1.修復(fù)的CVE ·CVE-2018-16838 描述：在sssd組策略對(duì)象實(shí)現(xiàn)中發(fā)現(xiàn)一個(gè)缺陷。當(dāng)sso側(cè)的sso設(shè)置為不允許所有用戶登錄時(shí)，sso會(huì)嚴(yán)格拒絕sso的訪問(wèn)權(quán)限。 ·CVE-2019-3811 描述：在sssd中發(fā)現(xiàn)了一個(gè)漏洞，其中，如果用戶未設(shè)置主目錄，sssd將返回“/”（根目錄）而不是“”（空字符串/no home directory）。這可能會(huì)影響通過(guò)chroot（）限制用戶在其主目錄內(nèi)訪問(wèn)文件系統(tǒng)的服務(wù)。 2.受影響的軟件包 ·中標(biāo)麒麟高級(jí)服務(wù)器操作系統(tǒng) V7 ·aarch64架構(gòu): libipa_hbac、libipa_hbac-devel、libsss_autofs、libsss_certmap、libsss_certmap-devel、libsss_idmap、libsss_idmap-devel、libsss_nss_idmap、libsss_nss_idmap-devel、libsss_simpleifp、libsss_simpleifp-devel、libsss_sudo、python-libipa_hbac、python-libsss_nss_idmap、python-sss、python-sss-murmur、python-sssdconfig、sssd、sssd-ad、sssd-client、sssd-common、sssd-common-pac、sssd-dbus、sssd-ipa、sssd-kcm、sssd-krb5、sssd-krb5-common、sssd-ldap、sssd-libwbclient、sssd-libwbclient-devel、sssd-polkit-rules、sssd-proxy、sssd-tools、sssd-winbind-idmap ·x86_64架構(gòu): libipa_hbac、libipa_hbac-devel、libsss_autofs、libsss_certmap、libsss_certmap-devel、libsss_idmap、libsss_idmap-devel、libsss_nss_idmap、libsss_nss_idmap-devel、libsss_simpleifp、libsss_simpleifp-devel、libsss_sudo、python-libipa_hbac、python-libsss_nss_idmap、python-sss、python-sss-murmur、python-sssdconfig、sssd、sssd-ad、sssd-client、sssd-common、sssd-common-pac、sssd-dbus、sssd-ipa、sssd-kcm、sssd-krb5、sssd-krb5-common、sssd-ldap、sssd-libwbclient、sssd-libwbclient-devel、sssd-polkit-rules、sssd-proxy、sssd-tools、sssd-winbind-idmap 3.軟件包修復(fù)版本 ·中標(biāo)麒麟高級(jí)服務(wù)器操作系統(tǒng) V7 (aarch64、x86_64) libipa_hbac-1.16.4-21.el7或以上版本 libipa_hbac-devel-1.16.4-21.el7或以上版本 libsss_autofs-1.16.4-21.el7或以上版本 libsss_certmap-1.16.4-21.el7或以上版本 libsss_certmap-devel-1.16.4-21.el7或以上版本 libsss_idmap-1.16.4-21.el7或以上版本 libsss_idmap-devel-1.16.4-21.el7或以上版本 libsss_nss_idmap-1.16.4-21.el7或以上版本 libsss_nss_idmap-devel-1.16.4-21.el7或以上版本 libsss_simpleifp-1.16.4-21.el7或以上版本 libsss_simpleifp-devel-1.16.4-21.el7或以上版本 libsss_sudo-1.16.4-21.el7或以上版本 python-libipa_hbac-1.16.4-21.el7或以上版本 python-libsss_nss_idmap-1.16.4-21.el7或以上版本 python-sss-1.16.4-21.el7或以上版本 python-sss-murmur-1.16.4-21.el7或以上版本 python-sssdconfig-1.16.4-21.el7或以上版本 sssd-1.16.4-21.el7或以上版本 sssd-ad-1.16.4-21.el7或以上版本 sssd-client-1.16.4-21.el7或以上版本 sssd-common-1.16.4-21.el7或以上版本 sssd-common-pac-1.16.4-21.el7或以上版本 sssd-dbus-1.16.4-21.el7或以上版本 sssd-ipa-1.16.4-21.el7或以上版本 sssd-kcm-1.16.4-21.el7或以上版本 sssd-krb5-1.16.4-21.el7或以上版本 sssd-krb5-common-1.16.4-21.el7或以上版本 sssd-ldap-1.16.4-21.el7或以上版本 sssd-libwbclient-1.16.4-21.el7或以上版本 sssd-libwbclient-devel-1.16.4-21.el7或以上版本 sssd-polkit-rules-1.16.4-21.el7或以上版本 sssd-proxy-1.16.4-21.el7或以上版本 sssd-tools-1.16.4-21.el7或以上版本 sssd-winbind-idmap-1.16.4-21.el7或以上版本 4.修復(fù)方法 方法一：配置源進(jìn)行升級(jí)安裝 1.打開(kāi)軟件包源配置文件，根據(jù)倉(cāng)庫(kù)地址進(jìn)行修改。 倉(cāng)庫(kù)源地址： 中標(biāo)麒麟高級(jí)服務(wù)器操作系統(tǒng) V7 aarch64:https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/ x86_64:https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/ 2.配置完成后執(zhí)行更新命令進(jìn)行升級(jí)，命令如下： yum update Packagename 方法二：下載安裝包進(jìn)行升級(jí)安裝 通過(guò)軟件包地址下載軟件包，使用軟件包升級(jí)命令根據(jù)受影響的軟件包 列表進(jìn)行升級(jí)安裝, 命令如下： yum install Packagename 3.升級(jí)完成后是否需要重啟服務(wù)或操作系統(tǒng)： CVE-2018-16838:無(wú)需重啟操作系統(tǒng)與服務(wù)即可使漏洞修復(fù)生效。 CVE-2019-3811:需要重啟 sssd 以使漏洞修復(fù)生效。 5.軟件包下載地址 ·中標(biāo)麒麟高級(jí)服務(wù)器操作系統(tǒng) V7 sssd(aarch64)軟件包下載地址: https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/libipa_hbac-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/libipa_hbac-devel-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/libsss_autofs-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/libsss_certmap-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/libsss_certmap-devel-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/libsss_idmap-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/libsss_idmap-devel-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/libsss_nss_idmap-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/libsss_nss_idmap-devel-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/libsss_simpleifp-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/libsss_simpleifp-devel-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/libsss_sudo-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/python-libipa_hbac-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/python-libsss_nss_idmap-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/python-sss-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/python-sss-murmur-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/python-sssdconfig-1.16.4-21.el7.noarch.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/sssd-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/sssd-ad-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/sssd-client-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/sssd-common-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/sssd-common-pac-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/sssd-dbus-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/sssd-ipa-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/sssd-kcm-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/sssd-krb5-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/sssd-krb5-common-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/sssd-ldap-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/sssd-libwbclient-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/sssd-libwbclient-devel-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/sssd-polkit-rules-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/sssd-proxy-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/sssd-tools-1.16.4-21.el7.aarch64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/aarch64/Packages/sssd-winbind-idmap-1.16.4-21.el7.aarch64.rpm sssd(x86_64)軟件包下載地址: https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/libipa_hbac-1.16.4-21.el7.i686.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/libipa_hbac-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/libipa_hbac-devel-1.16.4-21.el7.i686.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/libipa_hbac-devel-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/libsss_autofs-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/libsss_certmap-1.16.4-21.el7.i686.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/libsss_certmap-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/libsss_certmap-devel-1.16.4-21.el7.i686.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/libsss_certmap-devel-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/libsss_idmap-1.16.4-21.el7.i686.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/libsss_idmap-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/libsss_idmap-devel-1.16.4-21.el7.i686.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/libsss_idmap-devel-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/libsss_nss_idmap-1.16.4-21.el7.i686.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/libsss_nss_idmap-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/libsss_nss_idmap-devel-1.16.4-21.el7.i686.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/libsss_nss_idmap-devel-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/libsss_simpleifp-1.16.4-21.el7.i686.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/libsss_simpleifp-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/libsss_simpleifp-devel-1.16.4-21.el7.i686.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/libsss_simpleifp-devel-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/libsss_sudo-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/python-libipa_hbac-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/python-libsss_nss_idmap-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/python-sss-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/python-sss-murmur-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/python-sssdconfig-1.16.4-21.el7.noarch.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/sssd-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/sssd-ad-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/sssd-client-1.16.4-21.el7.i686.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/sssd-client-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/sssd-common-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/sssd-common-pac-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/sssd-dbus-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/sssd-ipa-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/sssd-kcm-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/sssd-krb5-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/sssd-krb5-common-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/sssd-ldap-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/sssd-libwbclient-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/sssd-libwbclient-devel-1.16.4-21.el7.i686.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/sssd-libwbclient-devel-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/sssd-polkit-rules-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/sssd-proxy-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/sssd-tools-1.16.4-21.el7.x86_64.rpm https://update.cs2c.com.cn/NS/V7/V7Update7/os/adv/lic/base/x86_64/Packages/sssd-winbind-idmap-1.16.4-21.el7.x86_64.rpm 注：其他相關(guān)依賴包請(qǐng)到相同目錄下載 6.修復(fù)驗(yàn)證 使用軟件包查詢命令，查看相關(guān)軟件包版本是否與修復(fù)版本一致，如果版本一致，則說(shuō)明修復(fù)成功。 sudo rpm -qa | grep Packagename