Security Bulletin: IBM Kenexa LCMS Premier On Premise - CVE-2021-2341 (deferred from Oracle Jul 2021 CPU for Java 7.x)

Summary

We have identified that the IBM Kenexa LCMS Premier is affected by one or more security vulnerabilities. These have been addressed in LCMS Premier 14.0 version.

Vulnerability Details

CVEID:CVE-2021-2341
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Networking component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors.
CVSS Base score: 3.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/205768 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

IBM recommends updating to the latest release for customers who are using an affected version. The new version is available at IBM Passport Advantage web site.

Once on version 14.0, please proceed to download and apply the provided fix via Fix Central.

Steps to Download from Fix Central

• Log in to Fix Central (<https://www-945.ibm.com/support/fixcentral/&gt;)
• Select "IBM Kenexa LCMS Premier” from the Product Selector dropdown
• Select “14.0” from the Installed version dropdown
• Select “Windows” from the Platform dropdown
• Click “Continue”
• Select "Browse for Fixes” and click “Continue”

Download the following 2 files:

• p_14.0.0058_2021-09-07_21-16.zip or above
• p_14.0.0058-NO-LCMS_JDK8.0.6.35_2021-09-06_00-25.zip

Steps to Follow in Version 14.0 ONLY:

Perform Backups:

1. Stop LCMS Services

2. Perform Backups:

In the LCMS installation directory, perform a backup of the existing JDK directories by renaming the Java directories ibmsdk32 and ibmsdk64. We suggest appending "_backup” to the end.

& Store the back-up folders in separate place/folders

Important Note: If the Step 1 (stopping of services) did not complete, you might have issues renaming the folders. Please ensure all LCMS services are no longer running prior to renaming/taking backup

Step 1: Deploy the latest LCMS patch: p_14.0.0058_2021-09-07_21-16.zip or above

1. Remove all plugins:

a. From ConfigWiz.exe, check “Advanced” checkbox, then click “Stop Services”

b. Move all jar and all zip files from plugin folder to somewhere else

c. From ConfigWiz.exe, click “Add/Remove Plugins”.

2. Install this plugin:

a. Move or copy this plugin file into the plugin folder.

b. From ConfigWiz.exe, click “Advanced” checkbox, then click “Add/Remove Plugins”

Note: A pop up will display to start the deployment & it will be closed automatically once done the patch deployment

Step 2: Deploy the JDK_Only patch/plugin: p_14.0.0058-NO-LCMS_JDK8.0.6.35_2021-09-06_00-25.zip [This is on-time activity]

a. Step#1 must complete to starts the JDK 8.0.6.35 upgrade

b. Add the JDK_Only patch/plugin in “plugins” folder [example: p_14.0.0058-NO-LCMS_JDK8.0.6.35_2021-09-06_00-25.zip or later patch] & LCMS patch need not be removed from plugin folder

c. From ConfigWiz.exe, click “Advanced” checkbox, then click “Add/Remove Plugins”

Note: A pop up will display to start the deployment

d. For plugins that have JDK upgrade: ◦ ConfigWiz.exe must be closed for JDK upgrade to complete [A popup will be displayed as an alert to close the ConfigWiz]. Anything else that might be using LCMS files or directories must also be closed.

FYI…Steps:

d.1. click OK on the pop-up which is related to close the ConfigWiz

d.2. close the ConfigWiz

Note: Once closed the configwiz, JDK upgrade will be started and the pop-up which has displayed on step#2.c will be closed automatically after completion of JDK upgrade

e. From ConfigWiz.exe, check “Advanced” checkbox, then click “Starts Services”

Special Feature with this JDK_Only patch:

Certificates which has available in “Security” folder […\ibmsdk64\jre\lib\security] will be preserved after JDK8.0.6.35 version upgrade also [files with extension -> *.CER or *.CRT - Base64-encoded or DER-encoded binary X.509 Certificate]

Note:

1. In future, while deploying the upcoming patches, ensure JDK_Only patch/plugin deployment- “Add/Remove Plugins” needs to be run twice as part of step#1.1 [Remove all plugins]

2. Once, Step 1 & 2 are done, you will not be able to revert to the previous version of the JDK. However, applying the upcoming/future patches will only ensure that JDK is maintained with latest version or installed with upgraded version

Workarounds and Mitigations

None