fix(cve): 修复 CVE-2026-9828 在 logback 中的漏洞-logback-AtomGit

已关闭

fix(cve): 修复 CVE-2026-9828 在 logback 中的漏洞 #39

infra_team创建于 5月30日关闭于 20 天前从infra_team/logback： fix-CVE-2026-9828-master 合入到 src-openeuler/logback： master

fix(cve): 修复 CVE-2026-9828 在 logback 中的漏洞 #39

已关闭

infra_team创建于 5月30日关闭于 20 天前

从infra_team/logback fix-CVE-2026-9828-master合入到src-openeuler/logback master

共 2 个文件变更+90-1

ACVE-2026-9828.patch+84-0

@@ -0,0 +1,84 @@
	1	+From: infra_team <zhaiwenjie1@huawei.com>
	2	+Date: Sat May 30 2026
	3	+Subject: [PATCH] fix: CVE-2026-9828 - replace package-level whitelist with class-level whitelist and prevent proxy class bypass
	4	+
	5	+fix: CVE-2026-9828 - HardenedObjectInputStream.isWhitelisted() used
	6	+package prefix matching (startsWith("java.lang") / startsWith("java.util")),
	7	+allowing attackers to instantiate arbitrary classes in those packages via
	8	+SimpleSocketServer/SimpleSSLSocketServer, bypassing deserialization restrictions.
	9	+Also adds resolveProxyClass override to prevent proxy class bypass.
	10	+
	11	+Replace JAVA_PACKAGES (package-level) with JAVA_CLASSES (class-level) whitelist,
	12	+change isWhitelisted() to use equals() instead of startsWith(), and override
	13	+resolveProxyClass() to throw InvalidClassException.
	14	+
	15	+Upstream-commit: https://github.com/qos-ch/logback/commit/12cf2c5a150ee3ff4a720789bcfc6e047e836b0c
	16	+Upstream-commit: https://github.com/qos-ch/logback/commit/f7a0654c2b7e8e1c461e3d9e483e82ef969b5818
	17	+Signed-off-by: infra_team <zhaiwenjie1@huawei.com>
	18	+---
	19	+--- a/logback-core/src/main/java/ch/qos/logback/core/net/HardenedObjectInputStream.java
	20	++++ b/logback-core/src/main/java/ch/qos/logback/core/net/HardenedObjectInputStream.java
	21	+@@ -24,13 +24,13 @@
	22	+ import java.lang.reflect.Method;
	23	+ import java.util.ArrayList;
	24	+ import java.util.List;
	25	++import java.util.Arrays;
	26	+
	27	+ /**
	28	+ * HardenedObjectInputStream restricts the set of classes that can be deserialized to a set of
	29	+ * explicitly whitelisted classes. This prevents certain type of attacks from being successful.
	30	+ *
	31	+- * <p>It is assumed that classes in the "java.lang" and "java.util" packages are
	32	+- * always authorized.</p>
	33	++ * <p>Only explicitly listed classes in java.lang and java.util packages are authorized.</p>
	34	+ *
	35	+ * @author Ceki Gülcü
	36	+ * @since 1.2.0
	37	+@@ -38,7 +38,24 @@
	38	+ public class HardenedObjectInputStream extends ObjectInputStream {
	39	+
	40	+ final List<String> whitelistedClassNames;
	41	+- final static String[] JAVA_PACKAGES = new String[] { "java.lang", "java.util" };
	42	++ final static String[] JAVA_CLASSES = new String[] {
	43	++ "java.lang.Boolean",
	44	++ "java.lang.Byte",
	45	++ "java.lang.Character",
	46	++ "java.lang.Double",
	47	++ "java.lang.Float",
	48	++ "java.lang.Integer",
	49	++ "java.lang.Long",
	50	++ "java.lang.Number",
	51	++ "java.lang.Short",
	52	++ "java.lang.String",
	53	++ "java.lang.Throwable",
	54	++ "java.util.ArrayList",
	55	++ "java.util.Collections$EmptyMap",
	56	++ "java.util.Collections$UnmodifiableMap",
	57	++ "java.util.concurrent.CopyOnWriteArrayList",
	58	++ "java.util.HashMap"
	59	++ };
	60	+ final private static int DEPTH_LIMIT = 16;
	61	+ final private static int ARRAY_LIMIT = 10000;
	62	+
	63	+@@ -104,9 +121,19 @@
	64	+ return super.resolveClass(anObjectStreamClass);
	65	+ }
	66	+
	67	++
	68	++ /**
	69	++ * There is no reason to have proxy classes in logback deserialization, so we just
	70	++ * throw an exception here to prevent any potential bypasses that could be achieved
	71	++ * through proxy classes.
	72	++ */
	73	++ @Override
	74	++ protected Class<?> resolveProxyClass(String[] interfaces) throws IOException, ClassNotFoundException {
	75	++ throw new InvalidClassException("Unauthorized deserialization attempt ", Arrays.toString(interfaces));
	76	++ }
	77	+ private boolean isWhitelisted(String incomingClassName) {
	78	+- for (int i = 0; i < JAVA_PACKAGES.length; i++) {
	79	+- if (incomingClassName.startsWith(JAVA_PACKAGES[i]))
	80	++ for (String javaClass : JAVA_CLASSES) {
	81	++ if (incomingClassName.equals(javaClass))
	82	+ return true;
	83	+ }
	84	+ for (String whiteListed : whitelistedClassNames) {

Mlogback.spec+6-1

	@@ -1,6 +1,6 @@
1	Name: logback	1	Name: logback
2	Version: 1.2.8	2	Version: 1.2.8
3	-Release: 4	3	+Release: 5
4	Summary: A Java logging library	4	Summary: A Java logging library
5	License: LGPLv2 or EPL-1.0	5	License: LGPLv2 or EPL-1.0
6	URL: http://logback.qos.ch/	6	URL: http://logback.qos.ch/
	@@ -9,6 +9,7 @@ Source0: https://github.com/qos-ch/logback/archive/v_%{version}.tar.gz
9	Patch0001: logback-1.2.8-jetty.patch	9	Patch0001: logback-1.2.8-jetty.patch
10	Patch0002: CVE-2023-6378-and-CVE-2023-6481.patch	10	Patch0002: CVE-2023-6378-and-CVE-2023-6481.patch
11	Patch0003: CVE-2024-12798-and-CVE-2024-12801.patch	11	Patch0003: CVE-2024-12798-and-CVE-2024-12801.patch
		12	+Patch0004: CVE-2026-9828.patch
12		13
13	BuildRequires: java-devel >= 1:1.6.0 maven-local mvn(javax.mail:mail)	14	BuildRequires: java-devel >= 1:1.6.0 maven-local mvn(javax.mail:mail)
14	BuildRequires: mvn(javax.servlet:javax.servlet-api) mvn(junit:junit) mvn(log4j:log4j:1.2.17)	15	BuildRequires: mvn(javax.servlet:javax.servlet-api) mvn(junit:junit) mvn(log4j:log4j:1.2.17)
	@@ -124,6 +125,10 @@ cp -r %{name}-examples/pom.xml %{name}-examples/src %{buildroot}%{_datadir}/%{na
124	%files help -f .mfiles-javadoc	125	%files help -f .mfiles-javadoc
125		126
126	%changelog	127	%changelog
		128	+* Sat May 30 2026 infra_team <zhaiwenjie1@huawei.com> - 1.2.8-5
		129	+- fix CVE: CVE-2026-9828
		130	+- Replace JAVA_PACKAGES package-level whitelist with JAVA_CLASSES class-level whitelist in HardenedObjectInputStream, and add resolveProxyClass override to prevent proxy class bypass
		131	+
127	* Mon Jan 20 2025 yaoxin <1024769339@qq.com> - 1.2.8-4	132	* Mon Jan 20 2025 yaoxin <1024769339@qq.com> - 1.2.8-4
128	- Fix CVE-2024-12798 and CVE-2024-12801	133	- Fix CVE-2024-12798 and CVE-2024-12801
129		134