Security Bulletin: Updating IBM WebSphere Liberty Profile in Identity Insight for security update

Summary

Identity Insight customers are advised to update IBM WebSphere Liberty Profile (WLP) to version 24.0.0.9 for security update in WLP.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Remediation/Fixes

The listed vulnerability issues are addressed.

Steps

This section provides instructions on how to update WebSphere Liberty Profile used in InfoSphere Identity Insight (II) to WLP 24.0.0.9.

1. Download wlp-base-all-24.0.0.9.jar from Fix Central.

2. Stop Liberty Server
   Windows
   <ii_install_dir>\bin\stopIIServer.bat
   Linux/AIX
   <ii_install_dir>/bin/stopIIServer

3. Backup the wlp directory in the <ii_install_dir> by renaming it.
   * Find out what version of the current wlp in <ii_install_dir> by viewing <ii_install_dir>/wlp/usr/servers/iiServer/logs/messages.log. The wlp version is shown at the beginning of the file.
   * Rename the wlp directory to wlp__<version>, substitute <version> with the version number of the current wlp.
   Windows
   move <ii_install_dir>\wlp <ii_install_dir>\wlp<version>
   Linux/AIX
   mv <ii_install_dir>/wlp <ii_install_dir>/wlp_<version>

4. Extract wlp-base-all-24.0.0.9 JAR file into Identity Insight Installation directory (<ii_install_dir>).
   java -jar wlp-base-all-24.0.0.9.jar --acceptLicense <ii_install_dir>

5. Copy Liberty Server configuration files to the newly installed WLP directory.
   Windows
   xcopy /S /I <ii_install_dir>\wlp_<version>\usr\servers\iiServer <ii_install_dir>\wlp\usr\servers\iiServer
   Linux/AIX
   cp -rp <ii_install_dir>/wlp_<version>/usr/servers/iiServer <ii_install_dir>/wlp/usr/servers/iiServer

6. Remove ‘workarea’ and ‘tranlog’ directories from the newly installed WLP directory.
   Windows
   rd /s /q <ii_install_dir>\wlp\usr\servers\iiServer\workarea
   rd /s /q <ii_install_dir>\wlp\usr\servers\iiServer\tranlog
   Linux/AIX
   rm -fr <ii_install_dir>/wlp/usr/servers/iiServer/workarea
   rm -fr <ii_install_dir>/wlp/usr/servers/iiServer/tranlog

7. Configure or disable the hostname verification.
   Beginning with WLP 24.0.0.9, Liberty performs hostname verification on SSL certificates. When Liberty is acting as a client connecting to an outbound server (such as pipeline, db2 server, ldap server), the runtime now checks to make sure the hostname value from the server certificate’s Subject Alternative Name (SAN) matches the hostname value used when establishing the connection. A new collection of properties can be used to configure or disable the hostname verification behavior. For details, please refer to <https://www.ibm.com/support/pages/node/7163230&gt;

8. Verify the updated WLP is used in Identity Insight.
   * Start Libertyy Server
   Windows
   <ii_install_dir>\bin\startIIServer.bat
   Linux/AIX
   <ii_install_dir>/bin/startIIServer
   * Check the WLP version number logged in <ii_install_dir>/wlp/usr/servers/iiServer/logs/messages.log.

Workarounds and Mitigations

None