Closed
fix(cve): 修复 CVE-2026-10532 在 logback 中的漏洞 #41
infra_teamAdd on Jun 2Closed at 26 days ago
fix(cve): 修复 CVE-2026-10532 在 logback 中的漏洞 #41
Closed
Total: 2 files changed+49-1
| @@ -0,0 +1,42 @@ | |||
| 1 | +From: ceki <ceki@qos.ch> | ||
| 2 | +Date: Fri, 29 May 2026 21:50:57 +0200 | ||
| 3 | +Subject: [PATCH] fix: CVE-2026-10532 - prevent resolveProxyClass bypass | ||
| 4 | + | ||
| 5 | +Override resolveProxyClass() in HardenedObjectInputStream to throw | ||
| 6 | +InvalidClassException, preventing attackers from bypassing the class | ||
| 7 | +whitelist via dynamic proxy deserialization. | ||
| 8 | + | ||
| 9 | +Upstream-commit: https://github.com/qos-ch/logback/commit/f7a0654c2b7e8e1c461e3d9e483e82ef969b5818 | ||
| 10 | +Signed-off-by: infra_team <zhaiwenjie1@huawei.com> | ||
| 11 | +--- | ||
| 12 | +--- a/logback-core/src/main/java/ch/qos/logback/core/net/HardenedObjectInputStream.java 2026-06-02 15:14:32.850745015 +0800 | ||
| 13 | ++++ b/logback-core/src/main/java/ch/qos/logback/core/net/HardenedObjectInputStream.java 2026-06-02 15:19:26.051970533 +0800 | ||
| 14 | +@@ -6,6 +6,7 @@ | ||
| 15 | + import java.io.ObjectInputStream; | ||
| 16 | + import java.io.ObjectStreamClass; | ||
| 17 | + import java.util.ArrayList; | ||
| 18 | ++import java.util.Arrays; | ||
| 19 | + import java.util.List; | ||
| 20 | + | ||
| 21 | + /** | ||
| 22 | +@@ -53,6 +54,20 @@ | ||
| 23 | + return super.resolveClass(anObjectStreamClass); | ||
| 24 | + } | ||
| 25 | + | ||
| 26 | ++ /** | ||
| 27 | ++ * There is no reason to have proxy classes in logback deserialization, so we just | ||
| 28 | ++ * throw an exception here to prevent any potential bypasses that could be achieved | ||
| 29 | ++ * through proxy classes. | ||
| 30 | ++ * | ||
| 31 | ++ * @param interfaces the list of interface names that were | ||
| 32 | ++ * deserialized in the proxy class descriptor | ||
| 33 | ++ * @since 1.2.8 | ||
| 34 | ++ */ | ||
| 35 | ++ @Override | ||
| 36 | ++ protected Class<?> resolveProxyClass(String[] interfaces) throws IOException, ClassNotFoundException { | ||
| 37 | ++ throw new InvalidClassException("Unauthorized deserialization attempt ", Arrays.toString(interfaces)); | ||
| 38 | ++ } | ||
| 39 | ++ | ||
| 40 | + private boolean isWhitelisted(String incomingClassName) { | ||
| 41 | + for (int i = 0; i < JAVA_PACKAGES.length; i++) { | ||
| 42 | + if (incomingClassName.startsWith(JAVA_PACKAGES[i])) | ||
| @@ -1,6 +1,6 @@ | |||
| 1 | Name: logback | 1 | Name: logback |
| 2 | Version: 1.2.8 | 2 | Version: 1.2.8 |
| 3 | -Release: 4 | 3 | +Release: 5 |
| 4 | Summary: A Java logging library | 4 | Summary: A Java logging library |
| 5 | License: LGPLv2 or EPL-1.0 | 5 | License: LGPLv2 or EPL-1.0 |
| 6 | URL: http://logback.qos.ch/ | 6 | URL: http://logback.qos.ch/ |
| @@ -9,6 +9,7 @@ Source0: https://github.com/qos-ch/logback/archive/v_%{version}.tar.gz | |||
| 9 | Patch0001: logback-1.2.8-jetty.patch | 9 | Patch0001: logback-1.2.8-jetty.patch |
| 10 | Patch0002: CVE-2023-6378-and-CVE-2023-6481.patch | 10 | Patch0002: CVE-2023-6378-and-CVE-2023-6481.patch |
| 11 | Patch0003: CVE-2024-12798-and-CVE-2024-12801.patch | 11 | Patch0003: CVE-2024-12798-and-CVE-2024-12801.patch |
| 12 | +Patch0004: CVE-2026-10532.patch | ||
| 12 | 13 | ||
| 13 | BuildRequires: java-devel >= 1:1.6.0 maven-local mvn(javax.mail:mail) | 14 | BuildRequires: java-devel >= 1:1.6.0 maven-local mvn(javax.mail:mail) |
| 14 | BuildRequires: mvn(javax.servlet:javax.servlet-api) mvn(junit:junit) mvn(log4j:log4j:1.2.17) | 15 | BuildRequires: mvn(javax.servlet:javax.servlet-api) mvn(junit:junit) mvn(log4j:log4j:1.2.17) |
| @@ -67,6 +68,7 @@ logback-examples module. | |||
| 67 | 68 | ||
| 68 | %prep | 69 | %prep |
| 69 | %autosetup -p1 -n %{name}-v_%{version} | 70 | %autosetup -p1 -n %{name}-v_%{version} |
| 71 | +%patch0004 -p1 | ||
| 70 | find . -name "*.class" -delete | 72 | find . -name "*.class" -delete |
| 71 | find . -name "*.cmd" -delete | 73 | find . -name "*.cmd" -delete |
| 72 | find . -name "*.jar" -delete | 74 | find . -name "*.jar" -delete |
| @@ -124,6 +126,10 @@ cp -r %{name}-examples/pom.xml %{name}-examples/src %{buildroot}%{_datadir}/%{na | |||
| 124 | %files help -f .mfiles-javadoc | 126 | %files help -f .mfiles-javadoc |
| 125 | 127 | ||
| 126 | %changelog | 128 | %changelog |
| 129 | +* Tue Jun 02 2026 infra_team <zhaiwenjie1@huawei.com> - 1.2.8-5 | ||
| 130 | +- fix CVE: CVE-2026-10532 | ||
| 131 | +- Override resolveProxyClass() to prevent dynamic proxy deserialization bypass | ||
| 132 | + | ||
| 127 | * Mon Jan 20 2025 yaoxin <1024769339@qq.com> - 1.2.8-4 | 133 | * Mon Jan 20 2025 yaoxin <1024769339@qq.com> - 1.2.8-4 |
| 128 | - Fix CVE-2024-12798 and CVE-2024-12801 | 134 | - Fix CVE-2024-12798 and CVE-2024-12801 |
| 129 | 135 | ||