Weblogic反序列化远程代码执行漏洞(CVE-2018-2628) 补丁包

=============================== Patch Set Update (PSU) for Bug: 27912627 =============================== Date: Wed Jun 27 09:48:28 2018 --------------------------------- Platform Patch for : Generic Product Patched : ORACLE WEBLOGIC SERVER Product Version : 12.2.1.3.0 This document describes how to install the interim patch for bug # 27912627. It includes the following sections: Section 1, "Zero Downtime Patching" Section 2, "Prerequisites" Section 3, "Pre-Installation Instructions" Section 4, "Installation Instructions" Section 5, "Post-Installation Instructions" Section 6, "Deinstallation Instructions" Section 7, "Post Deinstallation Instructions" Section 8, "Bugs Fixed by This Patch" Section 9, "Known Issues" 1 Zero Downtime Patching ------------------------------ This patch has been marked as eligible for Zero Downtime Patching. The type of Zero Downtime Patching supported by this patch is FMW_ROLLING_ORACLE_HOME. With Zero Downtime Patching, a Patch can be applied to a system in a manner that does not incur any downtime. This ensures that the system can remain available and functioning during the patching process. Certain pre-requisites, however, must be met before the patch can be applied. For more information, see the following: Doc ID 1942159.1 Introduction to Zero Downtime (ZDT) Patching for Oracle Fusion Middleware / WebLogic Server https://support.oracle.com/rs?type=doc&id=1942159.1 2 Prerequisites ---------------- Ensure that you meet the following requirements before you install or deinstall the patch: 1. Understand the PSU program: Review the following before applying PSUs for the first time: Doc ID 1306505.1 Patch Set Update (PSU) Administration Guide for Oracle WebLogic Server (WLS) https://support.oracle.com/rs?type=doc&id=1306505.1 2. Update Java SE (JDK/JRE): For users of Oracle JDKs and JVMs, we strongly recommend applying the latest Java Critical Patch Updates (CPUs) as soon as they are released. Refer to the following for further information: Doc ID 1506916.1 Obtaining Java SE (JDK/JRE) for Oracle Fusion Middleware Products https://support.oracle.com/rs?type=doc&id=1506916.1 3. Update OPatch: Oracle Fusion Middleware 12.2.1 products are installed with OPatch NextGen 13.3 to apply interim patches. The OPatch utility should be updated over time to resolve known issues. You can check your version using the following command: ORACLE_HOME/OPatch/opatch version *** To install this PSU, you must use OPatch version 13.9.4. If you try to install the PSU with an earlier opatch version (e.g. 13.9.2.0.0), you will see an error similar to: " Verifying environment and performing prerequisite checks... Prerequisite check "CheckMinimumOPatchVersion" failed. The details are: The OPatch being used has version 13.9.2.0.0 while the following patch(es) require higher versions: Patch 27912627 requires OPatch version 13.9.4.0.0. Please download latest OPatch from My Oracle Support. " *** OPatch 13.9.4 is available as Patch 28186730: https://support.oracle.com/rs?type=patch&id=28186730 Review the following for more OPatch information: Doc ID 1587524.1 Using OUI NextGen OPatch 13 for Oracle Fusion Middleware 12c (12.1.2+) https://support.oracle.com/rs?type=doc&id=1587524.1 3. Verify the OUI Inventory: OPatch needs access to a valid OUI inventory to apply patches. Note: This needs the ORACLE_HOME to be set(refer section "2. Pre-Installation Instructions") prior to run the below commands: Validate the OUI inventory with the following commands: $ opatch lsinventory -jre $ORACLE_HOME/oracle_common/jdk/jre Note: All OPatch commands should be run with -jre option. Make sure the JDK version you use is the certified version for your product. If the command errors out, contact Oracle Support and work to validate and verify the inventory setup before proceeding. 4. Confirm the executables appear in your system PATH: The patching process will use the unzip and the OPatch executables. After setting the ORACLE_HOME environment, confirm if the following executables exist, before proceeding to the next step: - opatch - unzip If either of these executables do not show in the PATH, correct the problem before proceeding. 5. Create a location for storing the unzipped patch: This location will be referred to later in the document as PATCH_TOP. NOTE: On WINDOWS, the preferred location is the drive root directory. For example, "C:\PATCH_TOP" and avoid choosing locations like, "C:\Documents and Settings\username\PATCH_TOP". This is necessary due to the 256 characters limitation on windows platform. 3 Pre-Installation Instructions ------------------------------- 1. Set the ORACLE_HOME environment variable to the directory where you have installed ORACLE WEBLOGIC SERVER. 2. To install this PSU, you must use OPatch version 13.9.4. See Prerequisite section above. 4 Installation Instructions --------------------------- 1. Unzip the patch zip file into the PATCH_TOP. $ unzip -d PATCH_TOP p27912627_122130_Generic.zip NOTE: On WINDOWS, the unzip command has a limitation of 256 characters in the path name. If you encounter this, please use an alternate ZIP utility like 7-Zip to unzip the patch. For example: To unzip using 7-zip, run the command: "c:\Program Files\7-Zip\7z.exe" x p27912627_122130_Generic.zip 2. Set your current directory to the directory where the patch is located. $ cd PATCH_TOP/27912627 3. Run OPatch to apply the patch. $ opatch apply Windows: When applying interim patches with OPatch 13.9.4, Microsoft Windows platform needs the '-oop' option: <ORACLE_HOME>\OPatch\opatch apply <PATCH_HOME> -oop where PATCH_HOME is a numbered directory where you extracted interim patch contents. Note: ----- When OPatch starts, it validates the patch and makes sure that there are no conflicts with the software already installed in the ORACLE_HOME. In case of opatch conflict, you will see a warning message similar to the one mentioned below: Interim Patch XXXX has Conflict with patch(es) [ YYYY ] in OH ... Conflict patches: YYYY Patch(es) YYYY conflict with the patch currently being installed (XXXX). If you continue, patch(es) YYYY will be rolled back and the new patch (XXXX) will be installed. If a merge of the new patch (XXXX) and the conflicting patch(es) ( YYYY) is required,contact Oracle Support Services and request a Merged patch. Do you want to proceed? [y|n] n You must stop the patch installation and he following should be reviewed: Doc ID 1329952.1 Oracle Fusion Middleware Patch Conflict Resolution https://support.oracle.com/rs?type=doc&id=1329952.1 Contact Oracle Support if the conflict cannot be resolved or you need a Merge Request. 5 Post-Installation Instructions --------------------------------- Note: The fix for bug 26929163 updates the runtime components for the WLS plugin for the RCU and Upgrade Assistant tools. It will prevent any future WLS schema installs or upgrades from allowing WLS schema owners to retain ANY privs once installation or upgrade have been completed. The patch will *not* affect schemas that have already been installed or upgraded to the correct schema version. For existing installations that wish to remove the ANY privileges that have been assigned to the WLS schema owners, users can run the script located at $MW_HOME/oracle_common/common/sql/wlsservices/sql/cleanup.sql as the DBA user and provide the WLS schema owner names. For example, if the WLS schema owners are DEV1_WLS and DEV1_WLS_RUNTIME: sqlplus <dba-connect-info> cleanup.sql DEV1_WLS DEV1_WLS_RUNTIME 6 Deinstallation Instructions ------------------------------ If you experience any problems after installing this patch, remove the patch as follows: 1. Make sure to follow the same Prerequisites or pre-install steps (if any) when deinstalling a patch. This includes setti