Fix (APAR):  PI29911

Status:  Fix

Release:  8.5.5

Operating System:  AIX,HP-UX,IBM i,Linux,Solaris,Windows

Supersedes Fixes:  PM98409,PM90897,PI14340,PM93051,PM89259,PM88126,PI05139,PM96235,PI05525,PI10103,PM95424

CMVC Defect:  

Byte size of APAR:  4397077

Date: 2014-12-18

Abstract:  Potential Information Disclosure with Liberty profile servlets

Description/symptom of problem:  


PI29911 resolves the following problem:


        Potential Information Disclosure with Liberty profile servlets

        ERROR DESCRIPTION:
        Confidential for Security Integrity ifix.

        LOCAL FIX:                                                      

        PROBLEM SUMMARY:
        Confidential for Security Integrity ifix.

        PROBLEM CONCLUSION:
        Confidential for Security Integrity ifix.







Directions to apply fix:  
        1. Open a console and direct it to the location of your iFix jar
        2. Run the command "java -jar 8550-wlp-archive-IFPI29911.jar". The following launch options
        are available for the jar:

        --installLocation [LibertyRootDir] by default the jar will look for a "wlp" directory
        in its current location. If your Liberty profile install
        location is different to "wlp" and/or is not in the same
        directory as the jar then you can use this option to change
        where the jar will patch. [LibertyRootDir] can either be
        relative to the location of the jar or an absolute file path.

        --suppressInfo hides all messages other than confirming the
        patch has completed or error messages.

        3. Stop your Liberty profile server(s).
        4. When you next start your Liberty profile server(s), use the --clean option on
        the server start command (server start myServerName --clean) and the fix will become
        fully active in your runtime.







Directions to remove fix:  
        1. Stop your Liberty profile server(s).
        2. You will need to delete the following files (file locations are
        relative to your Liberty profile install root):

         - lib/com.ibm.ws.webcontainer.security.app_1.0.3.cl50020141212-2049.jar
         - lib/com.ibm.ws.webcontainer.security.admin_1.0.3.cl50020141212-2049.jar
         - lib/com.ibm.ws.webcontainer.security_1.0.2.cl50020141212-2049.jar
         - lib/com.ibm.ws.webcontainer_1.0.3.cl50020141212-2049.jar
         - lib/com.ibm.ws.webcontainer.security.feature_1.0.1.cl50020141212-2049.jar
         - lib/fixes/8550-wlp-archive-IFPI29911_8.5.5000.20141212_2049.xml

        3. When you next start your Liberty profile server(s), use the --clean option.
        The fix will then become inactive in your runtime.







Directions to re-apply fix:  
        1. Follow the instructions to apply the fix.







Additional Information: