网站后台找不到了怎么办,网站设计论文前言,微信优惠群怎么做网站,公司网站工商备案怎么做#xff08;一#xff09;简述#xff1a; 早上收到nginx最新漏洞的通知#xff0c;Nginx官方发布最新的安全公告#xff0c;在Nginx范围过滤器中发现了一个安全问题#xff08;CVE-2017-7529#xff09;#xff0c;通过精心构造的恶意请求可能会导致整数溢出并且不… 一简述 早上收到nginx最新漏洞的通知Nginx官方发布最新的安全公告在Nginx范围过滤器中发现了一个安全问题CVE-2017-7529通过精心构造的恶意请求可能会导致整数溢出并且不正确处理范围从而导致敏感信息泄漏。 当使用Nginx标准模块时如果文件头从缓存返回响应允许攻击者获取缓存文件头。在某些配置中缓存文件头可能包含后端服务器IP地址或其他敏感信息。此外如果使用第三方模块有潜在的可能导致拒绝服务。 影响版本 Nginx 0.5.6-1.13.2 漏洞等级 中危 Nginx 在官方公告中称发现了一个范围过滤器中的安全问题。通过精心构造的恶意请 求能造成整数溢出对范围的不当处理会导致敏感信息泄漏。 No. 漏洞名称 漏洞危害 CVE-2017-7529 Nginx range 过滤器整形溢出漏洞 高危 针对 CVE–2017–7529 修复建议 针对 Nginx range 过滤器整形溢出漏洞的修复建议 1) 下面的配置可以作为暂时的解决办法 max_ranges 1; 2) 建议受影响用户尽快升级至 1.13.3, 1.12.1 3) 及时安装官方补丁。 虽然临时可以解决不过还是建议升级到最新的版本官方建议升级到1.12.1。 二具体的升级步骤 1升级和安装nginx第三方模块一样需要查看原来安装nginx的版本以及编译的参数 [rootittestserver1 opt]# /usr/local/nginx2/sbin/nginx -V
nginx version: nginx/1.10.3
built by gcc 4.4.7 20120313 (Red Hat 4.4.7-16) (GCC)
built with OpenSSL 1.1.0e 16 Feb 2017
TLS SNI support enabled
configure arguments: --prefix/usr/local/nginx2 --with-http_stub_status_module --with-http_ssl_module --with-http_realip_module --with-http_gzip_static_module --with-http_stub_status_module --with-http_stub_status_module --with-http_v2_module --with-openssl/tmp/install/openssl-1.1.0e --with-http_v2_module 2下载要升级的nginx版本 [rootittestserver1 soft]# wget http://nginx.org/download/nginx-1.12.1.tar.gz
--2017-07-17 15:41:24-- http://nginx.org/download/nginx-1.12.1.tar.gz
正在解析主机 nginx.org... 206.251.255.63, 95.211.80.227, 2001:1af8:4060:a004:21::e3, ...
正在连接 nginx.org|206.251.255.63|:80... 已连接。
已发出 HTTP 请求正在等待回应... 200 OK
长度981093 (958K) [application/octet-stream]
正在保存至: “nginx-1.12.1.tar.gz”
90% [ ] 892,302 265K/s eta(英国中部时100%[] 981,093 291K/s in 3.3s
2017-07-17 15:41:28 (291 KB/s) - 已保存 “nginx-1.12.1.tar.gz” [981093/981093]) 3解压ningx下载的压缩包编译make,切记不要make install。 [rootittestserver1 soft]# tar xf nginx-1.12.1.tar.gz
[rootittestserver1 soft]# cd nginx-1.12.1
[rootittestserver1 nginx-1.12.1]# ls
auto CHANGES CHANGES.ru conf configure contrib html LICENSE man README src
[rootittestserver1 nginx-1.12.1]# ./configure --prefix/usr/local/nginx2 \
--with-http_stub_status_module \
--with-http_ssl_module \
--with-http_realip_module \
--with-http_gzip_static_module \
--with-http_stub_status_module \
--with-http_stub_status_module \
--with-http_v2_module \
--with-openssl/tmp/install/openssl-1.1.0e \
--with-http_v2_module
checking for OS Linux 2.6.32-358.el6.x86_64 x86_64
checking for C compiler ... found using GNU C compiler gcc version: 4.4.7 20120313 (Red Hat 4.4.7-17) (GCC)
checking for gcc -pipe switch ... found
checking for -Wl,-E switch ... found
checking for gcc builtin atomic operations ... found
checking for C99 variadic macros ... found
checking for gcc variadic macros ... found
checking for gcc builtin 64 bit byteswap ... found
checking for unistd.h ... found
checking for inttypes.h ... found
checking for limits.h ... found
checking for sys/filio.h ... not found
checking for sys/param.h ... found
checking for openat(), fstatat() ... found
checking for getaddrinfo() ... found
checking for PCRE library ... found
checking for PCRE JIT support ... found
checking for zlib library ... found
creating objs/Makefile
Configuration summary using system PCRE library using OpenSSL library: /tmp/install/openssl-1.1.0e using system zlib librarynginx path prefix: /usr/local/nginx2nginx binary file: /usr/local/nginx2/sbin/nginxnginx modules path: /usr/local/nginx2/modulesnginx configuration prefix: /usr/local/nginx2/confnginx configuration file: /usr/local/nginx2/conf/nginx.confnginx pid file: /usr/local/nginx2/logs/nginx.pidnginx error log file: /usr/local/nginx2/logs/error.lognginx http access log file: /usr/local/nginx2/logs/access.lognginx http client request body temporary files: client_body_tempnginx http proxy temporary files: proxy_tempnginx http fastcgi temporary files: fastcgi_tempnginx http uwsgi temporary files: uwsgi_tempnginx http scgi temporary files: scgi_temp
[rootittestserver1 nginx-1.12.1]# make 由于make的时间比较长需要稍等下。 4make编译完后会在安装目录下生成一个objs目录且在该目录下有一个nginx执行文件。 [rootittestserver1 nginx-1.12.1]# ls
auto CHANGES.ru configure html Makefile objs src
CHANGES conf contrib LICENSE man README
[rootittestserver1 nginx-1.12.1]# ll objs/
总用量 7124
-rw-r--r-- 1 root root 17459 7月 17 15:48 autoconf.err
-rw-r--r-- 1 root root 43530 7月 17 15:48 Makefile
-rwxr-xr-x 1 root root 7152312 7月 17 15:51 nginx
-rw-r--r-- 1 root root 5345 7月 17 15:51 nginx.8
-rw-r--r-- 1 root root 7066 7月 17 15:48 ngx_auto_config.h
-rw-r--r-- 1 root root 657 7月 17 15:48 ngx_auto_headers.h
-rw-r--r-- 1 root root 6242 7月 17 15:48 ngx_modules.c
-rw-r--r-- 1 root root 38232 7月 17 15:51 ngx_modules.o
drwxr-xr-x 9 root root 4096 7月 17 15:48 src 5备份原来老的nginx文件 [rootittestserver1 nginx-1.12.1]# mv /usr/local/nginx2/sbin/nginx /usr/local/nginx2/sbin/nginx.bak
[rootittestserver1 nginx-1.12.1]# cp objs/nginx
nginx nginx.8
[rootittestserver1 nginx-1.12.1]# cp objs/nginx /usr/local/nginx2/sbin/[rootittestserver1 nginx-1.12.1]# /usr/local/nginx2/sbin/nginx -t
nginx: the configuration file /usr/local/nginx2/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx2/conf/nginx.conf test is successful 6使用make upgrade替换老的nginx进程 [rootittestserver1 nginx-1.12.1]# make upgrade /usr/local/nginx2/sbin/nginx -t nginx: the configuration file /usr/local/nginx2/conf/nginx.conf syntax is ok nginx: configuration file /usr/local/nginx2/conf/nginx.conf test is successful kill -USR2 cat /usr/local/nginx2/logs/nginx.pid sleep 1 test -f /usr/local/nginx2/logs/nginx.pid.oldbin kill -QUIT cat /usr/local/nginx2/logs/nginx.pid.oldbin 7执行/usr/local/nginx2/sbin/nginx -V查看nginx最新的版本及编译的参数 [rootittestserver1 nginx-1.12.1]# /usr/local/nginx2/sbin/nginx -V
nginx version: nginx/1.12.1
built by gcc 4.4.7 20120313 (Red Hat 4.4.7-17) (GCC)
built with OpenSSL 1.1.0e 16 Feb 2017
TLS SNI support enabled
configure arguments: --prefix/usr/local/nginx2 --with-http_stub_status_module --with-http_ssl_module --with-http_realip_module --with-http_gzip_static_module --with-http_stub_status_module --with-http_stub_status_module --with-http_v2_module --with-openssl/tmp/install/openssl-1.1.0e --with-http_v2_module 至此升级完成。 本文转自 lqbyz 51CTO博客原文链接:http://blog.51cto.com/liqingbiao/1948430
