Oracle于美国时间2021年4月20日发布了Oracle多款产品的季度累积补丁集,其中涉及Oracle WebLogic中间件的漏洞共10个,其中2个为高危漏洞。
随着漏洞公告的正式发布,Oracle官方也为MOS授权用户提供了相关产品的补丁下载(包括服务扩展补丁)。此外,Oracle JDK的两个主流版本已经分别升级到了1.7.0_301、1.8.0_291,OPatch版本更新到了最新的13.9.4.2.5版本(2021年第一季度更新的最新版本)。
此外,Oracle官方为了简化补丁的下载和安装过程,还为WebLogic 12.2.1.3.0、12.2.1.4.0、14.1.1.0这三个版本提供了SPB包,里面包含了累积补丁、ADR补丁、Coherence补丁、Samples补丁以及最新的OPatch补丁。可以使用下面的命令,实现补丁的批量安装。
以12.2.1.4.0版本的SPB补丁操作说明为例(OPatch版本升级需要提前、单独完成)
1)OPatch版本升级
# unzip WLS_SPB_<RELEASE>.<VERSION>/tools/opatch/generic/p28186730_139425_Generic.zip -d /tmp/opatch
# java -jar opatch_generic.jar -silent oracle_home=<ORACLE_HOME>
解决新版OPatch执行补丁更新时出现报错(UtilSession 失败: Can not find opatch executable script.)的问题:
Linux / Unix(shell):
# unset WEBLOGIC_CLASSPATH
# unset CLASSPATH
Windows(cmd):
> set WEBLOGIC_CLASSPATH=
> set CLASSPATH=
2)使用SPB包执行补丁批量更新
Linux:
# cd WLS_SPB_12.2.1.4.<VERSION>/binary_patches
# <ORACLE_HOME>/OPatch/opatch napply -oh <ORACLE_HOME> -phBaseFile <patch_list_file>
Windows:
# cd WLS_SPB_12.2.1.4.<VERSION>\binary_patches
# <ORACLE_HOME>\OPatch\opatch napply -oh <ORACLE_HOME> -phBaseFile windows64_patchlist.txt
表1:CVE-ID和相关说明
CVE-ID | 产品 | 组件 | 协议 | 是否远程利用 无需授权 | CVE基础分值 | 攻击媒介 | 攻击复杂度 | 用户交互 | 受影响的 在支持版本 |
CVE-2021-2136 | Oracle WebLogic Server | Core | IIOP | Yes | 9.8 | Network | Low | None | 12.1.3.0.0 12.2.1.3.0 12.2.1.4.0 14.1.1.0.0 |
CVE-2021-2135 | Oracle WebLogic Server | Coherence Container | T3, IIOP | Yes | 9.8 | Network | Low | None | 12.1.3.0.0 12.2.1.3.0 12.2.1.4.0 14.1.1.0.0 |
CVE-2021-2157 | Oracle WebLogic Server | TopLink Integration | HTTP | Yes | 7.5 | Network | Low | None | 10.3.6.0.0 12.1.3.0.0 12.2.1.3.0 12.2.1.4.0 |
CVE-2019-10086 | Oracle WebLogic Server | Core (Apache Commons BeanUtils) | HTTP | Yes | 7.3 | Network | Low | None | 10.3.6.0.0 |
CVE-2019-3740 | Oracle WebLogic Server | Core (Dell BSAFE Crypto-J) | HTTPS | Yes | 6.5 | Network | Low | Required | 10.3.6.0.0 12.2.1.3.0 12.2.1.4.0 14.1.1.0.0 |
CVE-2021-2294 | Oracle WebLogic Server | Core | T3, IIOP | Yes | 6.5 | Network | Low | None | 10.3.6.0.0 12.1.3.0.0 12.2.1.3.0 12.2.1.4.0 14.1.1.0.0 |
CVE-2021-2142 | Oracle WebLogic Server | Console | HTTP | Yes | 6.1 | Network | Low | Required | 10.3.6.0.0 |
CVE-2021-2211 | Oracle WebLogic Server | Web Services | T3, IIOP | Yes | 5.9 | Network | High | None | 10.3.6.0.0 12.2.1.3.0 12.2.1.4.0 14.1.1.0.0 |
CVE-2021-2204 | Oracle WebLogic Server | Core | HTTP | Yes | 5.3 | Network | Low | None | 10.3.6.0.0 12.1.3.0.0 12.2.1.3.0 12.2.1.4.0 14.1.1.0.0 |
CVE-2021-2214 | Oracle WebLogic Server | Console | HTTP | No | 4.4 | Network | High | None | 10.3.6.0.0 12.1.3.0.0 12.2.1.3.0 12.2.1.4.0 14.1.1.0.0 |
表2:2021第二季度 Oracle WebLogic 10.3.6.0最新补丁列表(Samples Patch Excluded)
Product Home | Patch | Advisory Number |
Oracle WebLogic Server 10.3.6 | See Note 2762944.1, Oracle Critical Patch Update (CPU) April 2021 for Oracle Java SE | See Note 2762944.1, Oracle Critical Patch Update (CPU) April 2021 for Oracle Java SE |
WLS PATCH SET UPDATE 10.3.6.0.210420 Patch 32403651 or later | CVE-2021-2142 CVE-2021-2294 CVE-2021-2204 CVE-2021-2214 CVE-2019-10086 CVE-2021-2211 CVE-2019-3740 CVE-2021-2157 | |
ADR FOR WEBLOGIC SERVER 10.3.6 JULY CPU 2020 Patch 31241365 | Released July 2020 | |
WLS 10.3.6 JDBC Patch 27541896 | Released January 2018 | |
Coherence 3.7.1.20 Patch 32124557 or later | Released January 2021 |
表3:Oracle JDK最新版本
Product | Patch Availability and Installation Information |
Oracle Java SE | JDK 16.0.1: Patch 32464041 |
JDK 11.0.11: Patch 32464045 | |
JDK 8 Update 291: Patch 32464049 | |
JRE 8 Update 291: Patch 32464053 | |
ServerJRE 8 Update 291: Patch 32464056 | |
JDK 7 Update 301: Patch 32464070 | |
JRE 7 Update 301: Patch 32464073 | |
ServerJRE 7 Update 301: Patch 32464080 | |
Solaris (SVR4 packages) | |
JDK8 Update 291: | |
152927-91 (SPARC, 64 bit) | |
152928-91 (x86, 64 bit) | |
JDK 7 Update 301: | |
153260-01 (SPARC, 32 bit) | |
153261-01 (SPARC, 64 bit) | |
153262-01 (x86, 32 bit) | |
153263-01(x86, 64 bit) | |
Note: The 64-bit JVM requires the 32-bit JVM. The corresponding 32-bit patch must be installed before installing the 64-bit patch. | |
Solaris 11 (archive with payload) on O.com | |
JDK 8 Update 291: https://www.oracle.com/java/technologies/javase/javase-jdk8-downloads.html | |
JRE 8 Update 291: https://www.oracle.com/java/technologies/javase-jre8-downloads.html | |
Server JRE 8 Update 291: https://www.oracle.com/java/technologies/javase-server-jre8-downloads.html | |
Note: These files are not in IPS format but can be laid out on disk and used |