¿ËÈÕ£¬£¬£¬£¬£¬£¬£¬18ÐÂÀûÐÅÏ¢Çå¾²ÍþвÇ鱨ÖÐÐļà²âµ½Apache Struts¹Ù·½Ðû²¼Ç徲ͨ¸æ£¬£¬£¬£¬£¬£¬£¬Åû¶ÁËApache Struts¿ò¼ÜÎó²îS2-062 (CVE-2021-31805)£¬£¬£¬£¬£¬£¬£¬¹¥»÷Õ߿ɽṹ¶ñÒâµÄOGNL±í´ïʽ´¥·¢Îó²î£¬£¬£¬£¬£¬£¬£¬´Ó¶øÊµÏÖÔ¶³Ì´úÂëÖ´ÐС£¡£¡£¡£¡£¡£¡£ÏÖÔÚStruts¹Ù·½ÒÑÐû²¼Çå¾²°æ±¾£¬£¬£¬£¬£¬£¬£¬18ÐÂÀûÐÅÏ¢Çå¾²Ó¦¼±ÖÐÐĽ¨ÒéÊÜÓ°Ï쵥λºÍÓû§Á¬Ã¦Éý¼¶ÖÁÇå¾²°æ±¾¡£¡£¡£¡£¡£¡£¡£
¸ÃÎó²îÓÉÓÚ¶Ôs2-061£¨CVE-2020-17530£©µÄÐÞ¸´²»ÍêÕû£¬£¬£¬£¬£¬£¬£¬µ¼ÖÂÊäÈëÑéÖ¤²»×¼È·¡£¡£¡£¡£¡£¡£¡£µ±¿ª·¢Ö°Ô±Ê¹ÓÃÁË %{¡} Óï·¨¾ÙÐÐÇ¿ÖÆOGNLÆÊÎöʱ£¬£¬£¬£¬£¬£¬£¬ÈÔÓÐÒ»Ð©ÌØÊâµÄTAGÊôÐԿɱ»¶þ´ÎÆÊÎö£¬£¬£¬£¬£¬£¬£¬µ¼Ö¹¥»÷Õ߿ɽṹ¶ñÒâµÄOGNL±í´ïʽ´¥·¢Îó²î£¬£¬£¬£¬£¬£¬£¬´Ó¶øÊµÏÖÔ¶³Ì´úÂëÖ´ÐС£¡£¡£¡£¡£¡£¡£
Ó°Ïì¹æÄ££º2.0.0 <= Apache Struts°æ±¾ <= 2.5.29
ʹÓÃÌõ¼þ£ºÎó²îÐèÒª¿ª·¢Ã÷ʵ´úÂëд·¨Ö§³Ö£¬£¬£¬£¬£¬£¬£¬ÏÖÔÚÅжϱ»Ê¹ÓõÄÏÖʵΣº¦½ÏµÍ
ÏÖÔÚStruts¹Ù·½ÒÑÐû²¼Çå¾²²¹¶¡£¬£¬£¬£¬£¬£¬£¬18ÐÂÀûÐÅÏ¢ÌáÐѸ÷Ïà¹Øµ¥Î»ºÍÓû§ÒªÇ¿»¯Î£º¦Òâʶ£¬£¬£¬£¬£¬£¬£¬ÇÐʵÔöÇ¿Çå¾²Ìá·À£º
ÏÖÔÚStruts¹Ù·½ÒÑÐû²¼Çå¾²°æ±¾£º2.5.30¡£¡£¡£¡£¡£¡£¡£½¨ÒéÓû§¾¡¿ì×Բ飬£¬£¬£¬£¬£¬£¬¶ÔÊÜÓ°ÏìµÄ°æ±¾ÊµÊ±Éý¼¶ÖÁ×îа汾£ºhttps://cwiki.apache.org/confluence/display/WW/Version+Notes+2.5.30
1¡¢ÈôÏîÄ¿ÊǽÓÄÉ maven ±àÒ룬£¬£¬£¬£¬£¬£¬¿ÉÉó²épom.xmlÎļþÈ·¶¨struts2ʹÓõİ汾ºÅÊÇ·ñÔÚÓ°Ïì¹æÄ£ÄÚ£¬£¬£¬£¬£¬£¬£¬ÈçÏÂ2.5.10°æ±¾ÔÚÊÜÓ°Ïì°æ±¾¹æÄ£ÄÚ£º

2¡¢ÔÚÓ¦ÓÃĿ¼ÏÂËÑË÷ÊÇ·ñʹÓÃstruts2-core£¬£¬£¬£¬£¬£¬£¬ÌØÊâÔÚÓ¦ÓõÄWEB-INF\libĿ¼ÏÂËÑË÷£¬£¬£¬£¬£¬£¬£¬ÈôÊDZ£´æstruts2-core-{version}.jar£¬£¬£¬£¬£¬£¬£¬ÇÒÉó²éËùʹÓð汾ºÅÊÇ·ñÔÚÊÜÓ°Ïì¹æÄ£ÄÚ£¬£¬£¬£¬£¬£¬£¬ÈçÏÂ2.5.10°æ±¾ÔÚÊÜÓ°ÏìµÄ°æ±¾¹æÄ£ÄÚ£º

¸½²Î¿¼Á´½Ó£ºhttps://cwiki.apache.org/confluence/display/WW/S2-062