前言：

centos7環(huán)境下OpenSSL拒絕服務(wù)漏洞(CVE-2022-0778)
漏洞影響范圍：

• OpenSSL1.0.2
• OpenSSL1.1.1
• OpenSSL3.0
  OpenSSL拒絕服務(wù)漏洞(CVE-2022-0778)：該漏洞是由于OpenSSL中的BN_mod_sqrt()函數(shù)存在解析錯(cuò)誤，由于證書解析發(fā)生在證書簽名驗(yàn)證之前，因此任何解析外部提供的證書場(chǎng)景都可能受到拒絕服務(wù)攻擊，攻擊者可在未授權(quán)的情況下通過構(gòu)造特定證書來觸發(fā)無限循環(huán)，執(zhí)行拒絕服務(wù)攻擊，最終使服務(wù)器無法提供服務(wù)。

修復(fù)步驟：

openssl官網(wǎng)

https://www.openssl.org/source/

查看系統(tǒng)版本、內(nèi)核及openssl版本如下

[root@sdd ~]# cat /etc/redhat-release 
CentOS Linux release 7.8.2003 (Core)
You have new mail in /var/spool/mail/root
[root@sdd ~]# uname -a
Linux sdd 3.10.0-1127.el7.x86_64 #1 SMP Tue Mar 31 23:36:51 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
[root@sdd ~]# openssl version
OpenSSL 1.0.2k-fips  26 Jan 2017
[root@sdd ~]# 

按照官網(wǎng)提示我們的openssl版本為OpenSSL 1.0.2k-fips，需要下載升級(jí)到最新的3.0.8版本；

下載最新版本3.0.8

下載軟件上傳到要升級(jí)的服務(wù)器

上傳并解壓

[root@idss ~]# tar zvxf openssl-3.0.8.tar.gz
[root@idss ~]# cd openssl-3.0.5

查看安裝文檔INSTALL.md

編譯安裝

1.先建配置文件夾

[root@idss openssl-3.0.8]# mkdir -p /usr/local/openssl

2.配置安裝
./config --prefix=/usr/local/openssl
提示如下

[root@idss openssl-3.0.8]# ./config --prefix=/usr/local/openssl
/usr/bin/env: perl: No such file or directory

檢查perl

安裝perl-ExtUtils-CBuilder perl-ExtUtils-MakeMaker,先下載需要安裝的依賴包，然后使用rpm強(qiáng)制完成perl的安裝，此方式可以離線拷貝文件到內(nèi)網(wǎng)機(jī)器，進(jìn)行perl安裝

[root@idss ~]# mkdir -p myperl
[root@idss ~]# yum install --downloadonly --downloaddir=/root/myperl  perl-ExtUtils-CBuilder perl-ExtUtils-MakeMaker
[root@idss ~]# cd myperl
[root@idss myperl]# rpm -ivh *.rpm --force --nodeps

檢查perl安裝成功如下

[root@idss myperl]# perl -v

This is perl 5, version 16, subversion 3 (v5.16.3) built for x86_64-linux-thread-multi
(with 44 registered patches, see perl -V for more detail)

Copyright 1987-2012, Larry Wall

Perl may be copied only under the terms of either the Artistic License or the
GNU General Public License, which may be found in the Perl 5 source kit.

Complete documentation for Perl, including FAQ lists, should be found on
this system using "man perl" or "perldoc perl".  If you have access to the
Internet, point your browser at http://www.perl.org/, the Perl Home Page.

檢查gcc

[root@idss ~]# mkdir -p mygcc
[root@sdd ~]# yum install --downloadonly --downloaddir=/root/mygcc  gcc
[root@sdd ~]# cd /root/mygcc
[root@sdd mygcc]# rpm -ivh *.rpm --force --nodeps

檢查gcc安裝成功如下

[root@idss mygcc]# gcc -v
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/libexec/gcc/x86_64-redhat-linux/4.8.5/lto-wrapper
Target: x86_64-redhat-linux
Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --with-bugurl=http://bugzilla.redhat.com/bugzilla --enable-bootstrap --enable-shared --enable-threads=posix --enable-checking=release --with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions --enable-gnu-unique-object --enable-linker-build-id --with-linker-hash-style=gnu --enable-languages=c,c++,objc,obj-c++,java,fortran,ada,go,lto --enable-plugin --enable-initfini-array --disable-libgcj --with-isl=/builddir/build/BUILD/gcc-4.8.5-20150702/obj-x86_64-redhat-linux/isl-install --with-cloog=/builddir/build/BUILD/gcc-4.8.5-20150702/obj-x86_64-redhat-linux/cloog-install --enable-gnu-indirect-function --with-tune=generic --with-arch_32=x86-64 --build=x86_64-redhat-linux
Thread model: posix
gcc version 4.8.5 20150623 (Red Hat 4.8.5-44) (GCC) 

再次編譯安裝

[root@idss ~]# cd openssl-3.0.8
[root@idss openssl-3.0.8]# ./config --prefix=/usr/local/openssl/

顯示如下，提示successfully就預(yù)編譯成功了

[root@idss openssl-3.0.8]# ./config --prefix=/usr/local/openssl/
Configuring OpenSSL version 3.0.8 for target linux-x86_64
Using os-specific seed configuration
Created configdata.pm
Running configdata.pm
Created Makefile.in
Created Makefile
Created include/openssl/configuration.h

**********************************************************************
***                                                                ***
***   OpenSSL has been successfully configured                     ***
***                                                                ***
***   If you encounter a problem while building, please open an    ***
***   issue on GitHub <https://github.com/openssl/openssl/issues>  ***
***   and include the output from the following command:           ***
***                                                                ***
***       perl configdata.pm --dump                                ***
***                                                                ***
***   (If you are new to OpenSSL, you might want to consult the    ***
***   'Troubleshooting' section in the INSTALL.md file first)      ***
***                                                                ***
**********************************************************************

接下來進(jìn)行make編譯和安裝，時(shí)間會(huì)長(zhǎng)一些

make && make install

備份和配置軟鏈接

mv /usr/bin/openssl /usr/bin/openssl.old
mv /usr/include/openssl /usr/include/openssl.old
ln -s /usr/local/openssl/bin/openssl /usr/bin/openssl
ln -s /usr/local/openssl/include/openssl /usr/include/openssl
ln -s /usr/local/openssl/lib64/libssl.so.3 /usr/lib/libssl.so.3
ln -s /usr/local/openssl/lib64/libcrypto.so.3 /usr/lib/libcrypto.so.3
ldconfig
執(zhí)行過程如下

[root@idss openssl-3.0.8]# mv /usr/bin/openssl /usr/bin/openssl.old
[root@idss openssl-3.0.8]# mv /usr/include/openssl /usr/include/openssl.old
mv: cannot stat ‘/usr/include/openssl’: No such file or directory
[root@idss openssl-3.0.8]# ln -s /usr/local/openssl/bin/openssl /usr/bin/openssl
[root@idss openssl-3.0.8]# ln -s /usr/local/openssl/include/openssl /usr/include/openssl
[root@idss openssl-3.0.8]# ln -s /usr/local/openssl/lib64/libssl.so.3 /usr/lib/libssl.so.3
[root@idss openssl-3.0.8]# ln -s /usr/local/openssl/lib64/libcrypto.so.3 /usr/lib/libcrypto.so.3
[root@idss openssl-3.0.8]# ldconfig
[root@idss openssl-3.0.8]# 

檢查安裝后的openssl版本

[root@idss openssl-3.0.8]# openssl version
OpenSSL 3.0.8 7 Feb 2023 (Library: OpenSSL 3.0.8 7 Feb 2023)

附件
perl安裝包（我的主頁下載，審核中，后續(xù)附上安裝包連接）
gcc安裝包（我的主頁下載，審核中，后續(xù)附上安裝包連接）文章來源地址http://www.zghlxwxcb.cn/news/detail-518177.html

到了這里，關(guān)于Centos7修復(fù)OpenSSL 安全漏洞 (CVE-2022-0778)的文章就介紹完了。如果您還想了解更多內(nèi)容，請(qǐng)?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！