已开启
fix(cve): 修复 CVE-2026-9828 在 logback 中的漏洞 #38
infra_team创建于 5月29日
fix(cve): 修复 CVE-2026-9828 在 logback 中的漏洞 #38
已开启
共 2 个文件变更+70-1
| @@ -0,0 +1,65 @@ | |||
| 1 | +From: infra_team <zhaiwenjie1@huawei.com> | ||
| 2 | +Date: Thu May 29 2026 | ||
| 3 | +Subject: [PATCH] fix: CVE-2026-9828 - replace package-level whitelist with class-level whitelist | ||
| 4 | + | ||
| 5 | +fix: CVE-2026-9828 - HardenedObjectInputStream.isWhitelisted() used | ||
| 6 | +package prefix matching (startsWith("java.lang") / startsWith("java.util")), | ||
| 7 | +allowing attackers to instantiate arbitrary classes in those packages via | ||
| 8 | +SimpleSocketServer/SimpleSSLSocketServer, bypassing deserialization restrictions. | ||
| 9 | + | ||
| 10 | +Replace JAVA_PACKAGES (package-level) with JAVA_CLASSES (class-level) whitelist | ||
| 11 | +and change isWhitelisted() to use equals() instead of startsWith(). | ||
| 12 | + | ||
| 13 | +Upstream-commit: https://github.com/qos-ch/logback/commit/12cf2c5a150ee3ff4a720789bcfc6e047e836b0c | ||
| 14 | +Upstream-commit: https://github.com/qos-ch/logback/commit/b768a96e191bf0d15aeff207a5b160e5c0c8dba2 | ||
| 15 | +Signed-off-by: infra_team <zhaiwenjie1@huawei.com> | ||
| 16 | +--- | ||
| 17 | +--- a/logback-core/src/main/java/ch/qos/logback/core/net/HardenedObjectInputStream.java 2026-05-29 15:55:52.655186714 +0800 | ||
| 18 | ++++ b/logback-core/src/main/java/ch/qos/logback/core/net/HardenedObjectInputStream.java 2026-05-29 15:56:49.044998255 +0800 | ||
| 19 | +@@ -29,8 +29,7 @@ | ||
| 20 | + * HardenedObjectInputStream restricts the set of classes that can be deserialized to a set of | ||
| 21 | + * explicitly whitelisted classes. This prevents certain type of attacks from being successful. | ||
| 22 | + * | ||
| 23 | +- * <p>It is assumed that classes in the "java.lang" and "java.util" packages are | ||
| 24 | +- * always authorized.</p> | ||
| 25 | ++ * <p>Only explicitly listed classes in java.lang and java.util packages are authorized.</p> | ||
| 26 | + * | ||
| 27 | + * @author Ceki Gülcü | ||
| 28 | + * @since 1.2.0 | ||
| 29 | +@@ -38,7 +37,24 @@ | ||
| 30 | + public class HardenedObjectInputStream extends ObjectInputStream { | ||
| 31 | + | ||
| 32 | + final List<String> whitelistedClassNames; | ||
| 33 | +- final static String[] JAVA_PACKAGES = new String[] { "java.lang", "java.util" }; | ||
| 34 | ++ final static String[] JAVA_CLASSES = new String[] { | ||
| 35 | ++ "java.lang.Boolean", | ||
| 36 | ++ "java.lang.Byte", | ||
| 37 | ++ "java.lang.Character", | ||
| 38 | ++ "java.lang.Double", | ||
| 39 | ++ "java.lang.Float", | ||
| 40 | ++ "java.lang.Integer", | ||
| 41 | ++ "java.lang.Long", | ||
| 42 | ++ "java.lang.Number", | ||
| 43 | ++ "java.lang.Short", | ||
| 44 | ++ "java.lang.String", | ||
| 45 | ++ "java.lang.Throwable", | ||
| 46 | ++ "java.util.ArrayList", | ||
| 47 | ++ "java.util.Collections$EmptyMap", | ||
| 48 | ++ "java.util.Collections$UnmodifiableMap", | ||
| 49 | ++ "java.util.concurrent.CopyOnWriteArrayList", | ||
| 50 | ++ "java.util.HashMap" | ||
| 51 | ++ }; | ||
| 52 | + final private static int DEPTH_LIMIT = 16; | ||
| 53 | + final private static int ARRAY_LIMIT = 10000; | ||
| 54 | + | ||
| 55 | +@@ -105,8 +121,8 @@ | ||
| 56 | + } | ||
| 57 | + | ||
| 58 | + private boolean isWhitelisted(String incomingClassName) { | ||
| 59 | +- for (int i = 0; i < JAVA_PACKAGES.length; i++) { | ||
| 60 | +- if (incomingClassName.startsWith(JAVA_PACKAGES[i])) | ||
| 61 | ++ for (String javaClass : JAVA_CLASSES) { | ||
| 62 | ++ if (incomingClassName.equals(javaClass)) | ||
| 63 | + return true; | ||
| 64 | + } | ||
| 65 | + for (String whiteListed : whitelistedClassNames) { | ||
| @@ -1,6 +1,6 @@ | |||
| 1 | Name: logback | 1 | Name: logback |
| 2 | Version: 1.2.8 | 2 | Version: 1.2.8 |
| 3 | -Release: 4 | 3 | +Release: 5 |
| 4 | Summary: A Java logging library | 4 | Summary: A Java logging library |
| 5 | License: LGPLv2 or EPL-1.0 | 5 | License: LGPLv2 or EPL-1.0 |
| 6 | URL: http://logback.qos.ch/ | 6 | URL: http://logback.qos.ch/ |
| @@ -9,6 +9,7 @@ Source0: https://github.com/qos-ch/logback/archive/v_%{version}.tar.gz | |||
| 9 | Patch0001: logback-1.2.8-jetty.patch | 9 | Patch0001: logback-1.2.8-jetty.patch |
| 10 | Patch0002: CVE-2023-6378-and-CVE-2023-6481.patch | 10 | Patch0002: CVE-2023-6378-and-CVE-2023-6481.patch |
| 11 | Patch0003: CVE-2024-12798-and-CVE-2024-12801.patch | 11 | Patch0003: CVE-2024-12798-and-CVE-2024-12801.patch |
| 12 | +Patch0004: CVE-2026-9828.patch | ||
| 12 | 13 | ||
| 13 | BuildRequires: java-devel >= 1:1.6.0 maven-local mvn(javax.mail:mail) | 14 | BuildRequires: java-devel >= 1:1.6.0 maven-local mvn(javax.mail:mail) |
| 14 | BuildRequires: mvn(javax.servlet:javax.servlet-api) mvn(junit:junit) mvn(log4j:log4j:1.2.17) | 15 | BuildRequires: mvn(javax.servlet:javax.servlet-api) mvn(junit:junit) mvn(log4j:log4j:1.2.17) |
| @@ -124,6 +125,9 @@ cp -r %{name}-examples/pom.xml %{name}-examples/src %{buildroot}%{_datadir}/%{na | |||
| 124 | %files help -f .mfiles-javadoc | 125 | %files help -f .mfiles-javadoc |
| 125 | 126 | ||
| 126 | %changelog | 127 | %changelog |
| 128 | +* Fri May 29 2026 infra_team <zhaiwenjie1@huawei.com> - 1.2.8-5 | ||
| 129 | +- Fix CVE-2026-9828: replace package-level whitelist with class-level whitelist in HardenedObjectInputStream | ||
| 130 | + | ||
| 127 | * Mon Jan 20 2025 yaoxin <1024769339@qq.com> - 1.2.8-4 | 131 | * Mon Jan 20 2025 yaoxin <1024769339@qq.com> - 1.2.8-4 |
| 128 | - Fix CVE-2024-12798 and CVE-2024-12801 | 132 | - Fix CVE-2024-12798 and CVE-2024-12801 |
| 129 | 133 | ||