0821漏洞拟通知

docs/index.en.md

@@ -1,33 +1,44 @@
 # Product Introduction
 
-??? warning "[Important Notice | JumpServer Vulnerability Notification and Remediation (JS-2026.7.29)]"
-    In July 2026, the JumpServer open source project team received vulnerability reports from security researchers. After verification, the following vulnerabilities were confirmed:
+??? warning "[Important Notice | JumpServer Vulnerability Notification and Remediation (JS-2026.08.21)]"
+    In August 2026, the JumpServer open source project team received vulnerability reports from security researchers. After verification, the following vulnerability was confirmed:
 
-    ■ **Vulnerability in the fastjson dependency of the JumpServer Chen component (CVE-2026-16723)**. Details: [Security Advisory: Remote Code Execution in fastjson 1.2.68-1.2.83](https://github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83)
+    ■ **Access key disclosure caused by SQL query filtering in JumpServer (CVE-2026-xxxxx)**. Details: [GHSA-6rp5-ff2m-qfrm](https://github.com/jumpserver/jumpserver/security/advisories/GHSA-6rp5-ff2m-qfrm)
 
-    ■ **SFTP path traversal in JumpServer KoKo Web Terminal (CVE-2026-54336)**. Details: [GHSA-x6rg-36j6-76vr](https://github.com/jumpserver/jumpserver/security/advisories/GHSA-x6rg-36j6-76vr)
+    **Affected versions:**
 
-    ■ **Remote command execution through Jinja template injection during JumpServer Applet Host deployment (CVE-2026-44845)**. Details: [GHSA-22h6-pcgh-9v7q](https://github.com/jumpserver/jumpserver/security/advisories/GHSA-22h6-pcgh-9v7q)
+    <br>JumpServer V3: >= 3.7.0, < 3.10.23
+    <br>JumpServer V4: >= 4.0.0, < 4.10.19
 
-    ■ **Privilege overwrite in JumpServer organization invitation logic (CVE-2026-44846)**. Details: [GHSA-j836-99w5-523r](https://github.com/jumpserver/jumpserver/security/advisories/GHSA-j836-99w5-523r)
+    **Fixed versions:**
 
-    **Affected versions:**
+    <br>JumpServer V3: >= v3.10.23
+    <br>JumpServer V4: >= v4.10.19
+
+    **Exploitation conditions:**
+
+    An attacker with ordinary user privileges can use this API to obtain the access keys of other users, which is equivalent to having the permissions of other users, including admin.
 
-    <br>JumpServer V3: earlier than v3.10.22 LTS
-    <br>JumpServer V4: earlier than v4.10.17 LTS
+    **Remediation:**
 
-    **Secure versions:**
+    Users are advised to upgrade to a secure version as soon as possible. In the secure versions, JumpServer has fixed the above issues.
 
-    <br>JumpServer V3: v3.10.22 LTS or later
-    <br>JumpServer V4: v4.10.17 LTS or later
+    **Temporary workaround:**
 
-    If an immediate upgrade is not possible:
+    Disable this filtering parameter in the nginx configuration file:
 
-    **■** Restrict administrative access to high-risk functionality such as Ansible automation, SSH gateways, and Applet Hosts, granting the relevant permissions only to trusted administrators;
+    1. If HTTPS is enabled, modify `/opt/jumpserver/config/nginx/lb_http_server.conf`;
 
-    **■** Review existing SSH gateway configurations, automation task templates, Applet Host configurations, and organization role change records for suspicious content;
+    2. If HTTPS is not enabled, modify `/etc/nginx/conf.d/http_server.conf` inside the jms_web container, and commit the changes after completion.
 
-    **■** Limit the use of accounts that have user invitation permissions.
+    ```
+    location / {
+        if ($arg__rel != "") {
+            return 400;
+        }
+        .....
+    }
+    ```
 
 
 

docs/index.md

@@ -1,35 +1,45 @@
 # 产品介绍
 
-??? warning "[重要通知丨JumpServer 漏洞通知及修复方案（JS-2026.7.29）]"
+??? warning "[重要通知丨JumpServer 漏洞通知及修复方案（JS-2026.08.21）]"
 
-    2026 年 7 月，JumpServer 开源项目组收到安全研究人员提交的漏洞报告。经验证，此次发现的漏洞包括：
+    2026 年 8 月，JumpServer 开源项目组收到安全研究人员提交的漏洞报告。经验证，此次发现的漏洞包括：
 
-    ■ **JumpServer Chen 组件依赖库 fastjson 漏洞（CVE-2026-16723）**。漏洞详情：[Security Advisory: Remote Code Execution in fastjson 1.2.68-1.2.83](https://github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83)
+    ■ **JumpServer sql 查询过滤导致 access key 泄露漏洞（CVE-2026-xxxxx）**。漏洞详情：[GHSA-6rp5-ff2m-qfrm](https://github.com/jumpserver/jumpserver/security/advisories/GHSA-6rp5-ff2m-qfrm)
 
-    ■ **JumpServer KoKo Web Terminal SFTP 路径遍历漏洞（CVE-2026-54336）**。漏洞详情：[GHSA-x6rg-36j6-76vr](https://github.com/jumpserver/jumpserver/security/advisories/GHSA-x6rg-36j6-76vr)
+    **受影响版本：**
 
-    ■ **JumpServer Applet Host 部署 Jinja 模板注入远程命令执行漏洞（CVE-2026-44845）**。漏洞详情：[GHSA-22h6-pcgh-9v7q](https://github.com/jumpserver/jumpserver/security/advisories/GHSA-22h6-pcgh-9v7q)
+    <br>JumpServer V3 版本：>= 3.7.0, &lt; 3.10.23
+    <br>JumpServer V4 版本：>= 4.0.0, &lt; 4.10.19
 
-    ■ **JumpServer 组织邀请逻辑权限覆盖漏洞（CVE-2026-44846）**。漏洞详情：[GHSA-j836-99w5-523r](https://github.com/jumpserver/jumpserver/security/advisories/GHSA-j836-99w5-523r)
+    **修复版本：**
 
-    **以上漏洞影响版本：**
+    <br>JumpServer V3 版本：>= v3.10.23
+    <br>JumpServer V4 版本：>= v4.10.19
 
-    <br>JumpServer V3 版本：&lt; v3.10.22 LTS 版本
-    <br>JumpServer V4 版本：&lt; v4.10.17 LTS 版本
+    **漏洞利用条件：**
 
-    **安全版本：**
+    攻击者拥有普通用户的权限，就可以利用这个 API 获取到其他用户的 access key，其实就是相当于有了别的用户权限，包括 admin。
 
-    <br>JumpServer V3 版本：>= v3.10.22 LTS 版本
-    <br>JumpServer V4 版本：>= v4.10.17 LTS 版本
+    **修复方案：**
 
-
-    如果暂时无法升级：
+    建议用户尽快升级到安全版本。在安全版本中，JumpServer 已经针对以上问题完成修复。
 
-    **■** 建议限制 Ansible 自动化、SSH 网关、Applet Host 等高风险功能的管理权限，仅向可信管理员授予相关权限；
+    **临时修复：**
 
-    **■** 审查已有 SSH 网关配置、自动化任务模板、Applet Host 配置以及组织角色变更记录，排查异常内容；
+    在 nginx 配置文件中禁用这个过滤参数：
 
-    **■** 限制具有用户邀请权限账号的使用范围。
+    1. 如果启用了 https，可以通过修改 `/opt/jumpserver/config/nginx/lb_http_server.conf` 完成；
+
+    2. 如果没有启用，只能修改 jms_web 容器中的 `/etc/nginx/conf.d/http_server.conf` 完成，完成后需要 commit。
+
+    ```
+    location / {
+        if ($arg__rel != "") {
+            return 400;
+        }
+        .....
+    }
+    ```
 
 
 !!! tip "[信创合规、开箱即用、全栈优化丨飞致云联合宏时数据发布 Zabbix 信创一体机！](https://fit2cloud.com/zabbix/index.html)"