btiÌåÓý

¹ØÓÚSpring Cloud GatewayÔ¶³Ì´úÂëÖ´ÐÐÎó²îµÄÇ徲ͨ¸æ

Ðû²¼Ê±¼ä£º2022-03-02 00:00:00 ×÷Õߣºadmin

Ò»¡¢¡¢¡¢Åä¾°½éÉÜ

¿ËÈÕ£¬£¬£¬ÊÐÎ¯ÍøÐŰìÊÖÒÕÖ§³Öµ¥Î»¼à²âµ½VMware¹Ù·½Ðû²¼Ç徲ͨ¸æ£¬£¬£¬Åû¶ÁËSpring Cloud Gateway±£´æ´úÂë×¢ÈëÎó²î£¬£¬£¬Îó²î±àºÅCVE-2022-22947¡£

1.1 Îó²îÐÎò

µ±ÆôÓúÍ̻¶²»Çå¾²µÄ Gateway Actuator ¶Ëµãʱ£¬£¬£¬Ê¹Óà Spring Cloud Gateway µÄÓ¦ÓóÌÐòÈÝÒ×Êܵ½´úÂë×¢Èë¹¥»÷¡£Ô¶³Ì¹¥»÷Õß¿ÉÒÔ·¢³ö¶ñÒâÖÆ×÷µÄÇëÇ󣬣¬£¬ÀÖ³ÉʹÓøÃÎó²î¿ÉÒÔµ¼Ö´úÂëÖ´ÐС£

1.2 Îó²î±àºÅ

CVE-2022-22947

1.3 Îó²îÆ·¼¶

¸ßΣ

¶þ¡¢¡¢¡¢ÐÞ¸´½¨Òé

2.1 ÊÜÓ°Ïì°æ±¾ 

Spring Cloud Gateway < 3.1.1

Spring Cloud Gateway 3.0.0 -3.0.7

Spring Cloud Gateway ÆäËûÒѲ»ÔÙ¸üеİ汾

2.2 ÐÞ¸´½¨Òé

½â¾ö·½°¸£ºÉý¼¶µ½Çå¾²°æ±¾

Çå¾²°æ±¾£º

Spring Cloud Gateway >= 3.1.1

Spring Cloud Gateway >= 3.0.7

2.3 ÔÝʱ»º½â²½·¥

ÈôÊDz»ÐèÒªGateway actuator endpoint£¬£¬£¬¿ÉÒÔͨ¹ý management.endpoint.gateway.enabled: false ½ûÓÃËü¡£ÈôÊÇÐèÒªactuator£¬£¬£¬¿ÉÒÔʹÓà Spring Security ¶ÔÆä¾ÙÐб£»£»£»¤£¬£¬£¬Çë²ÎÔÄhttps://docs.spring.io/spring-boot/docs/current/reference/html/actuator.html#actuator.endpoints.security¡£

¹Ù·½Í¨¸æ£ºhttps://tanzu.vmware.com/security/cve-2022-22947


¡¾ÍøÕ¾µØÍ¼¡¿
_visitcount?siteId=156&type=3&articleId=143055