自主升级nginx-ingress-controller的内置nginx组件

我就是我 2024-03-01 08:46 2阅读 0赞

### 前言 ###

我们由于等保要求或者漏洞扫描，常常会遇到一些漏洞问题。这些漏洞可能不是你直接部署的服务的漏洞。可能是你部署的某个服务的内部组件的漏洞。这时你可能需要单独升级某个服务组件内部的组件。比如升级nginx-ingress-controller的ngix版本这样的需求。

### 漏洞描述 ###

*  各个版本情况：rancher:2.4.10、Kubernetes:1.18.0、rancher/nginx-ingress-controller:nginx-0.35.0-rancher2
 *  漏洞描述：nginx 安全漏洞(CVE-2021-23017) 
 *  <table> 
     <tbody> 
      <tr> 
       <td>漏洞名称：</td> 
       <td>nginx 安全漏洞(CVE-2021-23017)</td> 
      </tr> 
      <tr> 
       <td>详细描述：</td> 
       <td>Nginx是美国Nginx公司的一款轻量级Web服务器/反向代理服务器及电子邮件（IMAP/POP3）代理服务器。nginx存在安全漏洞，该漏洞源于一个离一错误在该漏洞允许远程攻击者可利用该漏洞在目标系统上执行任意代码。受影响版本：0.6.18-1.20.0</td> 
      </tr> 
      <tr> 
       <td>解决办法：</td> 
       <td>厂商补丁:目前厂商已发布升级补丁以修复漏洞，补丁获取链接：<a href="https://link.zhihu.com/?target=https%3A//www.nginx.com/blog/updating-nginx-dns-resolver-vulnerability-cve-2021-23017/" title="https://www.nginx.com/blog/updating-nginx-dns-resolver-vulnerability-cve-2021-23017/" rel="nofollow">https://www.nginx.com/blog/updating-nginx-dns-resolver-vulnerability-cve-2021-23017/</a>（不建议打补丁，可以采用升级的方法处理改漏洞，卸载安装，或者直接安装启用，都可以，nginx安装方法参考我前面的方法。）</td> 
      </tr> 
      <tr> 
       <td>威胁分值：</td> 
       <td>9.4</td> 
      </tr> 
      <tr> 
       <td>危险插件：</td> 
       <td>否</td> 
      </tr> 
      <tr> 
       <td>发现日期：</td> 
       <td>2021-05-25</td> 
      </tr> 
      <tr> 
       <td>CVE编号：</td> 
       <td>CVE-2021-23017</td> 
      </tr> 
      <tr> 
       <td>CNNVD编号：</td> 
       <td>CNNVD-202105-1581</td> 
      </tr> 
      <tr> 
       <td>CNCVE编号：</td> 
       <td>CNCVE-202123017</td> 
      </tr> 
      <tr> 
       <td>CVSS评分：</td> 
       <td>6.8</td> 
      </tr> 
     </tbody> 
    </table>
    
    ### 处理过程 ###
 *  查看当前nginx-ingress-controller镜像系统情况、版本以及所用的nginx版本情况。进入容器内部 nginx -V 、 cat /etc/issue查看。**一定要明确当前使用的nginx-ingress-controller镜像是基于alpine还是debian的！！！**
 *  ![90ff5871aeae452d8bdfb467e9404513.png][]![8080cba2aa8d4325a95e87058bdc3d36.png][]
 *  查找nginx 对应系统的安装包情况

可以使用apk search --allow-untrusted nginx 进行查找最新版本。当然你可能需要指定镜像源后再查询：echo http://mirrors.aliyun.com/alpine/v3.18/main/ > /etc/apk/repositories。

直接也可以直接在nginx和阿里的镜像源这里来查找：

[Index of /packages/alpine/ 、][Index of _packages_alpine_][http://mirrors.aliyun.com/alpine/][http_mirrors.aliyun.com_alpine]

以阿里云为例：

![44918b6bb52c41319153f2ab486cec43.png][]

![bdb7c1463a7f4286b1b67fe736dd00ba.png][]

*  更新nginx版本，制作新镜像

由于线上无法联网，且尽量避免直接在线上操作。我们将rancher/nginx-ingress-controller:nginx-0.35.0-rancher2镜像下载到本地，然后确保本地机器可以连接网络后新开一个cmd窗口进行操作：

PS C:\Users\Administrator\Desktop> docker run -it -u root rancher/nginx-ingress-controller:nginx-0.35.0-rancher2 /bin/bash
    bash-5.0# nginx -v
    nginx version: nginx/1.19.2
    bash-5.0# cat /etc/issue
    Welcome to Alpine Linux 3.11
    Kernel \r on an \m (\l)
    
    bash-5.0# echo http://mirrors.aliyun.com/alpine/v3.18/main/ > /etc/apk/repositories
    bash-5.0# apk add --upgrade --allow-untrusted nginx
    fetch http://mirrors.aliyun.com/alpine/v3.18/main/x86_64/APKINDEX.tar.gz
    (1/8) Upgrading musl (1.1.24-r2 -> 1.2.4-r2)
    (2/8) Purging ca-certificates-cacert (20191127-r2)
    (3/8) Installing ca-certificates-bundle (20230506-r0)
    (4/8) Upgrading zlib (1.2.11-r3 -> 1.2.13-r1)
    (5/8) Installing libcrypto3 (3.1.3-r0)
    (6/8) Upgrading pcre (8.43-r0 -> 8.45-r3)
    (7/8) Installing libssl3 (3.1.3-r0)
    (8/8) Installing nginx (1.24.0-r6)
    Executing nginx-1.24.0-r6.pre-install
    Executing nginx-1.24.0-r6.post-install
    Executing busybox-1.31.1-r9.trigger
    Executing ca-certificates-20191127-r2.trigger
    OK: 30 MiB in 42 packages
    bash-5.0# nginx -v
    nginx version: nginx/1.19.2                    ###这个地方还是现实1.19.2 但是应该是缓存问题,我们看到更新1.24.0已经成功了，所以尝试将容器保存为新的镜像试试
    bash-5.0#

由于我们开的是交互式窗口，所以不要退出，退出后容器就进不来了，所以再开一个cmd进行容器保存和测试：

#########新开一个cmd  将容器保存为镜像################
    PS C:\Users\Administrator\Desktop\test> docker ps
    CONTAINER ID   IMAGE                                                    COMMAND                   CREATED         STATUS         PORTS             NAMES
    957cf78e4b8e   rancher/nginx-ingress-controller:nginx-0.35.0-rancher2   "/usr/bin/dumb-init …"   2 minutes ago   Up 2 minutes   80/tcp, 443/tcp   confident_robinson
    PS C:\Users\Administrator\Desktop\test> docker commit -m="nginx-ingerss-controller自定义镜像基于apline3.11、nginx1.24.0" -a="yinghuo1129" 957cf78e4b8e 10.**.**.**:30000/ruifei/toos/nginx-ingerss-controller:nginx1.24.0-Release
    sha256:b457932f1b5913c72d55e5acf315a31b50f9a0982384285122c513545180e996
    PS C:\Users\Administrator\Desktop\test> docker run -it -u root 10.**.**.**:30000/ruifei/toos/nginx-ingerss-controller:nginx1.24.0-Release /bin/bash
    bash-5.0# nginx -v
    nginx version: nginx/1.24.0
    bash-5.0# nginx -V
    nginx version: nginx/1.24.0
    built with OpenSSL 3.1.0 14 Mar 2023 (running with OpenSSL 3.1.3 19 Sep 2023)
    TLS SNI support enabled
    configure arguments: --prefix=/var/lib/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib/nginx/modules --conf-path=/etc/nginx/nginx.conf --pid-path=/run/nginx/nginx.pid --lock-path=/run/nginx/nginx.lock --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --with-perl_modules_path=/usr/lib/perl5/vendor_perl --user=nginx --group=nginx --with-threads --with-file-aio --without-pcre2 --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_geoip_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_auth_request_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-stream=dynamic --with-stream_ssl_module --with-stream_realip_module --with-stream_geoip_module=dynamic --with-stream_ssl_preread_module --add-dynamic-module=/home/buildozer/aports/main/nginx/src/njs-0.7.11/nginx --add-dynamic-module=/home/buildozer/aports/main/nginx/src/ngx_devel_kit-0.3.2/ --add-dynamic-module=/home/buildozer/aports/main/nginx/src/traffic-accounting-nginx-module-2.0/ --add-dynamic-module=/home/buildozer/aports/main/nginx/src/array-var-nginx-module-0.06/ --add-dynamic-module=/home/buildozer/aports/main/nginx/src/nginx-auth-jwt-0.2.1/ --add-dynamic-module=/home/buildozer/aports/main/nginx/src/ngx_brotli-1.0.0rc/ --add-dynamic-module=/home/buildozer/aports/main/nginx/src/ngx_cache_purge-2.5.3/ --add-dynamic-module=/home/buildozer/aports/main/nginx/src/nginx_cookie_flag_module-1.1.0/ --add-dynamic-module=/home/buildozer/aports/main/nginx/src/nginx-dav-ext-module-3.0.0/ --add-dynamic-module=/home/buildozer/aports/main/nginx/src/echo-nginx-module-0.63/ --add-dynamic-module=/home/buildozer/aports/main/nginx/src/encrypted-session-nginx-module-0.09/ --add-dynamic-module=/home/buildozer/aports/main/nginx/src/ngx-fancyindex-0.5.2/ --add-dynamic-module=/home/buildozer/aports/main/nginx/src/ngx_http_geoip2_module-3.4/ --add-dynamic-module=/home/buildozer/aports/main/nginx/src/headers-more-nginx-module-0.34/ --add-dynamic-module=/home/buildozer/aports/main/nginx/src/nginx-keyval-0.1.0/ --add-dynamic-module=/home/buildozer/aports/main/nginx/src/nginx-log-zmq-1.0.0/ --add-dynamic-module=/home/buildozer/aports/main/nginx/src/lua-nginx-module-0.10.24/ --add-dynamic-module=/home/buildozer/aports/main/nginx/src/lua-upstream-nginx-module-0.07/ --add-dynamic-module=/home/buildozer/aports/main/nginx/src/naxsi-1.3/naxsi_src --add-dynamic-module=/home/buildozer/aports/main/nginx/src/nchan-1.3.6/ --add-dynamic-module=/home/buildozer/aports/main/nginx/src/redis2-nginx-module-0.15/ --add-dynamic-module=/home/buildozer/aports/main/nginx/src/set-misc-nginx-module-0.33/ --add-dynamic-module=/home/buildozer/aports/main/nginx/src/nginx-http-shibboleth-2.0.1/ --add-dynamic-module=/home/buildozer/aports/main/nginx/src/ngx_http_untar_module-1.1/ --add-dynamic-module=/home/buildozer/aports/main/nginx/src/nginx-upload-module-2.3.0/ --add-dynamic-module=/home/buildozer/aports/main/nginx/src/nginx-upload-progress-module-0.9.2/ --add-dynamic-module=/home/buildozer/aports/main/nginx/src/nginx-upstream-fair-0.1.3/ --add-dynamic-module=/home/buildozer/aports/main/nginx/src/ngx_upstream_jdomain-1.4.0/ --add-dynamic-module=/home/buildozer/aports/main/nginx/src/nginx-vod-module-1.31/ --add-dynamic-module=/home/buildozer/aports/main/nginx/src/nginx-module-vts-0.2.1/ --add-dynamic-module=/home/buildozer/aports/main/nginx/src/mod_zip-1.3.0/ --add-dynamic-module=/home/buildozer/aports/main/nginx/src/nginx-rtmp-module-1.2.2/
    bash-5.0# exit
    exit
    PS C:\Users\Administrator\Desktop\test>

好，至此我们已经成功完成了nginx版本的升级得到了我们自己的新的nginx-ingerss-controller镜像，可以push到自己的私有仓库，然后升级测试了。

![2918a1d10eb1486da482a9483d67dae2.png][]

### 总结 ###

其实更新和升级nginx是个很常见的问题，系统漏洞有很大一部分都是 数据库、redis、nginx、swagger等常见组件导致的，遇到漏洞不要慌慢慢处理和分析即可。另外如果有小伙伴觉得都没法通过 add 或者 apt-get 等命令安装，只能通过源码编译的话也可以大胆尝试，参考[升级ingress-nginx-controller的nginx版本\_修改 ingress 镜像版本-CSDN博客][ingress-nginx-controller_nginx_ ingress _-CSDN]

### 参考&资源查找 ###

[升级ingress-nginx-controller的nginx版本\_修改 ingress 镜像版本-CSDN博客][ingress-nginx-controller_nginx_ ingress _-CSDN]

[Dockerfile中使用alpine镜像部署nginx服务\_nginx alpine docker 安装模块-CSDN博客][Dockerfile_alpine_nginx_nginx alpine docker _-CSDN]

[alpine 镜像下 apk 命令的使用\_程序员\_IT虾米网][alpine _ apk _IT]

[nginx源码版本下载地址][nginx]

[nginx源码编译模块查找地址][nginx 1]

[nginx-apline3.18安装包地址][nginx-apline3.18]

[90ff5871aeae452d8bdfb467e9404513.png]: https://img-blog.csdnimg.cn/90ff5871aeae452d8bdfb467e9404513.png
[8080cba2aa8d4325a95e87058bdc3d36.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/01/c4059d21f15545e884a44064f1bf2329.png
[Index of _packages_alpine_]: http://nginx.org/packages/alpine
[http_mirrors.aliyun.com_alpine]: http://mirrors.aliyun.com/alpine/
[44918b6bb52c41319153f2ab486cec43.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/01/7eaf53c06f71494cbf44cd76648bd13b.png
[bdb7c1463a7f4286b1b67fe736dd00ba.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/01/2f7330145c6246c89a113f7df1fbb0fc.png
[2918a1d10eb1486da482a9483d67dae2.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/01/e37ab21d632043b1a3b4185827e2c7a2.png
[ingress-nginx-controller_nginx_ ingress _-CSDN]: https://blog.csdn.net/weixin_39961559/article/details/87935873
[Dockerfile_alpine_nginx_nginx alpine docker _-CSDN]: https://blog.csdn.net/cxyxt/article/details/126630118
[alpine _ apk _IT]: https://www.itxm.cn/post/gaiha1a7.html
[nginx]: http://nginx.org/download/
[nginx 1]: https://www.nginx.com/resources/wiki/modules/index.html
[nginx-apline3.18]: http://nginx.org/packages/alpine/v3.18/main/x86_64/