Fix (APAR): PI29911 Status: Fix Release: 8.5.5.3 Operating System: AIX,HP-UX,IBM i,Linux,Solaris,Windows Supersedes Fixes: PI23168,PI26941,PI15943 CMVC Defect: Byte size of APAR: 10571830 Date: 2014-12-18 Abstract: Potential Information Disclosure with Liberty profile servlets Description/symptom of problem: PI29911 resolves the following problem: Potential Information Disclosure with Liberty profile servlets ERROR DESCRIPTION: Confidential for Security Integrity ifix. LOCAL FIX: PROBLEM SUMMARY: Confidential for Security Integrity ifix. PROBLEM CONCLUSION: Confidential for Security Integrity ifix. Directions to apply fix: 1. Stop your Liberty profile server(s). 2. The following files will be backed up to [LibertyRootDir]/lib/fixes automatically, if they exist (file locations are relative to your Liberty profile install root, and may not exist depending on the installed product edition or configuration of runtime): - lib/com.ibm.ws.kernel.boot_1.0.6.jar 3. Open a console and direct it to the location of your iFix jar 4. Run the command "java -jar 8553-wlp-archive-IFPI29911.jar". The following launch options are available for the jar: --installLocation [LibertyRootDir] by default the jar will look for a "wlp" directory in its current location. If your Liberty profile install location is different to "wlp" and/or is not in the same directory as the jar then you can use this option to change where the jar will patch. [LibertyRootDir] can either be relative to the location of the jar or an absolute file path. --suppressInfo hides all messages other than confirming the patch has completed or error messages. 5. When you next start your Liberty profile server(s), the fix will become active in your runtime. Directions to remove fix: 1. Stop your Liberty profile server(s). 2. You will need to delete the following files (file locations are relative to your Liberty profile install root): - lib/com.ibm.ws.webcontainer.security_1.0.5.cl50320141212-1913.jar - lib/com.ibm.ws.security.thread.zos.context_1.0.1.cl50320140905-1604.jar - lib/com.ibm.ws.jsf_1.0.6.cl50320141106-2152.jar - lib/com.ibm.websphere.security_1.0.6.cl50320140905-1604.jar - lib/com.ibm.ws.javaee.ddmodel_1.0.6.cl50320141106-2152.jar - lib/com.ibm.ws.webcontainer_1.0.6.cl50320141212-1913.jar - lib/com.ibm.ws.jca.cm_1.0.3.cl50320140905-1604.jar - lib/com.ibm.ws.jsp_1.0.6.cl50320141106-2152.jar - lib/com.ibm.ws.classloading_1.0.6.cl50320141106-2152.jar - lib/fixes/8553-wlp-archive-IFPI29911_8.5.5003.20141212_1913.xml - lib/com.ibm.ws.kernel.boot_1.0.6.jar 3. You will need to restore the static files by extracting the corresponding backup archive from [LibertyRootDir]/lib/fixes (contents of the backup archive are relative to your Liberty profile install root). 4. When you next start your Liberty profile server(s), use the --clean option. The fix will then become inactive in your runtime. Directions to re-apply fix: 1. Follow the instructions to apply the fix. Additional Information: