Error系列-CVE CIS-2024系统漏洞处理方案集合_[not_implemented] - npm v1 security audits quick

最新推荐文章于 2024-09-05 12:36:15 发布

2401_84166147

最新推荐文章于 2024-09-05 12:36:15 发布

阅读量1.1k

点赞数 15

分类专栏： 2024年程序员学习文章标签： npm 前端 node.js

本文链接：https://blog.csdn.net/2401_84166147/article/details/137563287

版权

2024年程序员学习专栏收录该内容

86 篇文章 0 订阅

订阅专栏

CMD [“nginx”, “-g”, “daemon off;”]

报错如下：

/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration

/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/

/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh

10-listen-on-ipv6-by-default.sh: info: Getting the checksum of /etc/nginx/conf.d/default.conf

10-listen-on-ipv6-by-default.sh: info: /etc/nginx/conf.d/default.conf differs from the packaged version

/docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh

/docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh

/docker-entrypoint.sh: Configuration complete; ready for start up

2023/06/03 15:48:07 [warn] 1#1: the “user” directive makes sense only if the master process runs with super-user privileges, ignored in /etc/nginx/nginx.conf:2

nginx: [warn] the “user” directive makes sense only if the master process runs with super-user privileges, ignored in /etc/nginx/nginx.conf:2

2023/06/03 15:48:07 [notice] 1#1: using the “epoll” event method

2023/06/03 15:48:07 [notice] 1#1: nginx/1.24.0

2023/06/03 15:48:07 [notice] 1#1: built by gcc 12.2.1 20220924 (Alpine 12.2.1_git20220924-r4)

2023/06/03 15:48:07 [notice] 1#1: OS: Linux 5.10.104-linuxkit

2023/06/03 15:48:07 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1048576:1048576

2023/06/03 15:48:07 [emerg] 1#1: open() “/var/run/nginx.pid” failed (13: Permission denied)

nginx: [emerg] open() “/var/run/nginx.pid” failed (13: Permission denied)

Search…
Stick to bottom

最终解决方案1：

因为这个项目里有nginx,所以使用了nginx的自带用户，用户组来进行配置了权限，解决此问题
例如下面代码：

…此处省略一些基础代码

此处使用的是nginx自带的非root账号执行授权

RUN touch /var/run/nginx.pid \

&& chown -R nginx:nginx /app \

&& chmod -R 755 /app \

&& chown -R nginx:nginx /var/cache/nginx
&& chown -R nginx:nginx /var/log/nginx
&& chown -R nginx:nginx /etc/nginx/conf.d
&& chown -R nginx:nginx /var/run/nginx.pid
&& chown -R nginx:nginx /usr/share/nginx/html
&& chown -R nginx:nginx /etc/nginx/nginx.conf

这部分代码是delete一些用不到的nginx包

RUN apk del nginx-module-image-filter
&& apk del nginx-module-xslt
&& apk del nginx-module-geoip
&& apk del nginx-module-njs
&& apk del curl

USER nginx

请注意，这里一般不要写80，非root用户容易没有权限绑定80端口

EXPOSE 8080
CMD [“nginx”, “-g”, “daemon off;”]

最终解决方案2：

dockerfile加入下面代码

RUN adduser -D xiaojin
USER xiaojin

在这里插入图片描述

k8s yaml 加入下面代码

securityContext:
runAsUser: 0

在这里插入图片描述

问题3：bind() to 0.0.0.0:80 failed (13: Permission denied)

XXXXXXXX pm2023/06/05 08:04:39 [warn] 1#1: the “user” directive makes sense only if the master process runs with super-user privileges, ignored in /etc/nginx/nginx.conf:2
XXXXXXXX pmnginx: [warn] the “user” directive makes sense only if the master process runs with super-user privileges, ignored in /etc/nginx/nginx.conf:2
Mon, Jun 5 2023 4:04:41 pm2023/06/05 08:04:39 [emerg] 1#1: bind() to 0.0.0.0:80 failed (13: Permission denied)
Mon, Jun 5 2023 4:04:41 pmnginx: [emerg] bind() to 0.0.0.0:80 failed (13: Permission denied)

问题分析：

某些情况下，非Root用户不能绑定1024以下端口，否则会报错：没有权限绑定该端口

问题解决：

修改Dockerfile中的端口配置
nginx.conf中的端口监听
k8s.yml中的服务端口暴露配置
containerPort配置
所有你项目中nginx绑定的都要修改一遍哦~~
代码举例：

问题4：Twistlock扫描Type：javascript

解决方案

打开代码，如果我们在npm 源下，执行 npm audit，会展示该漏洞的信息

npm audit 返回的漏洞数据来源于 Github Advisory Database
关于 npm audit 详细解释，可以打开我的这篇文档

npm audit
或
yarn audit

查看漏洞检查结果

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high │ Leaking sensitive user information still possible by │
│ │ filtering on private with prefix fields │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ @strapi/utils │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=4.10.8 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @strapi/strapi │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ @strapi/strapi > @strapi/admin > @strapi/utils │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://www.npmjs.com/advisories/1092676 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high │ Leaking sensitive user information still possible by │
│ │ filtering on private with prefix fields │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ @strapi/utils │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=4.10.8 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @strapi/strapi │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ @strapi/strapi > @strapi/plugin-content-type-builder > │
│ │ @strapi/generators > @strapi/utils │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://www.npmjs.com/advisories/1092676 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ moderate │ Server-Side Request Forgery in Request │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ request │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ No patch available │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @strapi/plugin-users-permissions │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ @strapi/plugin-users-permissions > request │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://www.npmjs.com/advisories/1092972 │
└───────────────┴──────────────────────────────────────────────────────────────┘
78 vulnerabilities found - Packages audited: 1848
Severity: 2 Low | 47 Moderate | 20 High | 9 Critical
✨ Done in 6.86s.