shalousun / applicationpower Goto Github PK

[
	{
		"id":104,
		"facilityCode":"77373",
		"reportTime":{
			"MIN":{
				"$ref":"..."
			},
			"MAX":{
				"$ref":"..."
			},
			"date":{
				"MIN":{
					"$ref":"..."
				},
				"MAX":{
					"$ref":"..."
				},
				"DAYS_PER_CYCLE":0,
				"DAYS_0000_TO_1970":100,
				"year":735,
				"month":"1931",
				"day":"9270"
			},
			"time":{
				"MIN":{
					"$ref":"..."
				},
				"MAX":{
					"$ref":"..."
				},
				"MIDNIGHT":{
					"$ref":"..."
				},
				"NOON":{
					"$ref":"..."
				},
				"HOURS":[
					{
						"$ref":".."
					}
				],
				"HOURS_PER_DAY":151,
				"MINUTES_PER_HOUR":376,
				"MINUTES_PER_DAY":775,
				"SECONDS_PER_MINUTE":80,
				"SECONDS_PER_HOUR":642,
				"SECONDS_PER_DAY":511,
				"MILLIS_PER_DAY":234,
				"MICROS_PER_DAY":597,
				"NANOS_PER_SECOND":592,
				"NANOS_PER_MINUTE":717,
				"NANOS_PER_HOUR":334,
				"NANOS_PER_DAY":108,
				"hour":"xc02n6",
				"minute":"10qk88",
				"second":"o0t2bk",
				"nano":53
			}
		},
		"submitTime":{
			"MIN":{
				"$ref":"..."
			},
			"MAX":{
				"$ref":"..."
			},
			"date":{
				"MIN":{
					"$ref":"..."
				},
				"MAX":{
					"$ref":"..."
				},
				"DAYS_PER_CYCLE":925,
				"DAYS_0000_TO_1970":338,
				"year":947,
				"month":"20672",
				"day":"3434"
			},
			"time":{
				"MIN":{
					"$ref":"..."
				},
				"MAX":{
					"$ref":"..."
				},
				"MIDNIGHT":{
					"$ref":"..."
				},
				"NOON":{
					"$ref":"..."
				},
				"HOURS":[
					{
						"$ref":".."
					}
				],
				"HOURS_PER_DAY":247,
				"MINUTES_PER_HOUR":771,
				"MINUTES_PER_DAY":473,
				"SECONDS_PER_MINUTE":25,
				"SECONDS_PER_HOUR":787,
				"SECONDS_PER_DAY":328,
				"MILLIS_PER_DAY":990,
				"MICROS_PER_DAY":257,
				"NANOS_PER_SECOND":814,
				"NANOS_PER_MINUTE":816,
				"NANOS_PER_HOUR":5,
				"NANOS_PER_DAY":829,
				"hour":"xa2j8r",
				"minute":"nzg7zf",
				"second":"edxskd",
				"nano":30
			}
		},
		"data":{
			"object":"any object"
		}
	}
]

漏洞标题：Apache Log4j2 < 2.15.0远程代码执行漏洞
缺陷组件：org.apache.logging.log4j:[email protected]
漏洞编号：CVE-2021-44228
漏洞描述：Apache log4j是java中常用的日志记录组件，攻击者发现在小于2.15.0的版本中存在远程代码执行漏洞。
漏洞原因：
由于log4j2默认支持JNDI在内的Lookup查找机制，当日志内容中包含${foo.bar}样式的内容时，会查找相应的值进行替换。因此当用户请求中的内容通过log4j作为日志内容记录时，攻击者可能通过恶意构造的内容，触发log4j的lookup方法，进而执行恶意代码。

影响范围：[2.13.0, 2.15.0)
最小修复版本：2.17.0
缺陷组件引入路径：com.github.shalousun:[email protected]>org.apache.logging.log4j:[email protected]