收到报文</th><th>行为</th></tr></thead><tbody><tr><td>ESTABLISHED</td><td>正常 ACK</td><td>继续</td></tr><tr><td>ESTABLISHED</td><td>SYN</td><td>**RST**</td></tr><tr><td>FIN\_WAIT</td><td>数据包</td><td>**RST**</td></tr><tr><td>CLOSED</td><td>任意</td><td>**RST**</td></tr></tbody></table>

---

## 3️⃣ 序列号（Sequence Number）是否在接收窗口内？

### 判断点

- `seq` 是否在：
    
    ```
    rcv_nxt ≤ seq < rcv_nxt + rcv_wnd
    
    ```

### 不在窗口内

- 被视为 **无效或重放报文**
- **直接 RST**

> ⚠️ NAT 重映射、出口 IP 变更最容易触发这一点

---

## 4️⃣ TCP Flag 组合是否合法？

非法组合示例：

- SYN + FIN
- SYN + RST
- FIN + 数据 + 非法 seq

处理方式：

- **直接 RST**

---

## 5️⃣ 应用层主动要求“硬断”

这不是协议自动行为，而是程序逻辑。

### 常见方式

- `close()` + `SO_LINGER=0`
- 程序 crash
- 程序主动拒绝连接

结果：

- 内核直接发 RST
- 不进入 FIN/TIME\_WAIT

---

## 6️⃣ 安全 / 防火墙策略触发

虽然你看到的是“服务器 IP 发 RST”，但实际上可能是：

- iptables REJECT --reject-with tcp-reset
- conntrack 认为连接非法
- SYN flood 防护

---

# 四、结合你当前场景的“精准判断模型”

你描述的是：

> **通信一段时间后 → 服务器发 RST → 设备离线**

结合上面的逻辑，**最符合的是以下两类判断**：

---

## ✅ 场景 A（最高概率）：连接存在，但状态不一致

触发点：

- 运营商出口 IP 变更
- NAT 会话刷新
- 中间设备丢失状态

服务器看到的是：

> “这是一个我记得的连接，但你发来的 seq / ACK 对不上了”

→ **RST**

---

## ✅ 场景 B：服务器认为“这个连接已经不存在”

触发点：

- 长时间无数据
- 中间链路丢包
- keepalive 过长

服务器 TCP 表中：

> 连接已被回收

终端仍在发数据：

→ **RST**

---

## ❌ 最不可能的场景

- 服务器 BUG
- 内核异常
- 网络卡问题

如果是这些：

- RST 会随机出现
- 不会与“出口 IP 变更”强相关

---

# 五、抓包中“如何一眼判断 RST 原因”（实战）

### 1️⃣ RST 是否带 ACK？

<table id="bkmrk-%E7%89%B9%E5%BE%81-%E7%BB%93%E8%AE%BA-rst-%2B-ack-%E5%AF%B9%E6%96%B9%E8%BF%9E%E6%8E%A5"><thead><tr><th>特征</th><th>结论</th></tr></thead><tbody><tr><td>RST + ACK</td><td>对方连接存在，但不接受当前状态</td></tr><tr><td>纯 RST</td><td>连接根本不存在</td></tr></tbody></table>

---

### 2️⃣ RST 的 ACK 值是否“合理”？

```text
ACK = 对方最后一个 seq + len

```

- 合理 → 状态机判定
- 乱值 → 防火墙代发

---

### 3️⃣ TTL 是否异常？

- TTL 与正常数据包一致 → 服务器内核
- TTL 明显更小 / 不一致 → 中间设备

---

# 六、为什么“服务器重启不解决问题”（用这个逻辑解释）

服务器重启后：

- TCP 连接表清空
- 终端仍在旧状态
- 第一包数据 → “连接不存在”
- **立刻 RST**

所以：

> **重启服务器只会制造更多 RST，不会减少**

---

# 七、一句话总结（给你做结论用）

> **服务器发送 RST 的本质，是 TCP 状态机在发现连接状态不一致或非法报文时，执行的强制清理动作；它反映的是链路或会话状态问题，而非服务器主动异常。**

---

如果你愿意，下一步我可以：

- 按你现有抓包 **逐字段解析 RST 报文**
- 给你一份 **RST 排障速查表（字段级）**
- 帮你把这些内容整理成 **客户可读的技术解释版本**

你只要告诉我：  
👉 **是否有抓包（pcap）或截图？**

# nmap扫描https端口高危漏洞解决方案

你提供的 `nmap` 扫描结果是针对 **`www.xxxxxxx.com`** 的 SSL/TLS 加密套件（ciphers）探测，使用了：

```bash
nmap -sV -p 443 --script ssl-enum-ciphers www.xxxxxxxx.com

```

我们来逐项分析该结果是否安全、是否存在漏洞，并给出改进建议。

---

## 🔍 一、整体结论：⚠️ **存在严重安全隐患！不推荐用于生产环境**

<table id="bkmrk-%E9%A1%B9%E7%9B%AE-%E8%AF%84%E4%BB%B7-%E6%98%AF%E5%90%A6%E5%BC%80%E6%94%BE-https%EF%BC%9F-%E2%9C%85-"><thead><tr><th>项目</th><th>评价</th></tr></thead><tbody><tr><td>是否开放 HTTPS？</td><td>✅ 是（端口 443）</td></tr><tr><td>使用的服务器软件</td><td>⚠️ "Lego Server"（非主流/未知）</td></tr><tr><td>TLS 版本支持</td><td>❌ 支持 TLSv1.0 和 TLSv1.1（已弃用）</td></tr><tr><td>加密套件强度</td><td>❌ 包含多个弱加密算法（如 3DES、IDEA）</td></tr><tr><td>安全性等级</td><td>❌ 存在 **SWEET32 攻击风险**，建议立即修复</td></tr></tbody></table>

> 🛑 **关键警告**：此配置允许使用 **3DES 和 IDEA** 等已被证明不安全的加密算法，可能被攻击者利用进行中间人攻击或解密流量。

---

## 🧾 二、详细分析

### 1. **服务器信息**

```text
SERVICE: Lego Server
_http-server-header_: Lego Server

```

- “Lego Server” 不是常见 Web 服务器（如 Nginx、Apache、IIS），可能是自研或定制服务。
- 建议确认其来源和安全性，避免使用未经验证的中间件。

---

### 2. **TLS 版本支持**

```text
TLSv1.0:
TLSv1.1:

```

- ❌ **支持 TLS 1.0 和 TLS 1.1**： 
    - 这两个版本早在 **2020 年起就被主流浏览器和标准组织淘汰**。
    - 已知存在多种漏洞（如 POODLE、BEAST、CRIME）。
    - 多数现代客户端（Chrome、Firefox、iOS Safari）已不再信任这些协议。

> ✅ **建议**：立即禁用 TLS 1.0 和 TLS 1.1，仅保留 TLS 1.2 或更高版本。

---

### 3. **加密套件（Ciphers）**

#### 🔴 危险套件（需立即禁用）

```text
TLS_RSA_WITH_3DES_EDE_CBC_SHAKA (rsa 2048) - C
TLS_RSA_WITH_IDEA_CBC_SHA (rsa 2048) - A

```

- **3DES（Triple DES）**： 
    - 被认为是“**弱加密**”，且存在 **SWEET32 攻击** 漏洞。
    - SWEET32 攻击可在约 2^32 字节的数据传输后破解加密，适用于长期会话或大量数据通信。
- **IDEA**： 
    - 已被破解多年，不适合现代安全需求。

> ⚠️ **Nmap 明确提示**：
> 
> ```
> warnings:
>   64-bit block cipher 3DES vulnerable to SWEET32 attack
>   64-bit block cipher IDEA vulnerable to SWEET32 attack
> 
> ```

> ✅ **必须移除这两个套件！**

#### ⚠️ 其他潜在问题

- 所有套件均基于 **RSA 密钥交换**（而非 ECDHE），意味着： 
    - ❌ **无前向保密（Forward Secrecy）**
    - 如果私钥泄露，过去的所有通信都可被解密。
- 使用 **CBC 模式**（如 AES\_CBC、3DES\_CBC）： 
    - 相比 GCM 模式更易受填充 oracle 攻击（如 BEAST、POODLE）。
    - 尽管未直接暴露，但不应作为首选。

---

### 4. **压缩器（Compressors）**

```text
compressors: NULL

```

- ✅ 不启用压缩 → 避免 CRIME/BREACH 攻击风险。
- 正确做法！

---

### 5. **Cipher Preference**

```text
cipher preference: server

```

- 表示服务器决定使用的加密套件顺序。
- 对于安全配置来说，**应优先选择强加密套件**，但当前配置中却包含弱套件，因此仍不安全。

---

## 🛠️ 三、安全评级（SSLLabs 标准）

<table id="bkmrk-%E9%A1%B9%E7%9B%AE-%E5%BD%93%E5%89%8D%E7%8A%B6%E6%80%81-%E6%8E%A8%E8%8D%90%E7%9B%AE%E6%A0%87-tls-%E7%89%88%E6%9C%AC-"><thead><tr><th>项目</th><th>当前状态</th><th>推荐目标</th></tr></thead><tbody><tr><td>TLS 版本</td><td>TLS 1.0 / 1.1</td><td>TLS 1.2+（推荐 1.3）</td></tr><tr><td>加密套件</td><td>含 3DES、IDEA、CBC</td><td>仅使用 AEAD（GCM/ChaCha20）</td></tr><tr><td>前向保密</td><td>❌ 不支持</td><td>✅ 必须支持</td></tr><tr><td>弱密码</td><td>✅ 存在（3DES, IDEA）</td><td>❌ 必须移除</td></tr><tr><td>安全评分</td><td>⚠️ F / D（极差）</td><td>✅ A+</td></tr></tbody></table>

> 💡 参考 [SSL Labs Test](https://www.ssllabs.com/ssltest/)：此类配置通常得分为 **F 或 D**，无法通过 PCI-DSS、GDPR 等合规要求。

---

## ✅ 四、改进建议（强烈推荐）

### ✅ 1. **升级 TLS 版本**

```nginx
ssl_protocols TLSv1.2 TLSv1.3;

```

> 禁用 TLS 1.0 和 1.1。

### ✅ 2. **替换为强加密套件**

```nginx
ssl_ciphers 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256';

```

> 推荐使用：
> 
> - ECDHE（前向保密）
> - AES-GCM 或 ChaCha20-Poly1305
> - SHA256/SHA384 哈希

### ✅ 3. **禁用弱加密**

```nginx
ssl_ciphers '...';  # 上面的强套件列表
ssl_prefer_server_ciphers on;

```

### ✅ 4. **启用 HSTS 和 HTTP/2**

```nginx
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

```

### ✅ 5. **更换服务器软件（如适用）**

- “Lego Server” 名称可疑，建议确认是否为合法产品。
- 若为自研系统，请确保其具备安全审计机制。

---

## 🔐 五、如何验证改进效果？

运行以下命令重新扫描：

```bash
nmap -sV -p 443 --script ssl-enum-ciphers www.xxxxxxxxx.com

```

查看输出是否：

- 不再出现 `3DES`, `IDEA`
- 无 TLS 1.0/1.1
- 使用 ECDHE + GCM 或 ChaCha20

也可访问：  
🔗 [https://www.ssllabs.com/ssltest/](https://www.ssllabs.com/ssltest/)  
输入域名，获取专业安全评分。

---

## ✅ 总结

<table id="bkmrk-%E9%A1%B9%E7%9B%AE-%E6%98%AF%E5%90%A6%E6%AD%A3%E5%B8%B8%EF%BC%9F-%E5%BB%BA%E8%AE%AE-tls-%E7%89%88%E6%9C%AC-%E2%9D%8C"><thead><tr><th>项目</th><th>是否正常？</th><th>建议</th></tr></thead><tbody><tr><td>TLS 版本</td><td>❌ 不正常（支持 TLS 1.0/1.1）</td><td>✅ 禁用旧版</td></tr><tr><td>加密套件</td><td>❌ 含 3DES、IDEA（高危）</td><td>✅ 移除并替换</td></tr><tr><td>前向保密</td><td>❌ 不支持</td><td>✅ 必须启用 ECDHE</td></tr><tr><td>安全性</td><td>❌ 极差（存在 SWEET32 攻击风险）</td><td>⚠️ **立即整改**</td></tr><tr><td>服务器软件</td><td>⚠️ “Lego Server” 不明</td><td>✅ 核实来源</td></tr></tbody></table>

> 🚨 **结论**：当前配置**不符合现代安全标准**，存在明确的安全漏洞，**建议立即修复**，否则可能导致数据泄露、证书失效、用户信任下降等问题。

如需我帮你生成一份完整的 Nginx 安全配置模板（含 TLS 1.3、HSTS、OCSP Stapling 等），请告诉我你的具体环境（如是否使用 Let's Encrypt、是否需要 HTTP/2）。

# 修复ZooKeeper未授权访问漏洞

根据搜索结果和ZooKeeper安全最佳实践，我为您详细分析两种ACL配置方式的风险，并提供安全加固方案。

---

## 一、两种ACL配置方式风险分析

### ⚠️ 方式一（明文密码）- **高风险**

```bash
addauth digest user1:password1
setAcl / auth:user1:password1:cdrwa

```

<table id="bkmrk-%E9%A3%8E%E9%99%A9%E7%82%B9-%E8%AF%B4%E6%98%8E-%E9%A3%8E%E9%99%A9%E7%AD%89%E7%BA%A7-%E5%91%BD%E4%BB%A4%E5%8E%86%E5%8F%B2%E6%B3%84%E9%9C%B2-%E5%AF%86"><thead><tr><th align="left">风险点</th><th align="left">说明</th><th align="left">风险等级</th></tr></thead><tbody><tr><td align="left">**命令历史泄露**</td><td align="left">密码会保存在 `~/.bash_history` 中，任何能访问该文件的用户都可获取密码</td><td align="left">🔴 高</td></tr><tr><td align="left">**脚本明文存储**</td><td align="left">如写在部署脚本中，密码以明文形式存在于代码仓库</td><td align="left">🔴 高</td></tr><tr><td align="left">**进程列表暴露**</td><td align="left">`ps -ef` 可能显示含密码的命令行参数</td><td align="left">🟡 中</td></tr><tr><td align="left">**日志记录风险**</td><td align="left">如开启命令审计，密码可能被记录到系统日志</td><td align="left">🟡 中</td></tr></tbody></table>

### ✅ 方式二（密文密码）- **推荐**

```bash
setAcl / digest:user1:HYGa7IZRm2PUBFiFFu8xY2pPP/s=:cdrwa

```

<table id="bkmrk-%E4%BC%98%E5%8A%BF-%E8%AF%B4%E6%98%8E-%E5%AF%86%E7%A0%81%E4%B8%8D%E8%90%BD%E5%9C%B0-%E6%98%8E%E6%96%87%E5%AF%86%E7%A0%81%E4%B8%8D%E4%BC%9A%E5%87%BA%E7%8E%B0"><thead><tr><th align="left">优势</th><th align="left">说明</th></tr></thead><tbody><tr><td align="left">**密码不落地**</td><td align="left">明文密码不会出现在脚本、历史命令中</td></tr><tr><td align="left">**哈希不可逆**</td><td align="left">SHA1+Base64编码，无法反向推导原始密码</td></tr><tr><td align="left">**符合安全审计**</td><td align="left">满足等保/安全扫描要求</td></tr></tbody></table>

---

## 二、安全配置完整方案

### 步骤1：生成密码密文（在安全环境执行）

```bash
# 方法：使用openssl生成digest哈希（推荐在临时环境执行，执行后清除历史）
echo -n "admin:YourSecurePassword123" | openssl dgst -sha1 -binary | base64
# 输出示例：HYGa7IZRm2PUBFiFFu8xY2pPP/s=

```

**安全提示**：

- 执行后立即运行 `history -c` 清除命令历史
- 或使用 `unset HISTFILE` 临时禁用历史

### 步骤2：配置ZooKeeper ACL（使用密文）

```bash
# 连接ZooKeeper
/usr/local/zookeeper-3.4.13/bin/zkCli.sh -server localhost:2181

# 添加认证（此步骤密码会短暂明文，但不会持久化）
addauth digest admin:YourSecurePassword123

# 设置根节点ACL（使用密文）
setAcl / digest:admin:HYGa7IZRm2PUBFiFFu8xY2pPP/s=:cdrwa

# 验证ACL设置
getAcl /

# 退出
quit

```

### 步骤3：清理敏感痕迹

```bash
# 清除bash历史
history -c
history -w

# 检查并清理可能含密码的文件
grep -r "password" /home/shuncom/ --include="*.sh" --include="*.log"

```

---

## 三、针对现有部署脚本的安全修改建议

### 📝 修改后的安全部署脚本

```bash
#!/bin/bash
# ZooKeeper安全部署脚本 (修订版)

# ========== 安全配置变量 ==========
ZK_USER="shuncom"
ZK_GROUP="shuncom"
ZK_HOME="/usr/local/zookeeper-3.4.13"
ZK_LOG_DIR="/home/shuncom/log/zookeeper"
# ⚠️ 密码应从安全配置中心获取，不要硬编码
# ZK_PASSWORD="从密钥管理系统读取"

# ========== 基础部署 ==========
sudo tar -zxvf zookeeper-3.4.13.tar.gz -C /usr/local
sudo chown -R ${ZK_USER}.${ZK_GROUP} ${ZK_HOME}

# ========== Java环境配置 ==========
sudo touch ${ZK_HOME}/conf/java.env
cat <<EOF | sudo tee ${ZK_HOME}/conf/java.env > /dev/null
export JAVA_HOME=/usr/local/jdk1.8.0_111
# 安全加固：限制JVM内存，防止DoS
export JVMFLAGS="-Xmx512m -Xms256m"
EOF

# ========== 日志配置（保留原有配置） ==========
sudo mv ${ZK_HOME}/conf/log4j.properties ${ZK_HOME}/conf/log4j.properties.bak
sudo mkdir -p ${ZK_LOG_DIR}
sudo chown -R ${ZK_USER}.${ZK_GROUP} ${ZK_LOG_DIR}
cat <<EOF | sudo tee ${ZK_HOME}/conf/log4j.properties > /dev/null
# （保持原有log4j配置内容）
log4j.rootLogger=INFO, ROLLINGFILE
log4j.appender.ROLLINGFILE=org.apache.log4j.RollingFileAppender
log4j.appender.ROLLINGFILE.Threshold=INFO
log4j.appender.ROLLINGFILE.File=${ZK_LOG_DIR}/zookeeper.log
log4j.appender.ROLLINGFILE.MaxFileSize=10MB
log4j.appender.ROLLINGFILE.layout=org.apache.log4j.PatternLayout
log4j.appender.ROLLINGFILE.layout.ConversionPattern=%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n
EOF

# ========== 安全加固：zoo.cfg配置 ==========
cp ${ZK_HOME}/conf/zoo_sample.cfg ${ZK_HOME}/conf/zoo.cfg

# 追加安全配置
cat <<EOF | sudo tee -a ${ZK_HOME}/conf/zoo.cfg > /dev/null

# ===== 安全加固配置 =====
# 限制客户端连接数
maxClientCnxns=60
# 设置ACL默认策略（4lw命令白名单）
4lw.commands.whitelist=stat,ruok,conf,isro
# 禁用危险命令
disableAdminServer=true
EOF

# ========== 启动服务 ==========
sudo -u ${ZK_USER} ${ZK_HOME}/bin/zkServer.sh start
sleep 5
ps -fle | grep zookeeper | grep -v grep

# ========== ACL配置提示（不自动执行，需手动） ==========
echo ""
echo "===== 安全提示 ====="
echo "1. 请使用以下命令手动配置ACL（密码不要写在脚本中）："
echo "   ${ZK_HOME}/bin/zkCli.sh -server localhost:2181"
echo "   > addauth digest admin:YOUR_PASSWORD"
echo "   > setAcl / digest:admin:HASH_VALUE:cdrwa"
echo "2. 密码哈希生成命令："
echo "   echo -n 'admin:YOUR_PASSWORD' | openssl dgst -sha1 -binary | base64"
echo "3. 配置完成后执行：history -c 清除命令历史"
echo "===================="

```

---

## 四、额外安全加固措施（针对Ubuntu 14.04）

由于 **Ubuntu 14.04已于2019年停止标准支持**，需额外加固：

<table id="bkmrk-%E5%8A%A0%E5%9B%BA%E9%A1%B9-%E9%85%8D%E7%BD%AE%E6%96%B9%E6%B3%95-%E4%BC%98%E5%85%88%E7%BA%A7-%E7%BD%91%E7%BB%9C%E9%9A%94%E7%A6%BB-%E9%98%B2%E7%81%AB"><thead><tr><th align="left">加固项</th><th align="left">配置方法</th><th align="left">优先级</th></tr></thead><tbody><tr><td align="left">**网络隔离**</td><td align="left">防火墙仅允许应用服务器IP访问2181端口</td><td align="left">🔴 必须</td></tr><tr><td align="left">**系统升级**</td><td align="left">尽可能升级到受支持的Ubuntu版本</td><td align="left">🔴 必须</td></tr><tr><td align="left">**文件权限**</td><td align="left">`chmod 700` 限制ZK配置文件仅所有者可读写</td><td align="left">🟡 推荐</td></tr><tr><td align="left">**日志审计**</td><td align="left">开启auditd监控ZK配置文件变更</td><td align="left">🟡 推荐</td></tr><tr><td align="left">**定期轮转**</td><td align="left">每90天更换ZK认证密码</td><td align="left">🟡 推荐</td></tr></tbody></table>

### 防火墙配置示例

```bash
# 仅允许应用服务器IP访问ZooKeeper端口
sudo ufw allow from 192.168.1.0/24 to any port 2181 proto tcp
sudo ufw deny 2181/tcp  # 拒绝其他所有访问

```

### 文件权限加固

```bash
# 限制配置文件权限
chmod 700 /usr/local/zookeeper-3.4.13/conf
chmod 600 /usr/local/zookeeper-3.4.13/conf/zoo.cfg
chmod 600 /usr/local/zookeeper-3.4.13/conf/java.env

# 限制日志文件权限
chmod 750 /home/shuncom/log/zookeeper
chmod 640 /home/shuncom/log/zookeeper/*.log

```

---

## 五、漏洞修复验证清单

完成配置后，请使用以下命令验证：

```bash
# 1. 验证根节点ACL
/usr/local/zookeeper-3.4.13/bin/zkCli.sh -server localhost:2181 <<EOF
getAcl /
quit
EOF
# 预期输出：'world,'anyone' 应不存在，只有 'digest:admin:xxx'

# 2. 验证未认证访问被拒绝
# 新开终端（未addauth）尝试访问
/usr/local/zookeeper-3.4.13/bin/zkCli.sh -server localhost:2181 <<EOF
ls /
# 预期：Authentication is not valid
quit
EOF

# 3. 检查命令历史无密码
grep -i "password\|passwd" ~/.bash_history
# 预期：无输出

# 4. 检查端口暴露情况
netstat -tlnp | grep 2181
# 确认仅监听必要IP

```

---

## 六、总结建议

<table id="bkmrk-%E9%A1%B9%E7%9B%AE-%E5%BB%BA%E8%AE%AE-acl%E9%85%8D%E7%BD%AE%E6%96%B9%E5%BC%8F-%E2%9C%85-%E4%BD%BF%E7%94%A8%E6%96%B9%E5%BC%8F"><thead><tr><th align="left">项目</th><th align="left">建议</th></tr></thead><tbody><tr><td align="left">**ACL配置方式**</td><td align="left">✅ 使用方式二（密文），避免明文密码落地</td></tr><tr><td align="left">**密码管理**</td><td align="left">✅ 使用密钥管理系统或加密配置文件存储密码</td></tr><tr><td align="left">**脚本安全**</td><td align="left">✅ 部署脚本中不包含密码，ACL配置单独手动执行</td></tr><tr><td align="left">**系统安全**</td><td align="left">⚠️ Ubuntu 14.04已过保，建议制定升级计划</td></tr><tr><td align="left">**网络访问**</td><td align="left">✅ 配置防火墙限制ZK端口仅内网访问</td></tr><tr><td align="left">**审计合规**</td><td align="left">✅ 定期更换密码，保留操作日志</td></tr></tbody></table>

按照以上方案实施后，可有效修复ZooKeeper未授权访问漏洞，满足安全扫描要求。

# ubuntu14.04用iptables添加屏蔽IP规则

在 Ubuntu 14.04 上屏蔽特定 IP（如 `192.168.95.80`）的所有访问，最常用且有效的方法是使用 **`iptables`**（Ubuntu 14.04 默认防火墙工具）或 **`ufw`**（Uncomplicated Firewall，如果已安装）。

以下是具体操作步骤：

### 方法一：使用 `iptables`（推荐，适用于所有 Ubuntu 14.04 系统）

`iptables` 是底层防火墙工具，Ubuntu 14.04 默认自带。

#### 1. 添加屏蔽规则

打开终端，运行以下命令将来自 `192.168.95.80` 的所有流量直接丢弃（DROP）：

```bash
sudo iptables -A INPUT -s 192.168.95.80 -j DROP

```

- `-A INPUT`: 追加规则到输入链（处理进入本机的流量）。
- `-s 192.168.95.80`: 指定源地址（Source）。
- `-j DROP`: 动作是丢弃数据包，不返回任何信息（对方会感觉超时）。

> **注意**：如果你希望对方收到“连接被拒绝”的提示而不是超时，可以将 `DROP` 改为 `REJECT`： `sudo iptables -A INPUT -s 192.168.95.80 -j REJECT` 通常为了安全隐蔽，建议使用 `DROP`。

#### 2. 验证规则是否生效

运行以下命令查看当前的防火墙规则列表：

```bash
sudo iptables -L -n --line-numbers

```

你应该能在 `INPUT` 链中看到类似这样的一行： `DROP       all  --  192.168.95.80      0.0.0.0/0`

#### 3. 【重要】永久保存规则

**Ubuntu 14.04 的 iptables 规则重启后会失效**，除非你手动保存。

**步骤 A：安装保存工具（如果尚未安装）**

```bash
sudo apt-get update
sudo apt-get install iptables-persistent

```

在安装过程中，它会询问是否保存当前的 IPv4 和 IPv6 规则，选择 `<Yes>`。

**步骤 B：如果已安装工具，手动保存** 如果你之前已经安装了 `iptables-persistent`，或者想手动更新保存：

```bash
sudo sh -c "iptables-save > /etc/iptables/rules.v4"

```

*(如果是 IPv6，则保存到 `/etc/iptables/rules.v6`)*

---

### 方法二：使用 `ufw`（仅限已启用 UFW 的系统）

如果你的系统已经启用了 `ufw`（可以通过 `sudo ufw status` 检查），可以使用更简单的命令。

#### 1. 添加拒绝规则

```bash
sudo ufw deny from 192.168.95.80

```

#### 2. 重载防火墙使规则生效

```bash
sudo ufw reload

```

#### 3. 验证

```bash
sudo ufw status numbered

```

你会看到一条 `Deny 192.168.95.80` 的规则。UFW 默认会自动持久化规则，重启后依然有效。

---

### 如何取消屏蔽？

如果你以后需要恢复该 IP 的访问：

**如果是用 `iptables` 添加的：**

1. 查看规则编号：`sudo iptables -L INPUT --line-numbers -n`
2. 找到对应 `192.168.95.80` 的编号（假设是 5）： ```bash
    sudo iptables -D INPUT 5
    
    ```
3. 记得重新保存：`sudo sh -c "iptables-save > /etc/iptables/rules.v4"`

**如果是用 `ufw` 添加的：**

```bash
sudo ufw delete deny from 192.168.95.80

```

### ⚠️ 特别提示

- **不要屏蔽自己**：如果你是通过 `192.168.95.80` 这台机器 SSH 连接到当前服务器的，执行上述命令后，**你的连接会立即断开且无法再连上**。请确保你在另一台机器上操作，或者通过控制台（Console/VNC）操作。
- **Ubuntu 14.04 已停止支持**：请注意 Ubuntu 14.04 (Trusty Tahr) 已于 2019 年结束标准支持，甚至扩展安全维护（ESM）也可能即将或已经结束。建议尽快规划升级到更新的 LTS 版本（如 20.04 或 22.04），以获得最新的安全补丁。

# firewall-cmd命令安全加固OpenClaw服务器

你当前的 **rich rule 写反了方向**。  
`destination address` 是 **目标地址**，表示“发往某个网段的流量”，而你需要的是 **限制来源地址 (source)** 访问本机。

因此规则应全部使用 `source address`。

另外还要注意 **规则优先级顺序**：

- 允许 `192.168.0.1`
- 再拒绝 `192.168.0.0/24`
- 再拒绝 `192.168.1.0/24`
- 再拒绝 `192.168.4.0/24`

否则 `192.168.0.1` 可能被 `/24` 规则误拦截。

---

# 一、先删除错误规则

```bash
firewall-cmd --permanent --remove-rich-rule='rule family="ipv4" destination address="192.168.4.0/24" reject'
firewall-cmd --permanent --remove-rich-rule='rule family="ipv4" destination address="192.168.1.0/24" reject'
firewall-cmd --permanent --remove-rich-rule='rule family="ipv4" source address="192.168.0.1" accept'

```

---

# 二、按正确逻辑添加规则

## 1 允许网关访问

```bash
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.0.1" accept'

```

---

## 2 禁止 192.168.0.0/24 访问（排除网关）

```bash
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.0.0/24" reject'

```

---

## 3 禁止其它两个网段

```bash
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" reject'

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.4.0/24" reject'

```

## 4 加上出站规则禁止本机访问其它四个网段，以下是所有规则

```
#入站规则
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.0.1" accept'
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.0.0/24" reject'
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" reject'
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.4.0/24" reject'
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.30.0/24" reject'
firewall-cmd --permanent --add-service=ssh

#出站规则
firewall-cmd --permanent \
--direct --add-rule ipv4 filter OUTPUT 0 \
-d 192.168.0.1 -j ACCEPT
firewall-cmd --permanent \
--direct --add-rule ipv4 filter OUTPUT 1 \
-d 192.168.0.0/24 -j REJECT
firewall-cmd --permanent \
--direct --add-rule ipv4 filter OUTPUT 1 \
-d 192.168.1.0/24 -j REJECT
firewall-cmd --permanent \
--direct --add-rule ipv4 filter OUTPUT 1 \
-d 192.168.4.0/24 -j REJECT
firewall-cmd --permanent \
--direct --add-rule ipv4 filter OUTPUT 1 \
-d 192.168.30.0/24 -j REJECT

firewall-cmd --reload
firewall-cmd --list-rich-rules

#查看出站规则
firewall-cmd --direct --get-all-rules
#查看入入站规则
firewall-cmd --list-all
```

---

# 三、确保 SSH 开放

你已经有：

```
services: ssh

```

如果需要可以再确认：

```bash
firewall-cmd --permanent --add-service=ssh

```

---

# 四、重新加载规则

```bash
firewall-cmd --reload

```

---

# 五、最终预期结果

```bash
firewall-cmd --list-rich-rules

```

应该类似：

```
rule family="ipv4" source address="192.168.0.1" accept
rule family="ipv4" source address="192.168.0.0/24" reject
rule family="ipv4" source address="192.168.1.0/24" reject
rule family="ipv4" source address="192.168.4.0/24" reject

```

---

# 六、实现效果

<table id="bkmrk-%E6%9D%A5%E6%BA%90ip-%E6%98%AF%E5%90%A6%E8%83%BD%E8%AE%BF%E9%97%AE-192.168.0"><thead><tr><th>来源IP</th><th>是否能访问</th></tr></thead><tbody><tr><td>192.168.0.1</td><td>✅ 允许</td></tr><tr><td>192.168.0.x</td><td>❌ 禁止</td></tr><tr><td>192.168.1.x</td><td>❌ 禁止</td></tr><tr><td>192.168.4.x</td><td>❌ 禁止</td></tr><tr><td>其他公网IP</td><td>✅ 可访问 SSH</td></tr></tbody></table>

并且：

- **服务器访问外网不受影响**
- **默认 SSH 对外开放**

---

# 七、生产环境更严谨写法（推荐）

只限制 **SSH** 而不是全部流量：

```
rule family="ipv4" source address="192.168.1.0/24" service name="ssh" reject

```

否则会影响：

- ping
- http
- agent
- 监控

你的当前情况需要先明确一个关键点：

### 1️⃣ 当前 `openclaw` 端口实际上 **外部无法访问**

从 `netstat` 看：

```
127.0.0.1:18789
127.0.0.1:18791
127.0.0.1:18792

```

绑定在 **127.0.0.1 (loopback)**，意味着：

- 只有 **本机 localhost** 可以访问
- **任何外部 IP 都无法连接**

所以即使在 `firewalld` 放行，这些端口 **仍然不会对外开放**。

如果你的目标是：

> 允许 **除禁止网段外的所有IP访问 openclaw**

则必须先让程序监听 **0.0.0.0** 或 **192.168.0.33**。

例如：

```
0.0.0.0:18789
0.0.0.0:18791
0.0.0.0:18792

```

否则防火墙规则不会生效。

---

# 一、firewalld 完整推荐规则

你的需求总结：

<table id="bkmrk-%E6%9D%A1%E4%BB%B6-%E8%A7%84%E5%88%99-192.168.0.1-%E5%85%81%E8%AE%B8"><thead><tr><th>条件</th><th>规则</th></tr></thead><tbody><tr><td>192.168.0.1</td><td>允许</td></tr><tr><td>192.168.0.0/24</td><td>禁止</td></tr><tr><td>192.168.1.0/24</td><td>禁止</td></tr><tr><td>192.168.4.0/24</td><td>禁止</td></tr><tr><td>其他IP</td><td>允许 SSH + openclaw</td></tr></tbody></table>

---

# 二、开放 openclaw 端口

```bash
firewall-cmd --permanent --add-port=18789/tcp
firewall-cmd --permanent --add-port=18791/tcp
firewall-cmd --permanent --add-port=18792/tcp

```

UDP 5353：

```bash
firewall-cmd --permanent --add-port=5353/udp

```

---

# 三、配置 IP 限制规则

### 1 允许网关

```bash
firewall-cmd --permanent \
--add-rich-rule='rule family="ipv4" source address="192.168.0.1" accept'

```

---

### 2 禁止三个网段

```bash
firewall-cmd --permanent \
--add-rich-rule='rule family="ipv4" source address="192.168.0.0/24" reject'

firewall-cmd --permanent \
--add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" reject'

firewall-cmd --permanent \
--add-rich-rule='rule family="ipv4" source address="192.168.4.0/24" reject'

```

---

# 四、重新加载

```bash
firewall-cmd --reload

```

---

# 五、最终规则验证

```
firewall-cmd --list-all

```

应看到：

```
services: ssh
ports: 18789/tcp 18791/tcp 18792/tcp 5353/udp
rich rules:
 rule family="ipv4" source address="192.168.0.1" accept
 rule family="ipv4" source address="192.168.0.0/24" reject
 rule family="ipv4" source address="192.168.1.0/24" reject
 rule family="ipv4" source address="192.168.4.0/24" reject

```

---

# 六、访问效果

<table id="bkmrk-%E6%9D%A5%E6%BA%90ip-ssh-openclaw-19"><thead><tr><th>来源IP</th><th>SSH</th><th>Openclaw</th></tr></thead><tbody><tr><td>192.168.0.1</td><td>✅</td><td>✅</td></tr><tr><td>192.168.0.x</td><td>❌</td><td>❌</td></tr><tr><td>192.168.1.x</td><td>❌</td><td>❌</td></tr><tr><td>192.168.4.x</td><td>❌</td><td>❌</td></tr><tr><td>公网IP</td><td>✅</td><td>✅</td></tr></tbody></table>

服务器访问外网 **不受影响**。

---

# 七、非常重要（openclaw 必须改监听地址）

如果你想让别人访问 openclaw，必须看到：

```
0.0.0.0:18789
0.0.0.0:18791
0.0.0.0:18792

```

而不是：

```
127.0.0.1:18789

```

常见修改方式：

```
config.yaml
gateway.yaml
server.conf
--host 0.0.0.0

```

---

你遇到的错误是 **正常现象**：

`firewalld rich rule` **不支持 `direction="out"` 属性**，所以会报：

```
INVALID_RULE: bad attribute 'direction'

```

在 **firewalld 架构中**：

- rich rule 默认作用于 **INPUT / FORWARD**
- **不直接支持 OUTPUT 方向控制**

如果要限制 **本机访问其它网段（egress filtering）**，通常有三种方法：

1️⃣ **使用 direct rule（推荐）**  
2️⃣ **使用 policy objects（firewalld 1.0+）**  
3️⃣ **直接使用 iptables/nftables**

在 **Ubuntu 24.04 + firewalld**，最简单稳定的是 **direct rule**。

---

# 一、实现你的需求的正确方法

需求：

```
禁止本机访问：
192.168.0.0/24 (除192.168.0.1)
192.168.1.0/24
192.168.4.0/24

```

---

# 二、允许访问网关

```
firewall-cmd --permanent \
--direct --add-rule ipv4 filter OUTPUT 0 \
-d 192.168.0.1 -j ACCEPT

```

---

# 三、禁止访问三个网段

### 禁止 192.168.0.0/24

```
firewall-cmd --permanent \
--direct --add-rule ipv4 filter OUTPUT 1 \
-d 192.168.0.0/24 -j REJECT

```

### 禁止 192.168.1.0/24

```
firewall-cmd --permanent \
--direct --add-rule ipv4 filter OUTPUT 1 \
-d 192.168.1.0/24 -j REJECT

```

### 禁止 192.168.4.0/24

```
firewall-cmd --permanent \
--direct --add-rule ipv4 filter OUTPUT 1 \
-d 192.168.4.0/24 -j REJECT

```

---

# 四、重新加载

```
firewall-cmd --reload

```

---

# 五、验证 direct 规则

```
firewall-cmd --direct --get-all-rules

```

应该看到：

```
ipv4 filter OUTPUT 0 -d 192.168.0.1 -j ACCEPT
ipv4 filter OUTPUT 1 -d 192.168.0.0/24 -j REJECT
ipv4 filter OUTPUT 1 -d 192.168.1.0/24 -j REJECT
ipv4 filter OUTPUT 1 -d 192.168.4.0/24 -j REJECT

```

---

# 六、最终完整防火墙策略

## 入站限制

```
192.168.0.1 允许
192.168.0.0/24 禁止
192.168.1.0/24 禁止
192.168.4.0/24 禁止

```

## 出站限制

```
192.168.0.1 允许
192.168.0.0/24 禁止
192.168.1.0/24 禁止
192.168.4.0/24 禁止
外网允许

```

---

# 七、最终访问效果

<table id="bkmrk-%E6%96%B9%E5%90%91-ip-%E7%BB%93%E6%9E%9C-%E5%A4%96%E9%83%A8-%E2%86%92-%E6%9C%AC%E6%9C%BA-192"><thead><tr><th>方向</th><th>IP</th><th>结果</th></tr></thead><tbody><tr><td>外部 → 本机</td><td>192.168.0.1</td><td>✅</td></tr><tr><td>外部 → 本机</td><td>192.168.0.x</td><td>❌</td></tr><tr><td>外部 → 本机</td><td>192.168.1.x</td><td>❌</td></tr><tr><td>外部 → 本机</td><td>192.168.4.x</td><td>❌</td></tr><tr><td>外部 → 本机</td><td>其他IP</td><td>✅</td></tr><tr><td>本机 → 192.168.0.1</td><td>✅</td><td> </td></tr><tr><td>本机 → 192.168.0.x</td><td>❌</td><td> </td></tr><tr><td>本机 → 192.168.1.x</td><td>❌</td><td> </td></tr><tr><td>本机 → 192.168.4.x</td><td>❌</td><td> </td></tr><tr><td>本机 → 外网</td><td>✅</td><td> </td></tr></tbody></table>

---

# 八、运维建议（非常重要）

你的服务器：

```
192.168.0.33

```

如果完全禁止访问：

```
192.168.0.0/24

```

可能影响：

- DNS
- NTP
- 内网API
- NFS / SMB
- LDAP / AD

生产环境通常只限制 **SSH / 管理端口**，而不是整个网段。

---

如果需要，我可以给你一套 **运维服务器 firewalld 最佳实践配置（约25条规则）**，特点：

- SSH 防暴力破解
- 内网扫描防护
- 只允许必要端口
- 自动记录攻击日志
- 适合 Ubuntu 20/22/24 运维服务器。

# 针对 Ubuntu 18.04 服务器，要仅封禁特定 IP 地址且不影响其他任何端口及 IP 的访问

针对 Ubuntu 18.04 服务器，要**仅封禁特定 IP 地址**且**不影响其他任何端口及 IP 的访问**，最标准、高效且对系统性能影响最小的方法是使用 `iptables`。

Ubuntu 18.04 默认可能使用 `ufw` (Uncomplicated Firewall)，但 `ufw` 底层也是 `iptables`。为了精准控制且不干扰现有规则，直接使用 `iptables` 命令是最稳妥的。

以下是具体操作步骤：

### 🚀 方法一：使用 iptables 直接封禁（推荐，即时生效）

这种方法不需要安装额外软件，直接操作内核防火墙规则。

#### 1. 执行封禁命令

请在终端中**逐行复制并执行**以下命令（需要 root 权限）：

```bash
# 封禁 广东深圳 IP
sudo iptables -I INPUT -s 103.44.236.211 -j DROP

# 封禁 江西南昌 IP
sudo iptables -I INPUT -s 223.83.150.76 -j DROP

# 封禁 中国香港 IP (1)
sudo iptables -I INPUT -s 83.229.126.117 -j DROP

# 封禁 中国香港 IP (2)
sudo iptables -I INPUT -s 45.192.103.126 -j DROP

# 封禁 美国 IP
sudo iptables -I INPUT -s 148.153.56.174 -j DROP

```

- \*\* `-I INPUT`**: 表示在输入链的**最前面\*\*插入规则（优先级最高，确保先于允许规则执行）。
- \*\* `-s`\*\*: 代表 Source（源地址），即你要封禁的 IP。
- \*\* `-j DROP`\*\*: 代表直接丢弃数据包，对方连接时会显示超时，就像网络断开一样（比 REJECT 更安全，不返回拒绝信息）。

#### 2. 验证是否生效

执行以下命令查看当前的防火墙规则，确认刚才添加的规则是否存在：

```bash
sudo iptables -L INPUT -n --line-numbers

```

你应该能在列表的最上方看到这几条带有 `DROP` 字样的规则。

---

### 💾 关键步骤：永久保存规则（防止重启失效）

**注意**：`iptables` 命令默认是临时的，**服务器重启后规则会丢失**。你必须执行以下步骤将其保存。

#### 情况 A：如果你没有安装 `iptables-persistent` (纯净版 Ubuntu)

1. 安装保存工具： ```bash
    sudo apt-get update
    sudo apt-get install iptables-persistent
    
    ```
2. 在安装过程中，它会问你是否保存当前的 IPv4 和 IPv6 规则，选择 **Yes**。
3. 如果以后修改了规则，手动保存命令为： ```bash
    sudo netfilter-persistent save
    
    ```

#### 情况 B：如果你正在使用 UFW

如果你之前一直用 `ufw` 管理防火墙，直接运行上面的 `iptables` 命令也是有效的（因为 ufw 本质就是 iptables），且优先级通常高于 ufw 的默认规则。  
为了确保重启后依然有效，建议将上述规则写入 UFW 的自定义文件，或者坚持使用上面的 `iptables-persistent` 方法（两者共存通常没问题，只要不冲突）。

**最稳妥的 UFW 用户做法：**  
创建自定义规则文件：

```bash
sudo nano /etc/ufw/before.rules

```

在文件的 `*filter` 部分之后，`COMMIT` 之前，加入以下内容：

```text
# 开始添加封禁 IP
-A ufw-before-input -s 103.44.236.211 -j DROP
-A ufw-before-input -s 223.83.150.76 -j DROP
-A ufw-before-input -s 83.229.126.117 -j DROP
-A ufw-before-input -s 45.192.103.126 -j DROP
-A ufw-before-input -s 148.153.56.174 -j DROP
# 结束添加

```

保存退出后，重启 UFW：

```bash
sudo ufw disable && sudo ufw enable

```

---

### ️ 进阶方案：如果攻击 IP 非常多（使用 ipset）

如果将来封禁的 IP 达到几十上百个，每条都写一条 iptables 规则会降低服务器网络性能。此时建议使用 `ipset`（IP 集合）。

1. **安装 ipset**: ```bash
    sudo apt-get install ipset
    
    ```
2. **创建一个名为 `blacklist` 的集合**: ```bash
    sudo ipset create blacklist hash:ip
    
    ```
3. **将恶意 IP 加入集合**: ```bash
    sudo ipset add blacklist 103.44.236.211
    sudo ipset add blacklist 223.83.150.76
    sudo ipset add blacklist 83.229.126.117
    sudo ipset add blacklist 45.192.103.126
    sudo ipset add blacklist 148.153.56.174
    
    ```
4. **添加一条 iptables 规则，拒绝该集合内的所有 IP**: ```bash
    sudo iptables -I INPUT -m set --match-set blacklist src -j DROP
    
    ```
5. **保存 ipset 集合 (防止重启丢失)**: ```bash
    sudo apt-get install ipset-persistent
    sudo ipset save > /etc/ipset.conf
    
    ```
    
    *(注：需配置开机自动恢复 `/etc/ipset.conf`，或简单地将 `ipset restore < /etc/ipset.conf` 加入 `/etc/rc.local`)*

### ✅ 总结

对于你目前的 5 个 IP，直接使用 **方法一（iptables 命令）** 最快最直接。  
**切记：** 执行完命令后，务必执行 **保存操作** (`netfilter-persistent save`)，否则重启服务器后防护会失效。

# Dubbo 服务运行在 Docker 容器中，修复漏洞方法如下

结合你提供的截图信息，你的服务器 IP 是 `169.169.39.135`，且 Dubbo 服务运行在 Docker 容器中，端口映射为 `0.0.0.0:20817->20817`。

这意味着 **20817 端口直接绑定在宿主机的所有网卡上（0.0.0.0）并暴露给了公网**，这就是漏洞产生的原因。

以下是针对你当前环境（Docker + Linux）的具体修复步骤：

### 方法一：修改 Docker 端口绑定（最快修复，无需改代码）

既然 Dubbo 服务只需要内部调用，不需要从公网直接访问，我们可以修改 Docker 的端口映射，让 20817 端口只监听本地回环地址（127.0.0.1），或者直接不映射到宿主机。

**操作步骤：**

1. 找到你的 `docker-compose.yml` 文件。
2. 找到 `rurl-model-proxy-server` 这个服务的 `ports` 配置部分。
3. 将 `20817:20817` 修改为 `127.0.0.1:20817:20817`。

**修改前：**

```yaml
ports:
  - "20817:20817"
  - "8041:8090"

```

**修改后：**

```yaml
ports:
  - "127.0.0.1:20817:20817"  # 加上 127.0.0.1 限制
  - "8041:8090"

```

**效果：** 修改后，外部网络（包括你的公网 IP `169.169.39.135`）将无法访问 20817 端口，只有服务器本机可以访问。

**重启服务：**

```bash
docker-compose down
docker-compose up -d

```

---

### 方法二：配置服务器防火墙（iptables）

如果你不想修改 Docker 配置，或者修改后仍希望特定内网 IP 能访问，可以使用防火墙策略。

**目标：** 禁止公网访问 20817，但允许本机或特定内网访问。

**执行命令（在宿主机上执行）：**

1. **拒绝外部访问 20817：**
    
    ```bash
    # 拒绝所有外部 IP 访问 TCP 20817 端口
    iptables -I INPUT -p tcp --dport 20817 ! -s 127.0.0.1 -j DROP
    
    ```
    
    *(注意：如果你的应用服务器在其他机器上，比如 192.168.x.x，需要把 `! -s 127.0.0.1` 改为 `-s 192.168.x.x` 或者添加一条允许规则)*
2. **保存规则（防止重启失效）：**
    
    ```bash
    service iptables save
    # 或者根据你的系统
    iptables-save > /etc/iptables/rules.v4
    
    ```

---

### 方法三：Dubbo 内部配置（彻底禁用 Telnet）

这是最安全的做法，即使端口暴露了，黑客也无法通过 Telnet 执行命令。

**操作步骤：**

1. 进入容器内部或修改你的项目配置文件（`application.yml` 或 `dubbo.properties`）。
2. **禁用 Telnet 命令支持。**

如果你使用的是 Spring Boot 配置 (`application.yml`)，在 `rurl-model-proxy-server` 的配置中添加：

```yaml
dubbo:
  protocol:
    name: dubbo
    port: 20817
    # 关键点：设置为 false 或空，禁用 telnet
    telnet: false 

```

或者在 `dubbo.properties` 中：

```properties
dubbo.protocol.telnet=false

```

**修改后重启容器：**

```bash
docker-compose restart rurl-model-proxy-server

```

### 验证修复结果

修复完成后，请在你的本地电脑（非服务器内部）使用 telnet 测试：

```bash
telnet 169.169.39.135 20817

```

- **修复成功：** 连接超时（Connection timed out）或连接被拒绝（Connection refused）。
- **修复失败：** 屏幕变黑或出现 `Connected to...` 字样。

**建议优先采用“方法一”或“方法二”，因为这是基础设施层面的防护，最快生效。**

# 732字节、1秒root、九年无人知——Linux近年最稳定提权漏洞

# <span class="js_title_inner" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; white-space: pre-wrap;">【已复现】732字节、1秒root、九年无人知<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; letter-spacing: normal;">——</span>Linux近年最稳定提权漏洞</span>

<div class="rich_media_meta_list" id="bkmrk-%E9%95%BF%E4%BA%AD%E5%AE%89%E5%85%A8%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94%E4%B8%AD%E5%BF%83-%C2%A02026%E5%B9%B44%E6%9C%883" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px 0px 22px; padding: 0px; outline: 0px; line-height: 20px; font-size: 0px; overflow-wrap: break-word; hyphens: auto; position: relative; z-index: 1; color: rgba(0, 0, 0, 0.9); font-family: 'PingFang SC', system-ui, -apple-system, BlinkMacSystemFont, 'Helvetica Neue', 'Hiragino Sans GB', 'Microsoft YaHei UI', 'Microsoft YaHei', Arial, sans-serif; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: 0.544px; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: rgb(255, 255, 255); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><span class="rich_media_meta rich_media_meta_nickname" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px 10px 10px 0px; padding: 0px; outline: 0px; display: inline-block; vertical-align: middle; font-size: 15px; position: relative;"><a class="wx_tap_link js_wx_tap_highlight weui-wa-hotarea" id="bkmrk-" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; color: var(--weui-link); text-decoration: none; -webkit-user-drag: none; cursor: default; position: relative;"></a>长亭安全应急响应中心</span><div id="bkmrk--1" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px;"></div><span class="rich_media_meta rich_media_meta_nickname" id="bkmrk--2" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px 10px 10px 0px; padding: 0px; outline: 0px; display: inline-block; vertical-align: middle; font-size: 15px; position: relative;"></span> <span class="" id="bkmrk-2026%E5%B9%B44%E6%9C%8830%E6%97%A5-10%3A25%C2%A0%E5%8C%97%E4%BA%AC" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px;">*2026年4月30日 10:25* *<span aria-hidden="true" id="bkmrk--3" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px;"></span><span aria-hidden="true" id="bkmrk-%E5%8C%97%E4%BA%AC-1" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px;">北京</span>*</span></div><div class="rich_media_content js_underline_content
                       defaultNoSetting
            " id="bkmrk-linux-%E6%98%AF%E7%9B%AE%E5%89%8D%E5%85%A8%E7%90%83%E6%9C%8D%E5%8A%A1%E5%99%A8%E3%80%81%E4%BA%91%E8%AE%A1%E7%AE%97%E3%80%81%E5%AE%B9" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; color: rgba(0, 0, 0, 0.9); font-size: var(--articleFontsize); overflow: hidden; text-align: justify; position: relative; z-index: 0; user-select: text; font-family: 'PingFang SC', system-ui, -apple-system, BlinkMacSystemFont, 'Helvetica Neue', 'Hiragino Sans GB', 'Microsoft YaHei UI', 'Microsoft YaHei', Arial, sans-serif; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: 0.544px; orphans: 2; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: rgb(255, 255, 255); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><section data-role="outer" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-family: 默认字体; visibility: visible;"><section data-role="paragraph" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 16px; letter-spacing: 0.578px; font-family: mp-quote, -apple-system-font, 'system-ui', 'Helvetica Neue', 'PingFang SC', 'Hiragino Sans GB', 'Microsoft YaHei UI', 'Microsoft YaHei', Arial, sans-serif; visibility: visible;"><section data-clipboard-cangjie="["root",{"copyFrom":1329378339},["p",{},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"泛微协同管理应用平台（e-cology）是一款全面的企业管理平台。它具备多元化的功能，包括企业信息门户、知识文档管理、工作流程管理、人力资源管理、客户关系管理、项目管理、财务管理、资产管理、供应链管理以及数据中心等。这款平台有助于企业整合各种资源，包括管理、市场、销售、研发、人事和行政等各个领域。通过e-cology，这些资源可以在一个统一的平台上集成，并为用户提供统一的界面以方便操作和获取信息。"]]],["p",{"uuid":"lhbw00xpg3nfo1awkjt"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"近日，长亭应急团队监测到泛微发布了新的安全漏洞补丁修补了多个漏洞，其中有两个漏洞值得关注，分别是信息泄露和任意用户登录，组合起来可以获取应用系统的任意用户权限。"]]],["p",{"uuid":"lhbw2mh45202sva9ihn"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"经过分析漏洞后，发现公网仍有较多系统未修复漏洞，长亭应急团队根据该漏洞的原理，编写了X-RAY远程检测工具和牧云本地检测工具供大家下载使用，同时在文章中提供了排查该资产的方式。"]]]]" data-identifier-application__slash__x-doc-key="LvBPlNWKY5PVndG8" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><section data-clipboard-cangjie="["root",{"copyFrom":1121139987},["p",{"uuid":"lhsqy1c3vobicv0i3er"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"畅捷通T+是一款企业资源规划（ERP）软件，主要功能包括财务管理、销售管理、采购管理以及库存管理等，助力企业实现业务流程自动化。"]]],["p",{"uuid":"limjtprko8zpm2fo8pl"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"近期，长亭科技监测到微步在线发布一则漏洞通告，声明畅捷通T+发布新版本修复了一个RCE漏洞。"]]],["p",{"uuid":"limrdh63y857qallxw"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"长亭应急团队经过漏洞分析后，发现该漏洞类型为SQL注入，可利用其实现RCE。公网仍有较多相关系统尚未修复漏洞。应急团队根据该漏洞的原理，编写了X-POC远程检测工具和牧云本地检测工具，目前工具已向公众开放下载使用。"]]]]" data-identifier-application__slash__x-doc-key="2M9qPJ1xzP43l015" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><section data-clipboard-cangjie="["root",{"copyFrom":1121139987},["p",{"uuid":"lhsqy1c3vobicv0i3er"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"Openfire（前身为Wildfire）是一个基于XMPP（Extensible Messaging and Presence Protocol，可扩展消息处理和呈现协议）的开源实时协作服务器，同时提供了Web管理界面。"]]],["p",{"uuid":"limjtprko8zpm2fo8pl"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"近期，长亭科技监测到Openfire发布新版本修复了一个漏洞。长亭应急团队经过漏洞分析后，发现该漏洞类型为后台权限绕过，可利用其实现RCE。公网仍有较多相关系统尚未修复漏洞。应急团队根据该漏洞的原理，编写了X-POC远程检测工具和牧云本地检测工具，目前工具已向公众开放下载使用。"]]]]" data-identifier-application__slash__x-doc-key="AJdl6mZR72PKOke1" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><section data-clipboard-cangjie="["root",{"copyFrom":1121139987},["p",{"uuid":"lhsqy1c3vobicv0i3er"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"Apache RocketMQ是一款开源的分布式消息和流处理平台，提供了高效、可靠、可扩展的低延迟消息和流数据处理能力，广泛用于异步通信、应用解耦、系统集成以及大数据、实时计算等场景。"]]],["p",{"uuid":"licys4nlk4z44589ypo"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"近期，长亭科技监测到RocketMQ发布新版本修复了一个远程命令执行漏洞（CVE-2023-37582）。"]]],["p",{"uuid":"licytz2meuxzh6wlgn"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"经过分析漏洞后，发现公网仍有较多系统未修复漏洞。应急团队根据该漏洞的原理，已经编写了X-POC远程检测工具和牧云本地检测工具"],["span",{"bold":false,"sz":11,"szUnit":"pt","data-type":"leaf"},"，并已向公众开放下载使用。"]]]]" data-identifier-application__slash__x-doc-key="r4mlQmEY28GMlxow" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); text-size-adjust: inherit; visibility: visible;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; text-align: center; visibility: visible;">  
</section><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;">  
</span>

<section data-clipboard-cangjie="["root",{},["p",{},["span",{"data-type":"text"},["span",{"fonts":{"hint":"eastAsia"},"data-type":"leaf"},"瑞"],["span",{"data-type":"leaf"},"友天翼应用虚拟化系统是西安瑞友信息技术资讯有限公司研发的具有自主知识产权，基于服务器计算架构的应用虚拟化平台。它将用户各种应用软件集中部署在瑞友天翼服务器(群)上，客户端通过WEB即可快速安全的访问经服务器上授权的应用软件，实现集中应用、远程接入、协同办公等。"]]],["p",{"uuid":"lp0xhb0ekky9vvtxiv"},["span",{"data-type":"text"},["span",{"sz":11,"szUnit":"pt","data-type":"leaf"},"2024年5月，互联网公开了一个"],["span",{"fonts":{"hint":"eastAsia"},"data-type":"leaf"},"瑞"],["span",{"data-type":"leaf"},"友天翼应用虚拟化系统"],["span",{"sz":11,"szUnit":"pt","data-type":"leaf"},"的SQL注入漏洞。鉴于该漏洞无前置条件，易于利用，且默认情况下可直接获取操作系统权限，建议所有使用该系统的企业尽快进行升级修复，以确保系统安全。"]]]]" data-identifier-application__slash__x-doc-key="4jKqmVWA95GDOw19" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; text-size-adjust: inherit; visibility: visible;"><section data-clipboard-cangjie="["root",{},["p",{"uuid":"lw0h0ayp6j8mmfkcsxa"},["span",{"data-type":"text"},["span",{"fonts":{"hint":"eastAsia"},"data-type":"leaf"},"PHP-CGI 是一种用于在 Web 服务器上运行 PHP 脚本的接口，通过 CGI（公共网关接口）将 PHP 解释器与 Web 服务器连接。"]]],["p",{"uuid":"lp0xhb0ekky9vvtxiv"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"2024年6月，PHP官方发布新版本，修复了 "],["span",{"sz":11,"szUnit":"pt","data-type":"leaf"},"PHP-CGI "],["span",{"data-type":"leaf"},"中一个远程代码执行漏洞。"],["span",{"sz":11,"szUnit":"pt","data-type":"leaf"},"鉴于该漏洞无前置条件，易于利用，且默认情况下可获取操作系统权限，建议所有使用受影响版本的企业尽快升级修复，以确保安全。"]]]]" data-identifier-application__slash__x-doc-key="3BMqYaMEV896qwZL" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; text-size-adjust: inherit; visibility: visible;"><section data-clipboard-cangjie="["root",{},["p",{"uuid":"liy8sjqqhpyk6m030b9"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"Serv-U 是 SolarWinds 公司推出的FTP服务器软件，提供文件传输服务，支持多种协议（FTP、FTPS、SFTP），具有用户管理、文件权限控制等功能，适用于企业级文件传输解决方案。"]]],["p",{"uuid":"lo5ajwxivf4py2sbk1f"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"2024年6月，Serv-U 官方 SolarWinds 发布了新补丁，修复了一处目录遍历致文件读取漏洞（CVE-2024-28995）。经分析，该漏洞可以通过特定的路径请求来未授权访问系统文件，进而可能导致敏感信息泄露。该漏洞无前置条件且利用简单，建议受影响的客户尽快修复漏洞。"]]]]" data-identifier-application__slash__x-doc-key="8K4nyRy9Bv1jqLbj" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; text-size-adjust: inherit; visibility: visible;"><section data-clipboard-cangjie="["root",{},["p",{"uuid":"lhsqy1c3vobicv0i3er"},["span",{"data-type":"text"},["span",{"sz":10.5,"szUnit":"pt","color":"rgba(0, 0, 0, 0.87)","spacing":0.049245,"data-type":"leaf"},"Gogs (Go Git Service) 是一款基于 Go 语言开发的开源 Git 托管平台，采用 MIT 许可证，提供代码托管、Issue 跟踪、权限管理和 Webhook 等功能。"]]],["p",{"jc":"left","ind":{},"spacing":{},"uuid":"lyiiqr1cqx6q84a8wmd"},["span",{"data-type":"text"},["span",{"spacing":0.21675,"data-type":"leaf"},"2025年6月，"],["span",{"sz":10.5,"szUnit":"pt","color":"rgba(0, 0, 0, 0.87)","spacing":0.049245,"data-type":"leaf"},"Gogs发布"],["span",{"spacing":0.21675,"data-type":"leaf"},"新版本，修复了一处命令注入漏洞。经分析，拥有用户权限的攻击者可利用该漏洞执行任意系统命令，利用难度较低，建议受影响的用户尽快修复。"]]]]" data-identifier-application__slash__x-doc-key="ABmOoWbjkxeDzOaw" data-pm-slice="0 0 []" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; visibility: visible;"><section data-clipboard-cangjie="["root",{},["p",{"uuid":"lhsqy1c3vobicv0i3er"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"ComfyUI 是一款流行的基于节点的 Stable Diffusion 图形用户界面，广泛应用于 AI 图像生成工作流的构建和执行。ComfyUI-Manager 是 ComfyUI 的扩展管理器插件，用于简化自定义节点、模型和依赖项的安装管理。"]]]]" data-identifier-application__slash__x-cangjie-fragment="JTdCJTIya2xhc3MlMjIlM0ElMjJkb2N1bWVudCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMmtsYXNzJTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIycGFyYWdyYXBoJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiUyMnV1aWQlMjIlM0ElMjJsaHNxeTFjM3ZvYmljdjBpM2VyJTIyJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyQ29tZnlVSSUyMCVFNiU5OCVBRiVFNCVCOCU4MCVFNiVBQyVCRSVFNiVCNSU4MSVFOCVBMSU4QyVFNyU5QSU4NCVFNSU5RiVCQSVFNCVCQSU4RSVFOCU4QSU4MiVFNyU4MiVCOSVFNyU5QSU4NCUyMFN0YWJsZSUyMERpZmZ1c2lvbiUyMCVFNSU5QiVCRSVFNSVCRCVBMiVFNyU5NCVBOCVFNiU4OCVCNyVFNyU5NSU4QyVFOSU5RCVBMiVFRiVCQyU4QyVFNSVCOSVCRiVFNiVCMyU5QiVFNSVCQSU5NCVFNyU5NCVBOCVFNCVCQSU4RSUyMEFJJTIwJUU1JTlCJUJFJUU1JTgzJThGJUU3JTk0JTlGJUU2JTg4JTkwJUU1JUI3JUE1JUU0JUJEJTlDJUU2JUI1JTgxJUU3JTlBJTg0JUU2JTlFJTg0JUU1JUJCJUJBJUU1JTkyJThDJUU2JTg5JUE3JUU4JUExJThDJUUzJTgwJTgyQ29tZnlVSS1NYW5hZ2VyJTIwJUU2JTk4JUFGJTIwQ29tZnlVSSUyMCVFNyU5QSU4NCVFNiU4OSVBOSVFNSVCMSU5NSVFNyVBRSVBMSVFNyU5MCU4NiVFNSU5OSVBOCVFNiU4RiU5MiVFNCVCQiVCNiVFRiVCQyU4QyVFNyU5NCVBOCVFNCVCQSU4RSVFNyVBRSU4MCVFNSU4QyU5NiVFOCU4NyVBQSVFNSVBRSU5QSVFNCVCOSU4OSVFOCU4QSU4MiVFNyU4MiVCOSVFMyU4MCU4MSVFNiVBOCVBMSVFNSU5RSU4QiVFNSU5MiU4QyVFNCVCRSU5RCVFOCVCNSU5NiVFOSVBMSVCOSVFNyU5QSU4NCVFNSVBRSU4OSVFOCVBMyU4NSVFNyVBRSVBMSVFNyU5MCU4NiVFMyU4MCU4MiUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTJDJTIyY29udGVudFR5cGUlMjIlM0ElMjJjYW5namllLXRleHRibG9jayUyMiU3RCU1RCU3RA==" data-identifier-application__slash__x-doc-key="8K4nyeZ4kYD8VnLb" data-pm-slice="0 0 []" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; visibility: visible;"><section data-clipboard-cangjie="["root",{},["p",{"uuid":"moktnqce2mqipujm2n6"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"Linux 是目前全球服务器、云计算、容器环境中使用最广泛的操作系统内核，绝大多数主流 Linux 发行版（Ubuntu、Debian、RHEL、Amazon Linux、SUSE、Arch、Fedora 等）均基于其构建。"]]]]" data-identifier-application__slash__x-cangjie-fragment="JTdCJTIya2xhc3MlMjIlM0ElMjJkb2N1bWVudCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMmtsYXNzJTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIycGFyYWdyYXBoJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiUyMnV1aWQlMjIlM0ElMjJtb2t0bnFjZTJtcWlwdWptMm42JTIyJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyTGludXglMjAlRTYlOTglQUYlRTclOUIlQUUlRTUlODklOEQlRTUlODUlQTglRTclOTAlODMlRTYlOUMlOEQlRTUlOEElQTElRTUlOTklQTglRTMlODAlODElRTQlQkElOTElRTglQUUlQTElRTclQUUlOTclRTMlODAlODElRTUlQUUlQjklRTUlOTklQTglRTclOEUlQUYlRTUlQTIlODMlRTQlQjglQUQlRTQlQkQlQkYlRTclOTQlQTglRTYlOUMlODAlRTUlQjklQkYlRTYlQjMlOUIlRTclOUElODQlRTYlOTMlOEQlRTQlQkQlOUMlRTclQjMlQkIlRTclQkIlOUYlRTUlODYlODUlRTYlQTAlQjglRUYlQkMlOEMlRTclQkIlOUQlRTUlQTQlQTclRTUlQTQlOUElRTYlOTUlQjAlRTQlQjglQkIlRTYlQjUlODElMjBMaW51eCUyMCVFNSU4RiU5MSVFOCVBMSU4QyVFNyU4OSU4OCVFRiVCQyU4OFVidW50dSVFMyU4MCU4MURlYmlhbiVFMyU4MCU4MVJIRUwlRTMlODAlODFBbWF6b24lMjBMaW51eCVFMyU4MCU4MVNVU0UlRTMlODAlODFBcmNoJUUzJTgwJTgxRmVkb3JhJTIwJUU3JUFEJTg5JUVGJUJDJTg5JUU1JTlEJTg3JUU1JTlGJUJBJUU0JUJBJThFJUU1JTg1JUI2JUU2JTlFJTg0JUU1JUJCJUJBJUUzJTgwJTgyJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlMkMlMjJjb250ZW50VHlwZSUyMiUzQSUyMmNhbmdqaWUtdGV4dGJsb2NrJTIyJTdEJTVEJTdE" data-identifier-application__slash__x-doc-key="4j6OJ5jkkBNgDq3p" data-pm-slice="0 0 []" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; visibility: visible;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px; visibility: visible;">Linux 是目前全球服务器、云计算、容器环境中使用最广泛的操作系统内核，绝大多数主流 Linux 发行版（Ubuntu、Debian、RHEL、Amazon Linux、SUSE、Arch、Fedora 等）均基于其构建。</span></span></span>

</section></section><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 10.5pt; color: rgba(0, 0, 0, 0.87); letter-spacing: 0.049245pt; visibility: visible;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;">  
</span></span>

</section><section data-clipboard-cangjie="["root",{},["p",{"uuid":"moktnqcel2bh4x2wtuq"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"2026 年 4 月 29 日，长亭安全应急响应中心监测到互联网公开披露了一个影响范围极广的Linux提权漏洞 CVE-2026-31431，命名为\"Copy Fail\"。该漏洞源于 Linux 内核加密子系统 "]],["inlineCode",{"uuid":"moktnqcerm21o7twpn"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"authencesn"]]],["span",{"data-type":"text"},["span",{"data-type":"leaf"}," 模块中的一处逻辑缺陷，攻击者仅需本地普通用户权限，通过链式利用 AF_ALG 套接字与 "]],["inlineCode",{"uuid":"moktnqcergh5ufd73h"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"splice()"]]],["span",{"data-type":"text"},["span",{"data-type":"leaf"}," 系统调用，即可向页缓存（page cache）写入任意内容，最终实现本地提权至 root。漏洞影响 2017 年至补丁发布前构建的几乎所有 Linux 内核版本，"],["span",{"bold":true,"data-type":"leaf"},"EXP 已公开"],["span",{"data-type":"leaf"},"，利用稳定性极高，建议受影响用户立即修复"]]]]" data-identifier-application__slash__x-doc-key="4j6OJ5jkkBNgDq3p" data-pm-slice="0 0 []" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; visibility: visible;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px; visibility: visible;">2026 年 4 月 29 日，长亭安全应急响应中心监测到互联网公开披露了一个影响范围极广的Linux提权漏洞 CVE-2026-31431，命名为"Copy Fail"。该漏洞源于 Linux 内核加密子系统 </span></span></span>`<span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px; visibility: visible;">authencesn</span></span></span>`<span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px; visibility: visible;">模块中的一处逻辑缺陷，攻击者仅需本地普通用户权限，通过链式利用 AF\_ALG 套接字与 </span></span></span>`<span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px; visibility: visible;">splice()</span></span></span>`<span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px; visibility: visible;">系统调用，即可向页缓存（page cache）写入任意内容，最终实现本地提权至 root。漏洞影响 2017 年至补丁发布前构建的几乎所有 Linux 内核版本，</span></span></span><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-weight: bold; visibility: visible;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px; visibility: visible;">EXP 已公开</span></span></span><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px; visibility: visible;">，利用稳定性极高，建议受影响用户立即修复。</span></span></span>

</section><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px; visibility: visible;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;">  
</span></span>

</section></section></section></section></section></section></section><section data-color="#7ac259" data-id="124637" data-role="title" data-tools="135编辑器" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 10px auto; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; display: flex; visibility: visible;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; flex-shrink: 0; display: flex; visibility: visible;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; width: 5px; height: 51.1992px; background-color: rgb(122, 194, 89); overflow: hidden; visibility: visible;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;">  
</span></section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px 0px 0px 10px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgb(122, 194, 89); text-align: left; visibility: visible;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 20px; letter-spacing: 2px; color: rgb(31, 31, 31); visibility: visible;">**<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; visibility: visible;">漏洞描述</span>**</span></section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 12px; color: rgb(166, 166, 166); text-align: left;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; letter-spacing: 1px; background-color: rgba(152, 152, 152, 0.1); line-height: 1.58em;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"> </span><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgb(152, 152, 152);"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">Description</span></span><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"> </span></span></section></section></section><section data-width="100%" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; width: 536.375px; display: flex; align-items: center; height: 0px; overflow: hidden;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; flex-shrink: 0; display: flex; align-items: center;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; flex-shrink: 0; height: 0px; overflow: hidden;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px 0px 0px 5px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 20px; letter-spacing: 1.5px; color: rgb(122, 194, 89);"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 24px; color: rgba(152, 152, 152, 0.2);">**<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">0</span><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">1</span>**</span></section></section></section></section></section><section data-role="paragraph" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-family: mp-quote, -apple-system-font, 'system-ui', 'Helvetica Neue', 'PingFang SC', 'Hiragino Sans GB', 'Microsoft YaHei UI', 'Microsoft YaHei', Arial, sans-serif;"><section data-clipboard-cangjie="["root",{"copyFrom":1329378339},["p",{"uuid":"lhbw6gwwf5hgshd51os"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"由于系统未对系统接口的响应进行合理的处理，导致该系统会泄漏已注册用户信息，攻击者可利用信息泄露漏洞获取注册用户的信息。另外由于系统使用了不当的算法设计，攻击者可模拟任意用户登录系统。"]]],["p",{"uuid":"lhbw6jvlp8ey3x5omd"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"对攻击者来说，这两个漏洞的利用无需认证和鉴权，可通过组合漏洞获取用户数据，登录后台。"]]]]" data-identifier-application__slash__x-doc-key="LvBPlNWKY5PVndG8" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><section data-clipboard-cangjie="["root",{"copyFrom":1121139987},["p",{"uuid":"limrxzplblycaec36z8"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"GeoServer在预览图层的时候，可以对图层进行数据过滤从而渲染出指定位置的图层。由于未对用户输入进行过滤，在使用需要以数据库作为数据存储的功能时，攻击者可以构造畸形的过滤语法，绕过GeoServer的词法解析从而造成SQL注入，获取服务器中的敏感信息，甚至可能获取数据库服务器权限。"]]],["p",{"uuid":"limlfrolcg1noaebcu8"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"经过深入分析，长亭应急响应实验室发现，默认情况下GeoServer内置图层并不会使用数据库作为存储方式，而是将数据存放在文件中，所以不受该漏洞的影响。而使用该系统创建自定义图层并使用外置数据库后，就会导致相应的功能存在SQL注入漏洞。"]]]]" data-identifier-application__slash__x-doc-key="8K4ny9795WGpnLbj" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><section data-identifier-application__slash__x-doc-key="r4mlQmEY28GMlxow" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; caret-color: rgb(0, 0, 0); text-size-adjust: inherit;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 17px;">**<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgb(122, 194, 89);"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">漏洞成因</span></span>**</span>

<section data-clipboard-cangjie="["root",{},["p",{"uuid":"moktnqcf5epebj18b5i"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"Linux 内核加密模块 "]],["inlineCode",{"uuid":"moktnqcfs332twubgwp"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"authencesn"]]],["span",{"data-type":"text"},["span",{"data-type":"leaf"}," 在 2017 年引入了一处针对 AEAD（认证加密）操作的原地（in-place）优化，该优化导致在特定条件下，页缓存（page cache）中的只读页面可以被错误地放入可写目标散列表（scatterlist）。攻击者通过 AF_ALG 套接字暴露的内核加密 API，结合 "]],["inlineCode",{"uuid":"moktnqcfvhuwr1g1uue"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"splice()"]]],["span",{"data-type":"text"},["span",{"data-type":"leaf"}," 系统调用，利用上述逻辑缺陷实现对 setuid 二进制文件（如 "]],["inlineCode",{"uuid":"moktnqcfud7t8izqbd"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"/usr/bin/su"]]],["span",{"data-type":"text"},["span",{"data-type":"leaf"},"）页缓存的 4 字节任意写入，从而篡改程序逻辑，获取 root shell。"]]],["p",{"uuid":"moktnqcfkha3r46b30b"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"整个利用过程为"],["span",{"bold":true,"data-type":"leaf"},"直线逻辑"],["span",{"data-type":"leaf"},"，无需竞争窗口（race window），无需内核特定偏移，无需预装任何特殊工具。"]]]]" data-identifier-application__slash__x-doc-key="4j6OJ5jkkBNgDq3p" data-pm-slice="0 0 []" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">Linux 内核加密模块 </span></span></span>`<span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">authencesn</span></span></span>`<span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">在 2017 年引入了一处针对 AEAD（认证加密）操作的原地（in-place）优化，该优化导致在特定条件下，页缓存（page cache）中的只读页面可以被错误地放入可写目标散列表（scatterlist）。攻击者通过 AF\_ALG 套接字暴露的内核加密 API，结合 </span></span></span>`<span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">splice()</span></span></span>`<span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">系统调用，利用上述逻辑缺陷实现对 setuid 二进制文件（如 </span></span></span>`<span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">/usr/bin/su</span></span></span>`<span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">）页缓存的 4 字节任意写入，从而篡改程序逻辑，获取 root shell。</span></span></span>

<span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">整个利用过程为</span></span></span><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-weight: bold;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">直线逻辑</span></span></span><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">，无需竞争窗口（race window），无需内核特定偏移，无需预装任何特殊工具。</span></span></span>

</section></section></section></section><section data-identifier-application__slash__x-doc-key="r4mlQmEY28GMlxow" data-pm-slice="0 0 []" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; caret-color: rgb(0, 0, 0); text-size-adjust: inherit;">## <span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgb(122, 194, 89);">**<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; line-height: 1.87em;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">漏洞影响</span></span>**</span>

<section data-clipboard-cangjie="["root",{},["p",{"uuid":"m8priaprslu9x2ofe5b"},["span",{"data-type":"text"},["span",{"bold":true,"data-type":"leaf"},"远程代码执行"],["span",{"data-type":"leaf"},"：攻击者可在服务器上执行任意系统命令，可能导致服务器被完全控制、数据泄露或业务系统沦陷。"]]]]" data-identifier-application__slash__x-cangjie-fragment="JTdCJTIya2xhc3MlMjIlM0ElMjJkb2N1bWVudCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMmtsYXNzJTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIycGFyYWdyYXBoJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiUyMnV1aWQlMjIlM0ElMjJtOHByaWFwcnNsdTl4Mm9mZTViJTIyJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyJUU4JUJGJTlDJUU3JUE4JThCJUU0JUJCJUEzJUU3JUEwJTgxJUU2JTg5JUE3JUU4JUExJThDJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMm1hcmslMjIlMkMlMjJ0eXBlJTIyJTNBJTIyYm9sZCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlN0QlNUQlN0QlMkMlN0IlMjJrbGFzcyUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyJUVGJUJDJTlBJUU2JTk0JUJCJUU1JTg3JUJCJUU4JTgwJTg1JUU1JThGJUFGJUU1JTlDJUE4JUU2JTlDJThEJUU1JThBJUExJUU1JTk5JUE4JUU0JUI4JThBJUU2JTg5JUE3JUU4JUExJThDJUU0JUJCJUJCJUU2JTg0JThGJUU3JUIzJUJCJUU3JUJCJTlGJUU1JTkxJUJEJUU0JUJCJUE0JUVGJUJDJThDJUU1JThGJUFGJUU4JTgzJUJEJUU1JUFGJUJDJUU4JTg3JUI0JUU2JTlDJThEJUU1JThBJUExJUU1JTk5JUE4JUU4JUEyJUFCJUU1JUFFJThDJUU1JTg1JUE4JUU2JThFJUE3JUU1JTg4JUI2JUUzJTgwJTgxJUU2JTk1JUIwJUU2JThEJUFFJUU2JUIzJTg0JUU5JTlDJUIyJUU2JTg4JTk2JUU0JUI4JTlBJUU1JThBJUExJUU3JUIzJUJCJUU3JUJCJTlGJUU2JUIyJUE2JUU5JTk5JUI3JUUzJTgwJTgyJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlMkMlMjJjb250ZW50VHlwZSUyMiUzQSUyMmNhbmdqaWUtdGV4dGJsb2NrJTIyJTdEJTVEJTdE" data-identifier-application__slash__x-doc-key="ABmOoWbjkxeDzOaw" data-pm-slice="0 0 []" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><section data-identifier-application__slash__x-doc-key="4j6OJ5jkkBNgDq3p" data-pm-slice="0 0 []" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">- <span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-weight: bold;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">本地提权至 root</span></span></span><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">：任意本地普通用户账户可无条件提权为 root。</span></span></span>
- <span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-weight: bold;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">容器逃逸</span></span></span><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">：Kubernetes / 容器环境中，页缓存为宿主机共享，容器内攻击者可突破容器边界，危及宿主节点及同节点其他租户。</span></span></span>
- <span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-weight: bold;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">CI/CD 环境沦陷</span></span></span><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">：GitHub Actions、GitLab Runner、Jenkins Agent 等执行不可信代码的 CI 环境，攻击者可通过恶意 PR 直接获取 Runner 宿主机的 root 权限。</span></span></span>
- <span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-weight: bold;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">云多租户环境</span></span></span><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">：Notebook、Serverless、Agent 沙箱等执行用户代码的云服务，租户可提权为宿主机 root。</span></span></span>
- <span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-weight: bold;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">漏洞持续近十年</span></span></span><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">：问题代码于 2017 年引入，此后所有 Linux 发行版均受影响。</span></span></span>

</section><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></span>

</section><section data-identifier-application__slash__x-doc-key="r4mlQmEY28GMlxow" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; caret-color: rgb(0, 0, 0); text-size-adjust: inherit;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span>

**<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; line-height: 1.87em;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">处置优先级：高</span></span>**

<section data-id="142799" data-tools="135编辑器" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 16px; letter-spacing: 0.578px; color: rgb(0, 0, 0); font-family: mp-quote, -apple-system-font, system-ui, 'Helvetica Neue', 'PingFang SC', 'Hiragino Sans GB', 'Microsoft YaHei UI', 'Microsoft YaHei', Arial, sans-serif;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 10px auto; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; display: flex;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; flex-shrink: 0; display: flex; align-items: flex-end;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; width: 1px; border-left: 1px solid rgb(122, 194, 89); height: 262.391px; overflow: hidden; transform: translateY(3px);"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></section></section><section data-width="100%" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; width: 676px;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 5px 10px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><section data-autoskip="1" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; line-height: 1.75em; letter-spacing: 1.5px; font-size: 14px; color: rgb(51, 51, 51);"><section data-identifier-application__slash__x-doc-key="8K4nyR2daWX0qLbj" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgb(0, 0, 0);"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgba(38, 38, 38, 0.86);"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; line-height: 2em;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; text-align: left; font-size: 15px;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-weight: bold;">漏洞类型：</span><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-weight: normal;">权限提升</span></span></span></span></span>

<section data-clipboard-cangjie="["root",{},["p",{"uuid":"lwimwq8a5n1v73x221a"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"● 漏洞类型：目录遍历"]]],["p",{"uuid":"lwimwq8aiiblz5hww6"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"● 漏洞危害等级：中"]]],["p",{"uuid":"lwimwq8adn8we8t368w"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"● 权限认证要求：无需任何权限"]]],["p",{"uuid":"lwimwq8a2iqisx8i3r4"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"● 系统配置要求：默认配置可利用"]]],["p",{"uuid":"lwimwq8abf2z7210v3s"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"● 用户交互要求：无需用户交互"]]],["p",{"uuid":"lwimwq8bmbyjgppdj7"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"● 利用成熟度：POC/EXP已公开"]]],["p",{"uuid":"lwimwq8bxxufs939y1"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"● 批量可利用性：可使用通用 POC/EXP，批量检测/利用"]]],["p",{"uuid":"lwimwq8b94hfo6wrmi"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"● 修复复杂度：低，官方提供热修复方案"]]]]" data-identifier-application__slash__x-doc-key="8K4nyRy9Bv1jqLbj" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; text-size-adjust: inherit;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgba(38, 38, 38, 0.86);">**<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">漏洞危害等级：</span></span>**<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">高</span></span></span>

**<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgba(38, 38, 38, 0.86); font-size: 15px;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">触发方式：</span></span>**<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgba(38, 38, 38, 0.86); font-size: 15px;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">本地</span></span>

<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgba(38, 38, 38, 0.86);">**<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">权限认证要求：</span></span>**<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">普通用户权限</span></span></span>

<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgba(38, 38, 38, 0.86);">**<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">系统配置要求：</span></span>**<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-family: mp-quote, -apple-system-font, system-ui, 'Helvetica Neue', 'PingFang SC', 'Hiragino Sans GB', 'Microsoft YaHei UI', 'Microsoft YaHei', Arial, sans-serif; letter-spacing: 1.5px; text-align: left; line-height: 2em; caret-color: rgb(0, 0, 0); text-size-adjust: inherit; color: rgba(38, 38, 38, 0.86); font-size: 15px;">默认配置</span></span>

<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgba(38, 38, 38, 0.86);">**<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">用户交互要求：</span></span>**<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">无需用户交互</span></span></span>

<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgba(38, 38, 38, 0.86);">**<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">利用成熟度：</span></span>**<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">EXP 已公开</span></span><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">，732 字节，100% 稳定复现</span></span></span>

**<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">修复复杂度：</span>**<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgba(38, 38, 38, 0.86); font-size: 15px;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">低，升级内核或临时禁用 algif\_aead 模块</span></span>

<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span>

</section></section></section></section></section></section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; display: flex; align-items: center;"><section data-width="100%" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; width: 609px; border-top: 1px solid rgb(122, 194, 89); height: 1px; overflow: hidden;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; flex-shrink: 0; overflow: hidden;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; display: flex; justify-content: space-between; transform: translateX(5px);"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px 0px 0px 4px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; width: 5px; height: 7px; background-color: rgb(122, 194, 89); overflow: hidden; transform: skew(-25deg);"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px 0px 0px 4px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; width: 5px; height: 7px; background-color: rgb(122, 194, 89); overflow: hidden; transform: skew(-25deg);"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px 0px 0px 4px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; width: 5px; height: 7px; background-color: rgb(122, 194, 89); overflow: hidden; transform: skew(-25deg);"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px 0px 0px 4px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; width: 5px; height: 7px; background-color: rgb(122, 194, 89); overflow: hidden; transform: skew(-25deg);"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px 0px 0px 4px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; width: 5px; height: 7px; background-color: rgb(122, 194, 89); overflow: hidden; transform: skew(-25deg);"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px 0px 0px 4px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; width: 5px; height: 7px; background-color: rgb(122, 194, 89); overflow: hidden; transform: skew(-25deg);"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px 0px 0px 4px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; width: 10px; height: 7px; background-color: rgb(122, 194, 89); overflow: hidden; transform: skew(-25deg);"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></section></section></section></section></section></section><section data-color="#7ac259" data-id="124637" data-role="title" data-tools="135编辑器" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 17px; letter-spacing: 0.544px; background-color: rgb(255, 255, 255); font-family: system-ui, -apple-system, 'system-ui', 'Helvetica Neue', 'PingFang SC', 'Hiragino Sans GB', 'Microsoft YaHei UI', 'Microsoft YaHei', Arial, sans-serif;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 10px auto; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; display: flex;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; flex-shrink: 0; display: flex;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px 0px 0px 10px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; text-align: left;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></section></section></section></section></section><section data-color="#7ac259" data-id="124637" data-role="title" data-tools="135编辑器" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 16px; letter-spacing: 0.578px; color: rgb(0, 0, 0); z-index: 0; max-width: 100%; max-inline-size: 100%; border: 0px none initial;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 10px auto; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; display: flex; max-width: 100%; max-inline-size: 100%;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; flex-shrink: 0; display: flex; max-width: 100%; max-inline-size: 100%;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; width: 5px; height: 51.1914px; background-color: rgb(122, 194, 89); overflow: hidden; max-width: 100%; max-inline-size: 100%;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px 0px 0px 10px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; max-width: 100%; max-inline-size: 100%;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgb(122, 194, 89); text-align: left; max-width: 100%; max-inline-size: 100%;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; cursor: text; font-size: 20px; letter-spacing: 2px; color: rgb(31, 31, 31); max-width: 100%; max-inline-size: 100%;">**<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">影响版本</span>**</span></section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 12px; text-align: left; max-width: 100%; max-inline-size: 100%;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; cursor: text; letter-spacing: 1px; background-color: rgba(152, 152, 152, 0.1); max-width: 100%; max-inline-size: 100%;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; cursor: text; color: rgb(166, 166, 166); max-width: 100%; max-inline-size: 100%;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"> </span></span><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; cursor: text; color: rgb(152, 152, 152); max-width: 100%; max-inline-size: 100%;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">Affects</span></span><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; cursor: text; color: rgb(166, 166, 166); max-width: 100%; max-inline-size: 100%;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"> </span></span></span></section></section></section><section data-width="100%" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; width: 536.391px; display: flex; align-items: center; height: 0px; overflow: hidden; max-width: 100%; max-inline-size: 100%;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; flex-shrink: 0; display: flex; align-items: center; max-width: 100%; max-inline-size: 100%;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; flex-shrink: 0; height: 0px; overflow: hidden; max-width: 100%; max-inline-size: 100%;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px 0px 0px 5px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 20px; letter-spacing: 1.5px; color: rgb(122, 194, 89); max-width: 100%; max-inline-size: 100%;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; cursor: text; font-size: 24px; color: rgba(152, 152, 152, 0.2); max-width: 100%; max-inline-size: 100%;">**<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">02</span>**</span></section></section></section></section><section data-clipboard-cangjie="["root",{"copyFrom":398674325},["p",{"uuid":"liczeplu90nx1mmntt"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"<"],["span",{"highlight":"rgb(252, 252, 252)","data-type":"leaf"},"RocketMQ 4.9.6"]]],["p",{"uuid":"liczez2ip16agu1s6w"},["span",{"data-type":"text"},["span",{"highlight":"rgb(252, 252, 252)","data-type":"leaf"},"<RocketMQ 5.1.1"]]]]" data-identifier-application__slash__x-cangjie-fragment="JTdCJTIya2xhc3MlMjIlM0ElMjJkb2N1bWVudCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMmtsYXNzJTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIycGFyYWdyYXBoJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiUyMnV1aWQlMjIlM0ElMjJsaWN6ZXBsdTkwbngxbW1udHQlMjIlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMmtsYXNzJTIyJTNBJTIydGV4dCUyMiUyQyUyMmxlYXZlcyUyMiUzQSU1QiU3QiUyMmtsYXNzJTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjIlM0MlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCUyQyU3QiUyMmtsYXNzJTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJSb2NrZXRNUSUyMDQuOS42JTIyJTJDJTIybWFya3MlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMm1hcmslMjIlMkMlMjJ0eXBlJTIyJTNBJTIyaGlnaGxpZ2h0JTIyJTJDJTIyZGF0YSUyMiUzQSU3QiUyMnZhbHVlJTIyJTNBJTIycmdiKDI1MiUyQyUyMDI1MiUyQyUyMDI1MiklMjIlN0QlN0QlNUQlN0QlNUQlN0QlNUQlN0QlMkMlN0IlMjJrbGFzcyUyMiUzQSUyMmJsb2NrJTIyJTJDJTIydHlwZSUyMiUzQSUyMnBhcmFncmFwaCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlMjJ1dWlkJTIyJTNBJTIybGljemV6MmlwMTZhZ3UxczZ3JTIyJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyJTNDUm9ja2V0TVElMjA1LjEuMSUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTdCJTIya2xhc3MlMjIlM0ElMjJtYXJrJTIyJTJDJTIydHlwZSUyMiUzQSUyMmhpZ2hsaWdodCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlMjJ2YWx1ZSUyMiUzQSUyMnJnYigyNTIlMkMlMjAyNTIlMkMlMjAyNTIpJTIyJTdEJTdEJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE" data-identifier-application__slash__x-doc-key="XYvenvXNYavMOoyZ" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; max-width: 100%; max-inline-size: 100%;"><section data-clipboard-cangjie="["root",{"copyFrom":1121139987},["p",{"uuid":"liczeplu90nx1mmntt"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"<"],["span",{"highlight":"rgb(252, 252, 252)","data-type":"leaf"},"RocketMQ 4.9.7"]]],["p",{"uuid":"liczez2ip16agu1s6w"},["span",{"data-type":"text"},["span",{"highlight":"rgb(252, 252, 252)","data-type":"leaf"},"<RocketMQ 5.1.2"]]]]" data-identifier-application__slash__x-cangjie-fragment="JTdCJTIya2xhc3MlMjIlM0ElMjJkb2N1bWVudCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMmtsYXNzJTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIycGFyYWdyYXBoJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiUyMnV1aWQlMjIlM0ElMjJsaWN6ZXBsdTkwbngxbW1udHQlMjIlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMmtsYXNzJTIyJTNBJTIydGV4dCUyMiUyQyUyMmxlYXZlcyUyMiUzQSU1QiU3QiUyMmtsYXNzJTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjIlM0MlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCUyQyU3QiUyMmtsYXNzJTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJSb2NrZXRNUSUyMDQuOS43JTIyJTJDJTIybWFya3MlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMm1hcmslMjIlMkMlMjJ0eXBlJTIyJTNBJTIyaGlnaGxpZ2h0JTIyJTJDJTIyZGF0YSUyMiUzQSU3QiUyMnZhbHVlJTIyJTNBJTIycmdiKDI1MiUyQyUyMDI1MiUyQyUyMDI1MiklMjIlN0QlN0QlNUQlN0QlNUQlN0QlNUQlN0QlMkMlN0IlMjJrbGFzcyUyMiUzQSUyMmJsb2NrJTIyJTJDJTIydHlwZSUyMiUzQSUyMnBhcmFncmFwaCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlMjJ1dWlkJTIyJTNBJTIybGljemV6MmlwMTZhZ3UxczZ3JTIyJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyJTNDUm9ja2V0TVElMjA1LjEuMiUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTdCJTIya2xhc3MlMjIlM0ElMjJtYXJrJTIyJTJDJTIydHlwZSUyMiUzQSUyMmhpZ2hsaWdodCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlMjJ2YWx1ZSUyMiUzQSUyMnJnYigyNTIlMkMlMjAyNTIlMkMlMjAyNTIpJTIyJTdEJTdEJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE" data-identifier-application__slash__x-doc-key="r4mlQmEY28GMlxow" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; text-size-adjust: inherit; max-width: 100%; max-inline-size: 100%;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; background-color: rgb(255, 255, 255); text-size-adjust: inherit; color: rgb(51, 51, 51); font-family: 'Open Sans', 'Clear Sans', 'Helvetica Neue', Helvetica, Arial, 'Segoe UI Emoji', sans-serif; letter-spacing: normal; orphans: 4; caret-color: rgb(51, 51, 51); white-space-collapse: preserve; text-align: left; font-size: 15px; max-width: 100%; max-inline-size: 100%;">  
</span>

<section data-clipboard-cangjie="["root",{},["p",{"uuid":"mbt8tfhjyvdd4n80df"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"e-cology 9  补丁版本 < v10.75"]]]]" data-identifier-application__slash__x-cangjie-fragment="JTdCJTIya2xhc3MlMjIlM0ElMjJkb2N1bWVudCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMmtsYXNzJTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIycGFyYWdyYXBoJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiUyMnV1aWQlMjIlM0ElMjJtYnQ4dGZoanl2ZGQ0bjgwZGYlMjIlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMmtsYXNzJTIyJTNBJTIydGV4dCUyMiUyQyUyMmxlYXZlcyUyMiUzQSU1QiU3QiUyMmtsYXNzJTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJlLWNvbG9neSUyMDklMjAlMjAlRTglQTElQTUlRTQlQjglODElRTclODklODglRTYlOUMlQUMlMjAlM0MlMjB2MTAuNzUlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCUyQyUyMmNvbnRlbnRUeXBlJTIyJTNBJTIyY2FuZ2ppZS10ZXh0YmxvY2slMjIlN0QlNUQlN0Q=" data-identifier-application__slash__x-doc-key="8K4nyeZVamGgPnLb" data-pm-slice="0 0 []" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><section data-clipboard-cangjie="["root",{},["p",{"uuid":"mjpqnzgpyc8x3kpa6g"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"ComfyUI-Manager < V3.38"]]]]" data-identifier-application__slash__x-cangjie-fragment="JTdCJTIya2xhc3MlMjIlM0ElMjJkb2N1bWVudCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMmtsYXNzJTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIycGFyYWdyYXBoJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiUyMnV1aWQlMjIlM0ElMjJtanBxbnpncHljOHgza3BhNmclMjIlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMmtsYXNzJTIyJTNBJTIydGV4dCUyMiUyQyUyMmxlYXZlcyUyMiUzQSU1QiU3QiUyMmtsYXNzJTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJDb21meVVJLU1hbmFnZXIlMjAlM0MlMjBWMy4zOCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTJDJTIyY29udGVudFR5cGUlMjIlM0ElMjJjYW5namllLXRleHRibG9jayUyMiU3RCU1RCU3RA==" data-identifier-application__slash__x-doc-key="8K4nyeZ4kYD8VnLb" data-pm-slice="0 0 []" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><section data-identifier-application__slash__x-doc-key="4j6OJ5jkkBNgDq3p" data-pm-slice="0 0 []" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-weight: bold;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px; font-weight: normal;">2017 年至补丁发布前构建的所有 Linux 内核版本</span></span></span><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">，涵盖：</span></span></span>

<table style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px 0px 10px; padding: 0px; outline: 0px; border-collapse: collapse; display: table; width: 650px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; table-layout: fixed;"><tbody style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><tr style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><td style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 4px 8px; outline: 0px; overflow-wrap: break-word; word-break: break-all; hyphens: auto; border: 1px solid rgb(0, 0, 0); max-width: 100%; box-sizing: border-box !important; overflow: hidden; vertical-align: top;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">发行版</span></span></span>

</td><td style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 4px 8px; outline: 0px; overflow-wrap: break-word; word-break: break-all; hyphens: auto; border: 1px solid rgb(0, 0, 0); max-width: 100%; box-sizing: border-box !important; overflow: hidden; vertical-align: top;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">受影响内核版本</span></span></span>

</td></tr><tr style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><td style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 4px 8px; outline: 0px; overflow-wrap: break-word; word-break: break-all; hyphens: auto; border: 1px solid rgb(0, 0, 0); max-width: 100%; box-sizing: border-box !important; overflow: hidden; vertical-align: top;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">Ubuntu 24.04 LTS</span></span></span>

</td><td style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 4px 8px; outline: 0px; overflow-wrap: break-word; word-break: break-all; hyphens: auto; border: 1px solid rgb(0, 0, 0); max-width: 100%; box-sizing: border-box !important; overflow: hidden; vertical-align: top;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">6.17.0-1007-aws 及以下</span></span></span>

</td></tr><tr style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><td style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 4px 8px; outline: 0px; overflow-wrap: break-word; word-break: break-all; hyphens: auto; border: 1px solid rgb(0, 0, 0); max-width: 100%; box-sizing: border-box !important; overflow: hidden; vertical-align: top;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">Amazon Linux 2023</span></span></span>

</td><td style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 4px 8px; outline: 0px; overflow-wrap: break-word; word-break: break-all; hyphens: auto; border: 1px solid rgb(0, 0, 0); max-width: 100%; box-sizing: border-box !important; overflow: hidden; vertical-align: top;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">6.18.8-9.213.amzn2023 及以下</span></span></span>

</td></tr><tr style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><td style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 4px 8px; outline: 0px; overflow-wrap: break-word; word-break: break-all; hyphens: auto; border: 1px solid rgb(0, 0, 0); max-width: 100%; box-sizing: border-box !important; overflow: hidden; vertical-align: top;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">RHEL 14.3</span></span></span>

</td><td style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 4px 8px; outline: 0px; overflow-wrap: break-word; word-break: break-all; hyphens: auto; border: 1px solid rgb(0, 0, 0); max-width: 100%; box-sizing: border-box !important; overflow: hidden; vertical-align: top;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">6.12.0-124.45.1.el10\_1 及以下</span></span></span>

</td></tr><tr style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><td style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 4px 8px; outline: 0px; overflow-wrap: break-word; word-break: break-all; hyphens: auto; border: 1px solid rgb(0, 0, 0); max-width: 100%; box-sizing: border-box !important; overflow: hidden; vertical-align: top;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">SUSE 16</span></span></span>

</td><td style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 4px 8px; outline: 0px; overflow-wrap: break-word; word-break: break-all; hyphens: auto; border: 1px solid rgb(0, 0, 0); max-width: 100%; box-sizing: border-box !important; overflow: hidden; vertical-align: top;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">6.12.0-160000.9-default 及以下</span></span></span>

</td></tr><tr style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><td style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 4px 8px; outline: 0px; overflow-wrap: break-word; word-break: break-all; hyphens: auto; border: 1px solid rgb(0, 0, 0); max-width: 100%; box-sizing: border-box !important; overflow: hidden; vertical-align: top;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">Debian / Arch / Fedora / Rocky / Alma / Oracle</span></span></span>

</td><td style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 4px 8px; outline: 0px; overflow-wrap: break-word; word-break: break-all; hyphens: auto; border: 1px solid rgb(0, 0, 0); max-width: 100%; box-sizing: border-box !important; overflow: hidden; vertical-align: top;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">同期内核版本均受影响</span></span></span>

</td></tr></tbody></table>

</section><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></span>

</section><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></span>

</section></section></section><section data-color="#7ac259" data-id="124637" data-role="title" data-tools="135编辑器" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 16px; letter-spacing: 0.578px; color: rgb(0, 0, 0); z-index: 0; caret-color: rgb(255, 0, 0); background-color: rgb(255, 255, 255); font-family: 微软雅黑, 'Microsoft YaHei', sans-serif; max-width: 100%; max-inline-size: 100%; border: 0px none initial;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 10px auto; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; display: flex; max-width: 100%; max-inline-size: 100%;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; flex-shrink: 0; display: flex; max-width: 100%; max-inline-size: 100%;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; width: 5px; height: 51.1914px; background-color: rgb(122, 194, 89); overflow: hidden; max-width: 100%; max-inline-size: 100%;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px 0px 0px 10px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; max-width: 100%; max-inline-size: 100%;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgb(122, 194, 89); text-align: left; max-width: 100%; max-inline-size: 100%;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; cursor: text; font-size: 20px; letter-spacing: 2px; color: rgb(31, 31, 31); max-width: 100%; max-inline-size: 100%;">**<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">解决方案</span>**</span></section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 12px; color: rgb(166, 166, 166); text-align: left; max-width: 100%; max-inline-size: 100%;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; cursor: text; letter-spacing: 1px; background-color: rgba(152, 152, 152, 0.1); max-width: 100%; max-inline-size: 100%;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"> </span><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; cursor: text; color: rgb(152, 152, 152); max-width: 100%; max-inline-size: 100%;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">Solution</span></span><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"> </span></span></section></section></section><section data-width="100%" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; width: 536.391px; display: flex; align-items: center; height: 0px; overflow: hidden; max-width: 100%; max-inline-size: 100%;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; flex-shrink: 0; display: flex; align-items: center; max-width: 100%; max-inline-size: 100%;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; flex-shrink: 0; height: 0px; overflow: hidden; max-width: 100%; max-inline-size: 100%;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px 0px 0px 5px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 20px; letter-spacing: 1.5px; color: rgb(122, 194, 89); max-width: 100%; max-inline-size: 100%;">**<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; cursor: text; font-size: 24px; color: rgba(152, 152, 152, 0.2); max-width: 100%; max-inline-size: 100%;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">03</span></span>**</section></section></section></section><section data-clipboard-cangjie="["root",{"copyFrom":1329378339},["p",{"uuid":"lhbwfatppk7t6mctnlg"},["span",{"data-type":"text"},["span",{"bold":false,"sz":11,"szUnit":"pt","data-type":"leaf"},"官方已经发布了安全补丁，在参考链接中安装官方提供的安全补丁 。"]]]]" data-identifier-application__slash__x-cangjie-fragment="JTdCJTIya2xhc3MlMjIlM0ElMjJkb2N1bWVudCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMmtsYXNzJTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIycGFyYWdyYXBoJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiUyMnV1aWQlMjIlM0ElMjJsaGJ3ZmF0cHBrN3Q2bWN0bmxnJTIyJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyJUU1JUFFJTk4JUU2JTk2JUI5JUU1JUI3JUIyJUU3JUJCJThGJUU1JThGJTkxJUU1JUI4JTgzJUU0JUJBJTg2JUU1JUFFJTg5JUU1JTg1JUE4JUU4JUExJUE1JUU0JUI4JTgxJUVGJUJDJThDJUU1JTlDJUE4JUU1JThGJTgyJUU4JTgwJTgzJUU5JTkzJUJFJUU2JThFJUE1JUU0JUI4JUFEJUU1JUFFJTg5JUU4JUEzJTg1JUU1JUFFJTk4JUU2JTk2JUI5JUU2JThGJTkwJUU0JUJFJTlCJUU3JTlBJTg0JUU1JUFFJTg5JUU1JTg1JUE4JUU4JUExJUE1JUU0JUI4JTgxJTIwJUUzJTgwJTgyJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMm1hcmslMjIlMkMlMjJ0eXBlJTIyJTNBJTIyYm9sZCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlMjJ2YWx1ZSUyMiUzQWZhbHNlJTdEJTdEJTJDJTdCJTIya2xhc3MlMjIlM0ElMjJtYXJrJTIyJTJDJTIydHlwZSUyMiUzQSUyMnN6JTIyJTJDJTIyZGF0YSUyMiUzQSU3QiUyMnZhbHVlJTIyJTNBMTElMkMlMjJzelVuaXQlMjIlM0ElMjJwdCUyMiU3RCU3RCU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==" data-identifier-application__slash__x-doc-key="LvBPlNWKY5PVndG8" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; caret-color: rgb(255, 0, 0); background-color: rgb(255, 255, 255); font-family: 微软雅黑, 'Microsoft YaHei', sans-serif; max-width: 100%; max-inline-size: 100%;"><section data-identifier-application__slash__x-doc-key="XYvenvXNYavMOoyZ" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; max-width: 100%; max-inline-size: 100%;">## <span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span>

<section data-identifier-application__slash__x-doc-key="XYvenvXNYavMOoyZ" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgb(0, 0, 0); font-size: 16px; letter-spacing: 0.578px; max-width: 100%; max-inline-size: 100%;">## **<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; cursor: text; color: rgb(122, 194, 89); max-width: 100%; max-inline-size: 100%;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">升级修复方案</span></span>**

</section><section data-identifier-application__slash__x-doc-key="XYvenvXNYavMOoyZ" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgb(0, 0, 0); font-size: 16px; letter-spacing: 0.578px; max-width: 100%; max-inline-size: 100%;"><section data-identifier-application__slash__x-doc-key="8K4nyeZ4kYD8VnLb" data-pm-slice="0 0 []" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></span>

<section data-clipboard-cangjie="["root",{},["p",{"uuid":"mk52sesdaa7nj3y7rq9"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"升级 ComfyUI-Manager 至 V3.39.2 或更高版本\n"]]]]" data-identifier-application__slash__x-cangjie-fragment="JTdCJTIya2xhc3MlMjIlM0ElMjJkb2N1bWVudCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMmtsYXNzJTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIycGFyYWdyYXBoJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiUyMnV1aWQlMjIlM0ElMjJtazUyc2VzZGFhN25qM3k3cnE5JTIyJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyJUU1JThEJTg3JUU3JUJBJUE3JTIwQ29tZnlVSS1NYW5hZ2VyJTIwJUU4JTg3JUIzJTIwVjMuMzkuMiUyMCVFNiU4OCU5NiVFNiU5QiVCNCVFOSVBQiU5OCVFNyU4OSU4OCVFNiU5QyVBQyU1Q24lMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCUyQyUyMmNvbnRlbnRUeXBlJTIyJTNBJTIyY2FuZ2ppZS10ZXh0YmxvY2slMjIlN0QlNUQlN0Q=" data-identifier-application__slash__x-doc-key="J9LnW6j7NLgGWlvD" data-pm-slice="0 0 []" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><section data-identifier-application__slash__x-doc-key="4j6OJ5jkkBNgDq3p" data-pm-slice="0 0 []" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">升级至包含 mainline commit </span></span></span>`<span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">a664bf3d603d</span></span></span>`<span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">的内核版本，各主流发行版正在陆续发布修复版本：</span></span></span>

<section class="code-snippet__fix code-snippet__js" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 10px 0px; padding: 0px; outline: 0px; max-width: 1000%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 14px; color: rgb(51, 51, 51); position: relative; background-color: rgba(0, 0, 0, 0.03); border: 1px solid rgb(240, 240, 240); border-radius: 2px; display: flex; line-height: 26px;">```
# Ubuntu / Debian
``````
apt update && apt upgrade linux-image-$(uname -r)
``````
# RHEL / CentOS / Rocky / Alma
``````
dnf update kernel
``````
# Amazon Linux
``````
yum update kernel
``````
# SUSE
``````
zypper update kernel-default
```

</section>```


```

<span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;">升级后重启系统使新内核生效，并通过以下命令验证是否包含修复 commit：</span></span></span>

<section class="code-snippet__fix code-snippet__js" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 10px 0px; padding: 0px; outline: 0px; max-width: 1000%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 14px; color: rgb(51, 51, 51); position: relative; background-color: rgba(0, 0, 0, 0.03); border: 1px solid rgb(240, 240, 240); border-radius: 2px; display: flex; line-height: 26px;">```
grep -r "a664bf3d603d" /proc/version 2>/dev/null || uname -r 
``````
# 验证是否包含修复commit或对比发行版官方公告中的修复版本号
```

</section></section></section></section></section><section data-identifier-application__slash__x-doc-key="XYvenvXNYavMOoyZ" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgb(0, 0, 0); font-size: 16px; letter-spacing: 0.578px; max-width: 100%; max-inline-size: 100%;">## **<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; cursor: text; color: rgb(122, 194, 89); max-width: 100%; max-inline-size: 100%;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">临时缓解方案</span></span>**

<section data-clipboard-cangjie="["root",{},["p",{"uuid":"mk52tgp1vohv8gxasam"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"避免使用 "]],["inlineCode",{"uuid":"mk52tgp1y6zvbpihwlp"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"--listen 0.0.0.0"]]],["span",{"data-type":"text"},["span",{"data-type":"leaf"}," 等允许外部连接的参数启动 ComfyUI\n"]]]]" data-identifier-application__slash__x-cangjie-fragment="JTdCJTIya2xhc3MlMjIlM0ElMjJkb2N1bWVudCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMmtsYXNzJTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIycGFyYWdyYXBoJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiUyMnV1aWQlMjIlM0ElMjJtazUydGdwMXZvaHY4Z3hhc2FtJTIyJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyJUU5JTgxJUJGJUU1JTg1JThEJUU0JUJEJUJGJUU3JTk0JUE4JTIwJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlMkMlN0IlMjJrbGFzcyUyMiUzQSUyMmlubGluZSUyMiUyQyUyMnR5cGUlMjIlM0ElMjJpbmxpbmVDb2RlJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiUyMnV1aWQlMjIlM0ElMjJtazUydGdwMXk2enZicGlod2xwJTIyJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyLS1saXN0ZW4lMjAwLjAuMC4wJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlMkMlN0IlMjJrbGFzcyUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyJTIwJUU3JUFEJTg5JUU1JTg1JTgxJUU4JUFFJUI4JUU1JUE0JTk2JUU5JTgzJUE4JUU4JUJGJTlFJUU2JThFJUE1JUU3JTlBJTg0JUU1JThGJTgyJUU2JTk1JUIwJUU1JTkwJUFGJUU1JThBJUE4JTIwQ29tZnlVSSU1Q24lMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCUyQyUyMmNvbnRlbnRUeXBlJTIyJTNBJTIyY2FuZ2ppZS10ZXh0YmxvY2slMjIlN0QlNUQlN0Q=" data-identifier-application__slash__x-doc-key="J9LnW6j7NLgGWlvD" data-pm-slice="0 0 []" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></span>

</section><section data-color="#7ac259" data-id="124637" data-role="title" data-tools="135编辑器" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgb(0, 0, 0); font-size: 16px; letter-spacing: 0.578px;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 10px auto; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; display: flex;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; flex-shrink: 0; display: flex;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px 0px 0px 10px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><section data-identifier-application__slash__x-doc-key="4j6OJ5jkkBNgDq3p" data-pm-slice="0 0 []" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">禁用 </span></span>`<span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">algif_aead</span></span>`<span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">内核模块可阻断漏洞利用路径：</span></span>

<section class="code-snippet__fix code-snippet__js" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 10px 0px; padding: 0px; outline: 0px; max-width: 1000%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 14px; color: rgb(51, 51, 51); position: relative; background-color: rgba(0, 0, 0, 0.03); border: 1px solid rgb(240, 240, 240); border-radius: 2px; display: flex; line-height: 26px;">```
# 永久禁用（重启后生效）
``````
echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
``````
# 立即卸载（当前会话生效）
``````
rmmod algif_aead 2>/dev/null || true
```

</section>```
禁用 algif_aead 的影响评估：
```

- <span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-weight: bold;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">不影响</span></span><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">：dm-crypt/LUKS、kTLS、IPsec/XFRM、OpenSSL/GnuTLS/NSS 默认构建、SSH、内核密钥环加密——这些组件直接使用内核加密 API，不经过 AF\_ALG。</span></span>
- <span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-weight: bold;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">可能影响</span></span><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">：显式启用了 </span></span>`<span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">afalg</span></span>`<span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">引擎的 OpenSSL、部分嵌入式加密卸载路径、直接绑定 aead/skcipher/hash 套接字的应用。可通过 </span></span>`<span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">lsof | grep AF_ALG</span></span>`<span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">或 </span></span>`<span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">ss -xa</span></span>`<span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">检查当前系统是否有进程使用 AF\_ALG。</span></span>

</section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgb(122, 194, 89); text-align: left;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></section></section></section></section></section><section data-color="#7ac259" data-id="124637" data-role="title" data-tools="135编辑器" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 10px auto; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; display: flex;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; flex-shrink: 0; display: flex;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgb(0, 0, 0); font-size: 16px; letter-spacing: 0.578px; width: 5px; height: 51.1992px; background-color: rgb(122, 194, 89); overflow: hidden;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px 0px 0px 10px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; text-align: left;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgb(31, 31, 31); font-size: 20px; letter-spacing: 2px;">**<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">漏洞复现</span>**</span></section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgb(166, 166, 166); font-size: 12px; letter-spacing: 0.578px; text-align: left;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; letter-spacing: 1px; background-color: rgba(152, 152, 152, 0.1);"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgb(152, 152, 152); font-family: 微软雅黑, 'Microsoft YaHei', sans-serif; font-size: 12px; letter-spacing: 1px; text-align: left; caret-color: rgb(0, 0, 0); background-color: rgba(152, 152, 152, 0.1);"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">Reproduction</span></span><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"> </span></span></section></section></section><section data-width="100%" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgb(0, 0, 0); font-size: 16px; letter-spacing: 0.578px; width: 435.203px; display: flex; align-items: center; height: 0px; overflow: hidden;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgb(0, 0, 0); font-size: 16px; letter-spacing: 0.578px; flex-shrink: 0; display: flex; align-items: center;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; flex-shrink: 0; height: 0px; overflow: hidden;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px 0px 0px 5px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 20px; letter-spacing: 1.5px; color: rgb(122, 194, 89);"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 24px; color: rgba(152, 152, 152, 0.2); line-height: 1.58em;">**<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"> 04</span>**</span></section></section></section></section><section data-clipboard-cangjie="["root",{},["p",{"uuid":"lpj9i8ax6llvk79gwia"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"雷池：已发布自定义规则支持该漏洞检测。"]]],["p",{"uuid":"lpj9i9l4cpvexzah8vc"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"全悉：预计于2024.06.07发布升级包支持该漏洞检测。"]]]]" data-identifier-application__slash__x-cangjie-fragment="JTdCJTIya2xhc3MlMjIlM0ElMjJkb2N1bWVudCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMmtsYXNzJTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIycGFyYWdyYXBoJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiUyMnV1aWQlMjIlM0ElMjJscGo5aThheDZsbHZrNzlnd2lhJTIyJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyJUU5JTlCJUI3JUU2JUIxJUEwJUVGJUJDJTlBJUU1JUI3JUIyJUU1JThGJTkxJUU1JUI4JTgzJUU4JTg3JUFBJUU1JUFFJTlBJUU0JUI5JTg5JUU4JUE3JTg0JUU1JTg4JTk5JUU2JTk0JUFGJUU2JThDJTgxJUU4JUFGJUE1JUU2JUJDJThGJUU2JUI0JTlFJUU2JUEzJTgwJUU2JUI1JThCJUUzJTgwJTgyJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlMkMlN0IlMjJrbGFzcyUyMiUzQSUyMmJsb2NrJTIyJTJDJTIydHlwZSUyMiUzQSUyMnBhcmFncmFwaCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlMjJ1dWlkJTIyJTNBJTIybHBqOWk5bDRjcHZleHphaDh2YyUyMiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIya2xhc3MlMjIlM0ElMjJ0ZXh0JTIyJTJDJTIybGVhdmVzJTIyJTNBJTVCJTdCJTIya2xhc3MlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMiVFNSU4NSVBOCVFNiU4MiU4OSVFRiVCQyU5QSVFOSVBMiU4NCVFOCVBRSVBMSVFNCVCQSU4RTIwMjQuMDYuMDclRTUlOEYlOTElRTUlQjglODMlRTUlOEQlODclRTclQkElQTclRTUlOEMlODUlRTYlOTQlQUYlRTYlOEMlODElRTglQUYlQTUlRTYlQkMlOEYlRTYlQjQlOUUlRTYlQTMlODAlRTYlQjUlOEIlRTMlODAlODIlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==" data-identifier-application__slash__x-doc-key="3BMqYaMEV896qwZL" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 16px; letter-spacing: 0.578px; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); text-size-adjust: inherit;"><section data-clipboard-cangjie="["root",{},["p",{"uuid":"loqq6t3oq333ujnyqtb"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"云图：默认支持该产品的指纹识别，同时支持该漏洞的PoC原理检测。"]]],["p",{"uuid":"lu9nc90jek0zpr6vngp"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"洞鉴：以自定义POC形式支持该漏洞的原理检测"]]],["p",{"uuid":"lu9ncemr5ykjtgxyvg4"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"雷池：默认支持检测该漏洞的利用行为。"]]],["p",{"uuid":"lp16d81afwi67gn9zrh"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"全悉：默认支持检测该漏洞的利用行为。"]]]]" data-identifier-application__slash__x-doc-key="8K4nyRy9Bv1jqLbj" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; text-size-adjust: inherit;"></section></section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 10px auto; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; display: flex;"><section data-identifier-application__slash__x-doc-key="Pd6l2Z7BDGBpdl7M" data-pm-slice="0 0 []" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span>

<section data-clipboard-cangjie="["root",{"copyFrom":1329378339},["p",{"uuid":"lhbw6gwwf5hgshd51os"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"由于系统未对系统接口的响应进行合理的处理，导致该系统会泄漏已注册用户信息，攻击者可利用信息泄露漏洞获取注册用户的信息。另外由于系统使用了不当的算法设计，攻击者可模拟任意用户登录系统。"]]],["p",{"uuid":"lhbw6jvlp8ey3x5omd"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"对攻击者来说，这两个漏洞的利用无需认证和鉴权，可通过组合漏洞获取用户数据，登录后台。"]]]]" data-identifier-application__slash__x-doc-key="LvBPlNWKY5PVndG8" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><section data-identifier-application__slash__x-doc-key="r4mlQmEY28GMlxow" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; caret-color: rgb(0, 0, 0); text-size-adjust: inherit;"><section data-clipboard-cangjie="["root",{"copyFrom":1329378339},["p",{"uuid":"lhbwfatppk7t6mctnlg"},["span",{"data-type":"text"},["span",{"bold":false,"sz":11,"szUnit":"pt","data-type":"leaf"},"官方已经发布了安全补丁，在参考链接中安装官方提供的安全补丁 。"]]]]" data-identifier-application__slash__x-cangjie-fragment="JTdCJTIya2xhc3MlMjIlM0ElMjJkb2N1bWVudCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMmtsYXNzJTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIycGFyYWdyYXBoJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiUyMnV1aWQlMjIlM0ElMjJsaGJ3ZmF0cHBrN3Q2bWN0bmxnJTIyJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyJUU1JUFFJTk4JUU2JTk2JUI5JUU1JUI3JUIyJUU3JUJCJThGJUU1JThGJTkxJUU1JUI4JTgzJUU0JUJBJTg2JUU1JUFFJTg5JUU1JTg1JUE4JUU4JUExJUE1JUU0JUI4JTgxJUVGJUJDJThDJUU1JTlDJUE4JUU1JThGJTgyJUU4JTgwJTgzJUU5JTkzJUJFJUU2JThFJUE1JUU0JUI4JUFEJUU1JUFFJTg5JUU4JUEzJTg1JUU1JUFFJTk4JUU2JTk2JUI5JUU2JThGJTkwJUU0JUJFJTlCJUU3JTlBJTg0JUU1JUFFJTg5JUU1JTg1JUE4JUU4JUExJUE1JUU0JUI4JTgxJTIwJUUzJTgwJTgyJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMm1hcmslMjIlMkMlMjJ0eXBlJTIyJTNBJTIyYm9sZCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlMjJ2YWx1ZSUyMiUzQWZhbHNlJTdEJTdEJTJDJTdCJTIya2xhc3MlMjIlM0ElMjJtYXJrJTIyJTJDJTIydHlwZSUyMiUzQSUyMnN6JTIyJTJDJTIyZGF0YSUyMiUzQSU3QiUyMnZhbHVlJTIyJTNBMTElMkMlMjJzelVuaXQlMjIlM0ElMjJwdCUyMiU3RCU3RCU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==" data-identifier-application__slash__x-doc-key="LvBPlNWKY5PVndG8" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: none 0px !important; box-sizing: border-box !important; overflow-wrap: break-word !important; caret-color: rgb(255, 0, 0); background-color: rgb(255, 255, 255); font-family: 微软雅黑, 'Microsoft YaHei', sans-serif; max-width: 100%; max-inline-size: 100%;"><section data-identifier-application__slash__x-doc-key="8K4nyeZ4kYD8VnLb" data-pm-slice="0 0 []" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><section data-clipboard-cangjie="["root",{},["p",{"uuid":"moktpq4cbxckpaozgsj"},["img",{"uuid":"moktpxnup9tfp77ez6","name":"image.png","size":75023,"width":748,"height":97.21334734060412,"src":"https://alidocs.dingtalk.com/core/api/resources/img/5eecdaf48460cde535f74d49b61e25921d47922d6f9ccbf475b8339e1c4c2483811b562af39a8db88d68742cd653602a15464a86392b1bf5d440bf34ea485700f8dcf9d09e2f1e448c7be80d71ede7f6af903738e0fd21512d0017dab0a10e13?tmpCode=0e6503c6-90c0-483b-ac58-e336821db1d2","extraData":{"resourceId":"315dc409-5653-4754-a31b-b4c46edd745e","metaData":{"size":75023,"originWidth":831,"originHeight":108,"format":"png","ratio":1}}},["span",{"data-type":"text"},["span",{"data-type":"leaf"},""]]]]]" data-identifier-application__slash__x-cangjie-fragment="JTdCJTIya2xhc3MlMjIlM0ElMjJkb2N1bWVudCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMmtsYXNzJTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIycGFyYWdyYXBoJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiUyMnV1aWQlMjIlM0ElMjJtb2t0cHE0Y2J4Y2twYW96Z3NqJTIyJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMmlubGluZSUyMiUyQyUyMnR5cGUlMjIlM0ElMjJpbWFnZSUyMiUyQyUyMmRhdGElMjIlM0ElN0IlMjJ1dWlkJTIyJTNBJTIybW9rdHB4bnVwOXRmcDc3ZXo2JTIyJTJDJTIybmFtZSUyMiUzQSUyMmltYWdlLnBuZyUyMiUyQyUyMnNpemUlMjIlM0E3NTAyMyUyQyUyMndpZHRoJTIyJTNBNzQ4JTJDJTIyaGVpZ2h0JTIyJTNBOTcuMjEzMzQ3MzQwNjA0MTIlMkMlMjJzcmMlMjIlM0ElMjJodHRwcyUzQSUyRiUyRmFsaWRvY3MuZGluZ3RhbGsuY29tJTJGY29yZSUyRmFwaSUyRnJlc291cmNlcyUyRmltZyUyRjVlZWNkYWY0ODQ2MGNkZTUzNWY3NGQ0OWI2MWUyNTkyMWQ0NzkyMmQ2ZjljY2JmNDc1YjgzMzllMWM0YzI0ODM4MTFiNTYyYWYzOWE4ZGI4OGQ2ODc0MmNkNjUzNjAyYTE1NDY0YTg2MzkyYjFiZjVkNDQwYmYzNGVhNDg1NzAwZjhkY2Y5ZDA5ZTJmMWU0NDhjN2JlODBkNzFlZGU3ZjZhZjkwMzczOGUwZmQyMTUxMmQwMDE3ZGFiMGExMGUxMyUzRnRtcENvZGUlM0QwZTY1MDNjNi05MGMwLTQ4M2ItYWM1OC1lMzM2ODIxZGIxZDIlMjIlMkMlMjJleHRyYURhdGElMjIlM0ElN0IlMjJyZXNvdXJjZUlkJTIyJTNBJTIyMzE1ZGM0MDktNTY1My00NzU0LWEzMWItYjRjNDZlZGQ3NDVlJTIyJTJDJTIybWV0YURhdGElMjIlM0ElN0IlMjJzaXplJTIyJTNBNzUwMjMlMkMlMjJvcmlnaW5XaWR0aCUyMiUzQTgzMSUyQyUyMm9yaWdpbkhlaWdodCUyMiUzQTEwOCUyQyUyMmZvcm1hdCUyMiUzQSUyMnBuZyUyMiUyQyUyMnJhdGlvJTIyJTNBMSU3RCU3RCU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIya2xhc3MlMjIlM0ElMjJ0ZXh0JTIyJTJDJTIybGVhdmVzJTIyJTNBJTVCJTdCJTIya2xhc3MlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMiUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTJDJTIyY29udGVudFR5cGUlMjIlM0ElMjJjYW5namllLXRleHRibG9jayUyMiU3RCU1RCU3RA==" data-identifier-application__slash__x-doc-key="4j6OJ5jkkBNgDq3p" data-pm-slice="0 0 []" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; text-align: left; text-indent: 0px;">  
</section></section><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span>

</section><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span>

</section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; flex-shrink: 0; display: flex; align-items: center;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; flex-shrink: 0; height: 0px; overflow: hidden;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></section></section></section></section><section data-color="#7ac259" data-id="124637" data-role="title" data-tools="135编辑器" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 16px; letter-spacing: 0.578px;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 10px auto; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; display: flex;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; flex-shrink: 0; display: flex;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; width: 5px; height: 51.1992px; background-color: rgb(122, 194, 89); overflow: hidden;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px 0px 0px 10px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgb(122, 194, 89); text-align: left;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 20px; letter-spacing: 2px; color: rgb(31, 31, 31);">**<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">时间线</span>**</span></section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 12px; color: rgb(166, 166, 166); text-align: left;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; letter-spacing: 1px; background-color: rgba(152, 152, 152, 0.1);"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"> </span><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgb(152, 152, 152);"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">Timeline</span></span><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"> </span></span></section></section></section><section data-width="100%" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; width: 558.391px; display: flex; align-items: center; height: 0px; overflow: hidden;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; flex-shrink: 0; display: flex; align-items: center;"><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; flex-shrink: 0; height: 0px; overflow: hidden;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px 0px 0px 5px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 20px; letter-spacing: 1.5px; color: rgb(122, 194, 89);"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 24px; color: rgba(152, 152, 152, 0.2); line-height: 1.58em;">**<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">05</span>**</span></section></section></section></section><section data-clipboard-cangjie="["root",{"copyFrom":398674325},["p",{"uuid":"licztcywfgeia50hgau"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"5月23日 官方发布漏洞更新补丁版本"]]],["p",{"uuid":"liczwtaewmcvwgfubl"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"5月24日 长亭应急响应实验室复现漏洞"]]],["p",{"uuid":"liczxgtrqt1a8f2uca"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"5月30日 监测到POC已被小范围公开"]]],["p",{"uuid":"liczyrvvhx91cimp5ko"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"6月1日 长亭发布应急响应通告"]]]]" data-identifier-application__slash__x-doc-key="XYvenvXNYavMOoyZ" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 16px; letter-spacing: 0.578px;"><section data-clipboard-cangjie="["root",{"copyFrom":1121139987},["p",{"uuid":"licztcywfgeia50hgau"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"7月12日 漏洞被公开披露[4]"]]],["p",{"uuid":"lk0k3n68fx3xyfk6eh"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"7月12日 长亭应急响应实验室漏洞分析与复现"]]],["p",{"uuid":"lk0k55pw2m215r3a86w"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"7月13日 长亭安全应急响应中心发布通告"]]]]" data-identifier-application__slash__x-cangjie-fragment="JTdCJTIya2xhc3MlMjIlM0ElMjJkb2N1bWVudCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMmtsYXNzJTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIycGFyYWdyYXBoJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiUyMnV1aWQlMjIlM0ElMjJsaWN6dGN5d2ZnZWlhNTBoZ2F1JTIyJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyNyVFNiU5QyU4ODEyJUU2JTk3JUE1JTIwJUU2JUJDJThGJUU2JUI0JTlFJUU4JUEyJUFCJUU1JTg1JUFDJUU1JUJDJTgwJUU2JThBJUFCJUU5JTlDJUIyJTVCNCU1RCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTJDJTdCJTIya2xhc3MlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTIydXVpZCUyMiUzQSUyMmxrMGszbjY4ZngzeHlmazZlaCUyMiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIya2xhc3MlMjIlM0ElMjJ0ZXh0JTIyJTJDJTIybGVhdmVzJTIyJTNBJTVCJTdCJTIya2xhc3MlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMjclRTYlOUMlODgxMiVFNiU5NyVBNSUyMCVFOSU5NSVCRiVFNCVCQSVBRCVFNSVCQSU5NCVFNiU4MCVBNSVFNSU5MyU4RCVFNSVCQSU5NCVFNSVBRSU5RSVFOSVBQSU4QyVFNSVBRSVBNCVFNiVCQyU4RiVFNiVCNCU5RSVFNSU4OCU4NiVFNiU5RSU5MCVFNCVCOCU4RSVFNSVBNCU4RCVFNyU4RSVCMCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTJDJTdCJTIya2xhc3MlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTIydXVpZCUyMiUzQSUyMmxrMGs1NXB3Mm0yMTVyM2E4NnclMjIlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMmtsYXNzJTIyJTNBJTIydGV4dCUyMiUyQyUyMmxlYXZlcyUyMiUzQSU1QiU3QiUyMmtsYXNzJTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjI3JUU2JTlDJTg4MTMlRTYlOTclQTUlMjAlRTklOTUlQkYlRTQlQkElQUQlRTUlQUUlODklRTUlODUlQTglRTUlQkElOTQlRTYlODAlQTUlRTUlOTMlOEQlRTUlQkElOTQlRTQlQjglQUQlRTUlQkYlODMlRTUlOEYlOTElRTUlQjglODMlRTklODAlOUElRTUlOTElOEElMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==" data-identifier-application__slash__x-doc-key="r4mlQmEY28GMlxow" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); text-size-adjust: inherit;"><section data-clipboard-cangjie="["root",{},["p",{"uuid":"lpj9i8ax6llvk79gwia"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"雷池：已发布自定义规则支持该漏洞检测。"]]],["p",{"uuid":"lpj9i9l4cpvexzah8vc"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"全悉：预计于2024.06.07发布升级包支持该漏洞检测。"]]]]" data-identifier-application__slash__x-cangjie-fragment="JTdCJTIya2xhc3MlMjIlM0ElMjJkb2N1bWVudCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMmtsYXNzJTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIycGFyYWdyYXBoJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiUyMnV1aWQlMjIlM0ElMjJscGo5aThheDZsbHZrNzlnd2lhJTIyJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyJUU5JTlCJUI3JUU2JUIxJUEwJUVGJUJDJTlBJUU1JUI3JUIyJUU1JThGJTkxJUU1JUI4JTgzJUU4JTg3JUFBJUU1JUFFJTlBJUU0JUI5JTg5JUU4JUE3JTg0JUU1JTg4JTk5JUU2JTk0JUFGJUU2JThDJTgxJUU4JUFGJUE1JUU2JUJDJThGJUU2JUI0JTlFJUU2JUEzJTgwJUU2JUI1JThCJUUzJTgwJTgyJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlMkMlN0IlMjJrbGFzcyUyMiUzQSUyMmJsb2NrJTIyJTJDJTIydHlwZSUyMiUzQSUyMnBhcmFncmFwaCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlMjJ1dWlkJTIyJTNBJTIybHBqOWk5bDRjcHZleHphaDh2YyUyMiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIya2xhc3MlMjIlM0ElMjJ0ZXh0JTIyJTJDJTIybGVhdmVzJTIyJTNBJTVCJTdCJTIya2xhc3MlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMiVFNSU4NSVBOCVFNiU4MiU4OSVFRiVCQyU5QSVFOSVBMiU4NCVFOCVBRSVBMSVFNCVCQSU4RTIwMjQuMDYuMDclRTUlOEYlOTElRTUlQjglODMlRTUlOEQlODclRTclQkElQTclRTUlOEMlODUlRTYlOTQlQUYlRTYlOEMlODElRTglQUYlQTUlRTYlQkMlOEYlRTYlQjQlOUUlRTYlQTMlODAlRTYlQjUlOEIlRTMlODAlODIlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==" data-identifier-application__slash__x-doc-key="3BMqYaMEV896qwZL" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; text-size-adjust: inherit;"><section data-clipboard-cangjie="["root",{},["p",{"uuid":"licztcywfgeia50hgau"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"6月6日 官方发布漏洞公告"]]],["p",{"uuid":"lxec4knlucj95j2h0a"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"6月13日 互联网公开漏洞细节"]]],["p",{"uuid":"lk0k55pw2m215r3a86w"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"6月14日 长亭安全应急响应中心发布通告"]]]]" data-identifier-application__slash__x-cangjie-fragment="JTdCJTIya2xhc3MlMjIlM0ElMjJkb2N1bWVudCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMmtsYXNzJTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIycGFyYWdyYXBoJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiUyMnV1aWQlMjIlM0ElMjJsaWN6dGN5d2ZnZWlhNTBoZ2F1JTIyJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyNiVFNiU5QyU4ODYlRTYlOTclQTUlMjAlRTUlQUUlOTglRTYlOTYlQjklRTUlOEYlOTElRTUlQjglODMlRTYlQkMlOEYlRTYlQjQlOUUlRTUlODUlQUMlRTUlOTElOEElMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCUyQyU3QiUyMmtsYXNzJTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIycGFyYWdyYXBoJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiUyMnV1aWQlMjIlM0ElMjJseGVjNGtubHVjajk1ajJoMGElMjIlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMmtsYXNzJTIyJTNBJTIydGV4dCUyMiUyQyUyMmxlYXZlcyUyMiUzQSU1QiU3QiUyMmtsYXNzJTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjI2JUU2JTlDJTg4MTMlRTYlOTclQTUlMjAlRTQlQkElOTIlRTglODElOTQlRTclQkQlOTElRTUlODUlQUMlRTUlQkMlODAlRTYlQkMlOEYlRTYlQjQlOUUlRTclQkIlODYlRTglOEElODIlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCUyQyU3QiUyMmtsYXNzJTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIycGFyYWdyYXBoJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiUyMnV1aWQlMjIlM0ElMjJsazBrNTVwdzJtMjE1cjNhODZ3JTIyJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyNiVFNiU5QyU4ODE0JUU2JTk3JUE1JTIwJUU5JTk1JUJGJUU0JUJBJUFEJUU1JUFFJTg5JUU1JTg1JUE4JUU1JUJBJTk0JUU2JTgwJUE1JUU1JTkzJThEJUU1JUJBJTk0JUU0JUI4JUFEJUU1JUJGJTgzJUU1JThGJTkxJUU1JUI4JTgzJUU5JTgwJTlBJUU1JTkxJThBJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0Q=" data-identifier-application__slash__x-doc-key="8K4nyRy9Bv1jqLbj" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; text-size-adjust: inherit;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span>

<section data-identifier-application__slash__x-doc-key="4j6OJ5jkkBNgDq3p" data-pm-slice="0 0 []" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><table style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px 0px 10px; padding: 0px; outline: 0px; border-collapse: collapse; display: table; width: 650px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; table-layout: fixed;"><tbody style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><tr style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><td style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 4px 8px; outline: 0px; overflow-wrap: break-word; word-break: break-all; hyphens: auto; border: 1px solid rgb(0, 0, 0); max-width: 100%; box-sizing: border-box !important; overflow: hidden; vertical-align: top;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">时间</span></span>

</td><td style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 4px 8px; outline: 0px; overflow-wrap: break-word; word-break: break-all; hyphens: auto; border: 1px solid rgb(0, 0, 0); max-width: 100%; box-sizing: border-box !important; overflow: hidden; vertical-align: top;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">事件</span></span>

</td></tr><tr style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><td style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 4px 8px; outline: 0px; overflow-wrap: break-word; word-break: break-all; hyphens: auto; border: 1px solid rgb(0, 0, 0); max-width: 100%; box-sizing: border-box !important; overflow: hidden; vertical-align: top;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">2026 年 3 月 23 日</span></span>

</td><td style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 4px 8px; outline: 0px; overflow-wrap: break-word; word-break: break-all; hyphens: auto; border: 1px solid rgb(0, 0, 0); max-width: 100%; box-sizing: border-box !important; overflow: hidden; vertical-align: top;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">漏洞报告至 Linux 内核安全团队</span></span>

</td></tr><tr style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><td style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 4px 8px; outline: 0px; overflow-wrap: break-word; word-break: break-all; hyphens: auto; border: 1px solid rgb(0, 0, 0); max-width: 100%; box-sizing: border-box !important; overflow: hidden; vertical-align: top;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">2026 年 3 月 24 日</span></span>

</td><td style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 4px 8px; outline: 0px; overflow-wrap: break-word; word-break: break-all; hyphens: auto; border: 1px solid rgb(0, 0, 0); max-width: 100%; box-sizing: border-box !important; overflow: hidden; vertical-align: top;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">内核安全团队确认收到</span></span>

</td></tr><tr style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><td style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 4px 8px; outline: 0px; overflow-wrap: break-word; word-break: break-all; hyphens: auto; border: 1px solid rgb(0, 0, 0); max-width: 100%; box-sizing: border-box !important; overflow: hidden; vertical-align: top;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">2026 年 3 月 25 日</span></span>

</td><td style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 4px 8px; outline: 0px; overflow-wrap: break-word; word-break: break-all; hyphens: auto; border: 1px solid rgb(0, 0, 0); max-width: 100%; box-sizing: border-box !important; overflow: hidden; vertical-align: top;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">补丁提出并完成审查</span></span>

</td></tr><tr style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><td style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 4px 8px; outline: 0px; overflow-wrap: break-word; word-break: break-all; hyphens: auto; border: 1px solid rgb(0, 0, 0); max-width: 100%; box-sizing: border-box !important; overflow: hidden; vertical-align: top;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">2026 年 4 月 1 日</span></span>

</td><td style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 4px 8px; outline: 0px; overflow-wrap: break-word; word-break: break-all; hyphens: auto; border: 1px solid rgb(0, 0, 0); max-width: 100%; box-sizing: border-box !important; overflow: hidden; vertical-align: top;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">修复 commit </span></span>`<span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">a664bf3d603d</span></span>`<span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">合入 mainline</span></span>

</td></tr><tr style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><td style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 4px 8px; outline: 0px; overflow-wrap: break-word; word-break: break-all; hyphens: auto; border: 1px solid rgb(0, 0, 0); max-width: 100%; box-sizing: border-box !important; overflow: hidden; vertical-align: top;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">2026 年 4 月 22 日</span></span>

</td><td style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 4px 8px; outline: 0px; overflow-wrap: break-word; word-break: break-all; hyphens: auto; border: 1px solid rgb(0, 0, 0); max-width: 100%; box-sizing: border-box !important; overflow: hidden; vertical-align: top;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">CVE-2026-31431 正式分配</span></span>

</td></tr><tr style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><td style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 4px 8px; outline: 0px; overflow-wrap: break-word; word-break: break-all; hyphens: auto; border: 1px solid rgb(0, 0, 0); max-width: 100%; box-sizing: border-box !important; overflow: hidden; vertical-align: top;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">2026 年 4 月 29 日</span></span>

</td><td style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 4px 8px; outline: 0px; overflow-wrap: break-word; word-break: break-all; hyphens: auto; border: 1px solid rgb(0, 0, 0); max-width: 100%; box-sizing: border-box !important; overflow: hidden; vertical-align: top;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">公开披露，EXP 同步发布</span></span>

</td></tr><tr style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><td style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 4px 8px; outline: 0px; overflow-wrap: break-word; word-break: break-all; hyphens: auto; border: 1px solid rgb(0, 0, 0); max-width: 100%; box-sizing: border-box !important; overflow: hidden; vertical-align: top;"><span data-type="text" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">2026 年 4 月 30 日</span></span>

</td><td style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 4px 8px; outline: 0px; overflow-wrap: break-word; word-break: break-all; hyphens: auto; border: 1px solid rgb(0, 0, 0); max-width: 100%; box-sizing: border-box !important; overflow: hidden; vertical-align: top;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">长亭安全应急响应中心发布通告</span>

</td></tr></tbody></table>

</section><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; font-size: 15px;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></span>

</section></section></section></section><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span>

</section><section style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">  
</span></section></section><section data-role="paragraph" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; letter-spacing: normal; text-align: start; white-space: normal; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><section data-clipboard-cangjie="["root",{"copyFrom":1329378339},["p",{"uuid":"lhbw6gwwf5hgshd51os"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"由于系统未对系统接口的响应进行合理的处理，导致该系统会泄漏已注册用户信息，攻击者可利用信息泄露漏洞获取注册用户的信息。另外由于系统使用了不当的算法设计，攻击者可模拟任意用户登录系统。"]]],["p",{"uuid":"lhbw6jvlp8ey3x5omd"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"对攻击者来说，这两个漏洞的利用无需认证和鉴权，可通过组合漏洞获取用户数据，登录后台。"]]]]" data-identifier-application__slash__x-doc-key="LvBPlNWKY5PVndG8" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><section data-clipboard-cangjie="["root",{"copyFrom":398674325},["p",{"spacing":{"after":"12pt","afterAutospacing":false,"before":"0pt","beforeAutospacing":false},"uuid":"lhsmfajr95jz91x7s4q"},["span",{"data-type":"text"},["span",{"data-type":"leaf"},"漏洞的官方描述为当RocketMQ多个组件暴露在外网，并且缺乏有效的身份认证机制，那么攻击者可以利用"],["span",{"highlight":"rgb(252, 252, 252)","data-type":"leaf"},"更新配置功能，以RocketMQ运行的系统用户身份执行命令。"]]],["p",{"spacing":{"after":"12pt","afterAutospacing":false,"before":"0pt","beforeAutospacing":false},"uuid":"licz6vm6uu9cyvgzbm"},["span",{"data-type":"text"},["span",{"bold":false,"sz":11,"szUnit":"pt","data-type":"leaf"},"经过深入分析，长亭科技应急响应实验室发现，官方的漏洞描述存在不准确之处。实际上，只要能访问到Broker服务且该服务未开启身份认证，就可能实现远程命令执行，无需其他条件。"]]]]" data-identifier-application__slash__x-doc-key="XYvenvXNYavMOoyZ" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;"><section data-clipboard-cangjie="["root",{"copyFrom":1329378339},["p",{"uuid":"lhbwfatppk7t6mctnlg"},["span",{"data-type":"text"},["span",{"bold":false,"sz":11,"szUnit":"pt","data-type":"leaf"},"官方已经发布了安全补丁，在参考链接中安装官方提供的安全补丁 。"]]]]" data-identifier-application__slash__x-cangjie-fragment="JTdCJTIya2xhc3MlMjIlM0ElMjJkb2N1bWVudCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMmtsYXNzJTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIycGFyYWdyYXBoJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiUyMnV1aWQlMjIlM0ElMjJsaGJ3ZmF0cHBrN3Q2bWN0bmxnJTIyJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyJUU1JUFFJTk4JUU2JTk2JUI5JUU1JUI3JUIyJUU3JUJCJThGJUU1JThGJTkxJUU1JUI4JTgzJUU0JUJBJTg2JUU1JUFFJTg5JUU1JTg1JUE4JUU4JUExJUE1JUU0JUI4JTgxJUVGJUJDJThDJUU1JTlDJUE4JUU1JThGJTgyJUU4JTgwJTgzJUU5JTkzJUJFJUU2JThFJUE1JUU0JUI4JUFEJUU1JUFFJTg5JUU4JUEzJTg1JUU1JUFFJTk4JUU2JTk2JUI5JUU2JThGJTkwJUU0JUJFJTlCJUU3JTlBJTg0JUU1JUFFJTg5JUU1JTg1JUE4JUU4JUExJUE1JUU0JUI4JTgxJTIwJUUzJTgwJTgyJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlN0IlMjJrbGFzcyUyMiUzQSUyMm1hcmslMjIlMkMlMjJ0eXBlJTIyJTNBJTIyYm9sZCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlMjJ2YWx1ZSUyMiUzQWZhbHNlJTdEJTdEJTJDJTdCJTIya2xhc3MlMjIlM0ElMjJtYXJrJTIyJTJDJTIydHlwZSUyMiUzQSUyMnN6JTIyJTJDJTIyZGF0YSUyMiUzQSU3QiUyMnZhbHVlJTIyJTNBMTElMkMlMjJzelVuaXQlMjIlM0ElMjJwdCUyMiU3RCU3RCU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==" data-identifier-application__slash__x-doc-key="LvBPlNWKY5PVndG8" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; letter-spacing: normal; text-align: start; white-space: normal; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><section data-autoskip="1" style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px 0px 16px; padding: 16px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: normal; overflow: auto; font-size: 15px; line-height: 1.45; border-radius: 3px; background-color: rgb(247, 247, 247);"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgb(31, 31, 31);"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">参考资料：</span></span>

<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important; color: rgb(31, 31, 31);"><span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">\[1\].https://copy.fail/</span></span>

<span style="-webkit-tap-highlight-color: rgba(0, 0, 0, 0); margin: 0px; padding: 0px; outline: 0px; max-width: 100%; box-sizing: border-box !important; overflow-wrap: break-word !important;">\[2\].https://github.com/theori-io/copy-fail-CVE-2026-31431</span>

</section></section></section></section></section></section></section></section></section></section></section></section></div>