my-vault/01_Projects/Work/Enterprise/GAC/Vulnerability-Fix.md

堡垒机 账号： luoxin Luox@!fh202406

https://10.8.82.16/

lizx 7Ghjb@DF1,OgdN

远程桌面： 远程机Todesk： 847422402 gzZn@2023

广汽云的，南基区 【广汽云中心】您的vpn账户已开通， 账号： caojinhua@ds.cn 初始密码为：uStfuNFai6!

Mysql 更新 8.0.35->8.4.1

公司环境： 10.100.100.95 root gzzn@123

公司测试升级： local docker install mysql 8.0.35 use data upgrade docker 8.4.1

生产环境：85、86

应用：88 veigue: docker stack rm gqxm就好了吧

启动在 /opt/apps/gqxm/deploy.sh

The error code MY-002061 in MySQL 8.4.1 typically relates to an issue with the replication setup, particularly with the authentication plugin being used. Here are the steps you can take to resolve this issue:

1. Change the Authentication Plugin: Since MySQL 8.4 does not enable the mysql_native_password plugin by default, and it is completely removed in MySQL 9.0, you need to update your replication user to use the caching_sha2_password plugin.

   ALTER USER 'replication_user'@'%' IDENTIFIED WITH 'caching_sha2_password' BY 'your_password';
   

   This ensures that the user is using an authentication method compatible with MySQL 8.4 and later versions【7†source】【8†source】.

2. Update the Replication Configuration: You may also need to modify the replication configuration to use the new authentication method. Add GET_MASTER_PUBLIC_KEY=1 to your CHANGE MASTER TO statement:

   CHANGE MASTER TO MASTER_HOST='source_host',
   MASTER_USER='replication_user',
   MASTER_PASSWORD='your_password',
   MASTER_AUTO_POSITION=1,
   GET_MASTER_PUBLIC_KEY=1;
   

   This command configures the replica to request the master's public key, which is necessary for secure connections【6†source】【9†source】.

3. Verify User Plugins: Ensure that there are no users still relying on the deprecated mysql_native_password plugin by running the following query:

   SELECT user, host, plugin FROM mysql.user WHERE plugin='mysql_native_password';
   

   Update any users found by this query to use the caching_sha2_password plugin as shown in the first step【7†source】.

4. Check Master and Slave Configuration: Ensure that both the master and slave servers are configured correctly, especially regarding the paths and permissions of key files. Verify the configuration with:

   SHOW GLOBAL VARIABLES LIKE 'caching_sha2_password_public_key_path';
   

   Copy the public key file from the master to the slave if necessary, and adjust the CHANGE MASTER TO statement accordingly to specify the path to the public key on the slave【6†source】.

By following these steps, you should be able to resolve the MY-002061 error and get your MySQL replication working properly. If issues persist, consider checking the MySQL error log for more detailed messages that might provide additional insights into the problem.

CREATE USER "repluser"@"%" IDENTIFIED BY "P@ssw0rd";

CHANGE MASTER TO MASTER_HOST='10.8.62.85', MASTER_USER='repluser', MASTER_PASSWORD='P@ssw0rd', MASTER_AUTO_POSITION=1, GET_MASTER_PUBLIC_KEY=1;

ALTER USER 'repluser'@'%' IDENTIFIED WITH 'caching_sha2_password' BY 'P@ssw0rd';

FLUSH PRIVILEGES;

SELECT user, host, plugin FROM mysql.user WHERE user = 'repluser' AND host = '%';

SELECT user, host, plugin FROM mysql.user WHERE plugin NOT IN ('caching_sha2_password', 'mysql_native_password', 'sha256_password');

CHANGE MASTER TO MASTER_HOST = '10.8.62.85', MASTER_USER = 'repluser', MASTER_PASSWORD = 'P@ssw0rd', MASTER_AUTO_POSITION = 1, GET_MASTER_PUBLIC_KEY = 1;

change master to master_host='10.8.62.85', master_port=3386, master_user='repl', master_password='P@ssw0rd', MASTER_AUTO_POSITION = 1, GET_MASTER_PUBLIC_KEY = 1;

CHANGE REPLICATION SOURCE TO SOURCE_HOST = '10.8.62.85', SOURCE_USER = 'repluser', SOURCE_PASSWORD = 'Pssw0rd' , SOURCE_PORT = 3886, GET_SOURCE_PUBLIC_KEY = 1, SOURCE_AUTO_POSITION =1;

CHANGE REPLICATION SOURCE TO SOURCE_HOST = '10.8.62.85', SOURCE_USER = 'repluser', SOURCE_PASSWORD = 'P@ssw0rd' , SOURCE_PORT = 3886, GET_SOURCE_PUBLIC_KEY = 1;

nacos 更新

复测：

漏洞检测： Linux kernel 权限提升漏洞(CVE-2024-1086) 云服务商提供操作系统更新支持

runc: CVE-2024-21626 升级docker ? 升级runc ?

fastjson: 由于autotype开关的限制可被绕过，通过开启safeMode配置完全禁用autoType。三种配置SafeMode的方式如下:

  1）加上JVM启动参数： -Dfastjson.parser.safeMode=true

  2）通过类路径的fastjson.properties文件来配置： fastjson.parser.safeMode=true

  3）在代码中配置： ParserConfig.getGlobalInstance().setSafeMode(true); 需要核实