发布日期: 2026-02-27
版本号: v23.0.3

Vitess v23.0.3是一个以安全为重点的版本，主要修复了两个新报告的漏洞（CVE-2026-27965和CVE-2026-27969）以及其他相关的安全问题。首先，默认不再使用备份MANIFEST文件中存储的外部解压器命令，因为之前可能导致攻击者执行任意代码，现已通过新增--external-decompressor-use-manifest标志进行控制，这是一个需要用户注意的破坏性变更。其次，更新了对备份MANIFEST文件的处理，以防止路径遍历攻击，避免攻击者写入任意文件路径。该版本共包含22个合并的提交，感谢所有贡献者的工作。

更新内容 （中文）

Vitess v23.0.3 版本发布

概要

本版本重点关注安全修复。包含针对近期两个 CVE 的修复以及多项其他安全相关更新。

外部解压器默认不再从备份 MANIFEST 读取

此修复针对以下安全公告及关联 CVE：

备份 MANIFEST 文件中存储的外部解压器命令，在恢复时将默认不再被使用。此前若未提供 --external-decompressor 参数，VTTablet 会回退至使用 MANIFEST 中指定的命令。这存在安全风险：拥有备份存储写入权限的攻击者可修改 MANIFEST，在 tablet 上执行任意命令。

请注意此为破坏性变更。 自 v23.0.3 起，基于 MANIFEST 的解压器将被忽略，除非通过新的 --external-decompressor-use-manifest 参数显式启用。若依赖此行为，请在 VTTablet 配置中添加该参数，但需注意相关安全影响。

详情参见 #19460。

通过备份 MANIFEST 文件恢复时阻止路径遍历攻击

此修复针对以下安全公告及关联 CVE：

现已阻止一种常见的路径遍历攻击，防止拥有备份存储写入权限的攻击者通过修改 MANIFEST 逃逸目标恢复目录，并将文件写入任意文件系统路径。

详情参见 #19470。

本版本完整变更日志请见此处。

本次发布包含 22 个合并的 Pull Request。

感谢所有贡献者：@app/vitess-bot、@bcremer、@mattlord

更新内容 （原始）

Release of Vitess v23.0.3

Summary

This is a security focused release. It contains fixes for two recently reported CVEs along with a number of other security related fixes.

External Decompressor No Longer Read from Backup MANIFEST by Default

This is a fix for the following security advisory and associated CVE

The external decompressor command stored in a backup’s MANIFEST file is no longer used at restore time by default. Previously, when no --external-decompressor flag was provided, VTTablet would fall back to the command specified in the MANIFEST. This posed a security risk: an attacker with write access to backup storage could modify the MANIFEST to execute arbitrary commands on the tablet.

Please note that this is a breaking change. Starting in v23.0.3, the MANIFEST-based decompressor is ignored unless you explicitly opt in with the new --external-decompressor-use-manifest flag. If you rely on this behavior, add the flag to your VTTablet configuration, but be aware of the security implications.

See #19460 for details.

Prevent Path Traversals Via Backup MANIFEST Files On restore

This is a fix for the following security advisory and associated CVE

We now prevent a common Path Traversal attack that someone with write access to backup storage could use to escape the target restore directory and write files to arbitrary filesystem paths via modifications to the MANIFEST.

See #19470 for details.

The entire changelog for this release can be found here.

The release includes 22 merged Pull Requests.

Thanks to all our contributors: @app/vitess-bot, @bcremer, @mattlord

下载链接