IBM Support

IJ28757: ASSET VULNERABILITY ASSIGNMENTS CAN FAIL TO WORK AS EXPECTED DUE TO AN INCORRECT JAR REFERENCE

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • Asset Vulnerability assignments updates can fail to work as
    expected when an incorrect jar file is used within QRadar
    (icu4j-58.2.jar instead of icu4j-65.1.jar)
    The crontab entry on the console that runs the script
    /opt/qvm/assetupdates/run-qvm-assetupdates.sh fails with "class
    not found error", but the error is only visible when the
    command is run on the command line.
    For example:
    # /opt/qvm/assetupdates/run-qvm-assetupdates.sh
    09:07:19,962 INFO  [FrameworksContext]
    [NOT:0000006000][127.0.0.1/- -] [-/- -]Initializing resource
    loggers:
    [Lcom.q1labs.frameworks.core.IFrameworksContext$ResourceLogger;@
    41bb258b
    09:07:19,968 INFO  [FrameworksContext]
    [NOT:0000006000][127.0.0.1/- -] [-/- -]Frameworks instance name:
    09:07:19,968 INFO  [FrameworksContext]
    [NOT:0000006000][127.0.0.1/- -] [-/- -]Initializing with URL:
    file:/opt/qradar/conf/
    09:07:19,968 INFO  [FrameworksContext]
    [NOT:0000006000][127.0.0.1/- -] [-/- -]Frameworks booting -
    logging, loader complete
    09:07:19,969 INFO  [FrameworksContext]
    [NOT:0000006000][127.0.0.1/- -] [-/- -]Loading
    frameworks.properties
    09:07:20,244 INFO  [NamedThreadFactory]
    [NOT:0000006000][127.0.0.1/- -] [-/- -]Thread factory created:
    Spillover Cache Vacuum
    09:07:20,256 INFO  [FrameworksContext]
    [NOT:0000006000][127.0.0.1/- -] [-/- -]Frameworks global cache
    manager was initialized using: /opt/qradar/conf/ehcache.xml
    09:07:20,256 INFO  [FrameworksContext]
    [NOT:0000006000][127.0.0.1/- -] [-/- -]Initializing jpa
    09:07:21,003 INFO  [FrameworksContext]
    [NOT:0000006000][127.0.0.1/- -] [-/- -]Initializing naming
    09:07:21,005 INFO  [FrameworksNaming]
    [NOT:0000006000][127.0.0.1/- -] [-/- -]Naming initializing,
    failFast disabled: false
    09:07:21,441 INFO  [FrameworksNaming]
    [NOT:0000006000][127.0.0.1/- -] [-/-
    -]com.q1labs.assetprofile.service.ui.UIByVulnerability.NAME
    MUST be public, static and not final for naming to help with
    setting of NAME
    09:07:21,446 INFO  [FrameworksNaming]
    [NOT:0000006000][127.0.0.1/- -] [-/-
    -]com.q1labs.assetprofile.service.ui.UIVulnerabilityService.NAME
    MUST be public, static and not final for naming to help with
    setting of NAME
    09:07:22,072 INFO  [FrameworksNaming]
    [NOT:0000006000][127.0.0.1/- -] [-/-
    -]com.q1labs.core.api.impl.health.HealthMetricAPIImpl.NAME MUST
    be public, static and not final for naming to help with setting
    of NAME
    09:07:22,099 INFO  [FrameworksNaming]
    [NOT:0000006000][127.0.0.1/- -] [-/-
    -]com.q1labs.core.dao.application.ApplicationUserRoleMapping.App
    licationUserRoleMapping.NAME MUST be public, static and not
    final for naming to help with setting of NAME
    09:07:22,100 INFO  [FrameworksNaming]
    [NOT:0000006000][127.0.0.1/- -] [-/-
    -]com.q1labs.core.dao.application.AugmentedSecurityProfile.NAME
    MUST be public, static and not final for naming to help with
    setting of NAME
    09:07:22,114 INFO  [FrameworksNaming]
    [NOT:0000006000][127.0.0.1/- -] [-/-
    -]com.q1labs.core.dao.application.InstalledApplicationInstance.I
    nstalledApplicationInstance.NAME MUST be public, static and not
    final for naming to help with setting of NAME
    09:07:22,116 INFO  [FrameworksNaming]
    [NOT:0000006000][127.0.0.1/- -] [-/-
    -]com.q1labs.core.dao.application.InstalledApplicationInstance.I
    nstalledApplicationInstanceArchive.NAME MUST be public, static
    and not final for naming to help with setting of NAME
    09:07:22,418 INFO  [FrameworksNaming]
    [NOT:0000006000][127.0.0.1/- -] [-/-
    -]com.q1labs.core.dao.wincollect.AleDestination.NAME MUST be
    public, static and not final for naming to help with setting of
    NAME
    09:07:22,419 INFO  [FrameworksNaming]
    [NOT:0000006000][127.0.0.1/- -] [-/-
    -]com.q1labs.core.dao.wincollect.AleSchedule.NAME MUST be
    public, static and not final for naming to help with setting of
    NAME
    09:07:22,420 INFO  [FrameworksNaming]
    [NOT:0000006000][127.0.0.1/- -] [-/-
    -]com.q1labs.core.dao.wincollect.AleStoreAndForward.NAME MUST
    be public, static and not final for naming to help with setting
    of NAME
    09:07:22,424 INFO  [FrameworksNaming]
    [NOT:0000006000][127.0.0.1/- -] [-/-
    -]com.q1labs.core.dao.wincollect.AleThrottleConfiguration.NAME
    MUST be public, static and not final for naming to help with
    setting of NAME
    09:07:22,495 ERROR [ThreadExceptionHandler]
    [NOT:0000003000][127.0.0.1/- -] [-/- -]Exception was uncaught
    in thread: main
    org.springframework.beans.factory.BeanCreationException: Error
    creating bean with name 'qradarFrameworksContextService'
    defined in class path resource [appContext.xml]: Invocation of
    init method failed; nested exception is
    java.lang.NoClassDefFoundError: com.ibm.icu.text.DateFormat
            at
    org.springframework.beans.factory.support.AbstractAutowireCapabl
    eBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.j
    ava:1745)
            at
    org.springframework.beans.factory.support.AbstractAutowireCapabl
    eBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.jav
    a:576)
            at
    org.springframework.beans.factory.support.AbstractAutowireCapabl
    eBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:
    498)
            at
    org.springframework.beans.factory.support.AbstractBeanFactory.la
    mbda$doGetBean$0(AbstractBeanFactory.java:320)
            at
    org.springframework.beans.factory.support.AbstractBeanFactory$$L
    ambda$7.0000000014E93B30.getObject(Unknown Source)
            at
    org.springframework.beans.factory.support.DefaultSingletonBeanRe
    gistry.getSingleton(DefaultSingletonBeanRegistry.java:222)
            at
    org.springframework.beans.factory.support.AbstractBeanFactory.do
    GetBean(AbstractBeanFactory.java:318)
            at
    org.springframework.beans.factory.support.AbstractBeanFactory.ge
    tBean(AbstractBeanFactory.java:199)
            at
    org.springframework.beans.factory.support.DefaultListableBeanFac
    tory.preInstantiateSingletons(DefaultListableBeanFactory.java:84
    6)
            at
    org.springframework.context.support.AbstractApplicationContext.f
    inishBeanFactoryInitialization(AbstractApplicationContext.java:8
    63)
            at
    org.springframework.context.support.AbstractApplicationContext.r
    efresh(AbstractApplicationContext.java:546)
            at
    org.springframework.context.support.ClassPathXmlApplicationConte
    xt.<init>(ClassPathXmlApplicationContext.java:144)
            at
    org.springframework.context.support.ClassPathXmlApplicationConte
    xt.<init>(ClassPathXmlApplicationContext.java:85)
            at
    com.q1labs.qvm.assetupdates.Bootstrapper.initialize(Bootstrapper
    .java:42)
            at
    com.q1labs.qvm.assetupdates.Bootstrapper.main(Bootstrapper.java:
    106)
    Caused by:
    java.lang.NoClassDefFoundError: com.ibm.icu.text.DateFormat
            at java.lang.J9VMInternals.prepareClassImpl(Native
    Method)
            at
    java.lang.J9VMInternals.prepare(J9VMInternals.java:304)
            at java.lang.Class.getField(Class.java:1079)
            at
    com.q1labs.frameworks.naming.FrameworksNaming.checkNameConstant(
    FrameworksNaming.java:399)
            at
    com.q1labs.frameworks.naming.FrameworksNaming.loadClasses(Framew
    orksNaming.java:323)
            at
    com.q1labs.frameworks.naming.FrameworksNaming.loadNaming(Framewo
    rksNaming.java:171)
            at
    com.q1labs.frameworks.naming.FrameworksNaming.loadClasses(Framew
    orksNaming.java:270)
            at
    com.q1labs.frameworks.naming.FrameworksNaming.loadNaming(Framewo
    rksNaming.java:171)
            at
    com.q1labs.frameworks.naming.FrameworksNaming.loadNaming(Framewo
    rksNaming.java:105)
            at
    com.q1labs.frameworks.naming.FrameworksNaming.<init>(FrameworksN
    aming.java:86)
            at
    com.q1labs.frameworks.core.FrameworksContext.initServices(Framew
    orksContext.java:620)
            at
    com.q1labs.frameworks.core.FrameworksContext.initFrameworks(Fram
    eworksContext.java:257)
            at
    com.q1labs.qvm.assetupdates.frameworks.FrameworksContextServiceI
    mpl.retrieveFrameworkContext(FrameworksContextServiceImpl.java:3
    1)
            at sun.reflect.NativeMethodAccessorImpl.invoke0(Native
    Method)
            at
    sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessor
    Impl.java:90)
            at
    sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethod
    AccessorImpl.java:55)
            at java.lang.reflect.Method.invoke(Method.java:508)
            at
    org.springframework.beans.factory.support.AbstractAutowireCapabl
    eBeanFactory.invokeCustomInitMethod(AbstractAutowireCapableBeanF
    actory.java:1870)
            at
    org.springframework.beans.factory.support.AbstractAutowireCapabl
    eBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactor
    y.java:1813)
            at
    org.springframework.beans.factory.support.AbstractAutowireCapabl
    eBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.j
    ava:1741)
            ... 14 more
    Caused by:
    java.lang.ClassNotFoundException: com.ibm.icu.text.DateFormat
            at
    java.net.URLClassLoader.findClass(URLClassLoader.java:610)
            at
    java.lang.ClassLoader.loadClassHelper(ClassLoader.java:943)
            at java.lang.ClassLoader.loadClass(ClassLoader.java:888)
            at
    sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:349)
            at java.lang.ClassLoader.loadClass(ClassLoader.java:871)
            ... 34 more
    

Local fix

  • The classpath needs updated in the script to update the
    version of the icu4j jar file.
    Using the vi command, update the classpath setting in the
    following script:
    /opt/qvm/assetupdates/run-qvm-assetupdates.sh
    Replace line
    APP_CP=${APP_CP}:${QRADAR_JARS}/icu4j-58.2.jar
    with
    APP_CP=${APP_CP}:${QRADAR_JARS}/icu4j-65.1.jar
    

Problem summary

  • This issue was fixed in QRadar QRM QVM release of 7.4.2 FixPack
    2, 7.4.1 FixPack 2 and 7.3.3 FixPack 6.
    

Problem conclusion

  • This issue was fixed in QRadar QRM QVM release of 7.4.2 FixPack
    2, 7.4.1 FixPack 2 and 7.3.3 FixPack 6.
    

Temporary fix

Comments

APAR Information

  • APAR number

    IJ28757

  • Reported component name

    QR VULNERABILIT

  • Reported component ID

    5725QVMSW

  • Reported release

    740

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2020-10-15

  • Closed date

    2021-01-28

  • Last modified date

    2021-01-28

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QR VULNERABILIT

  • Fixed component ID

    5725QVMSW

Applicable component levels

[{"Line of Business":{"code":"LOB10","label":"Data and AI"},"Business Unit":{"code":"BU029","label":"Software"},"Product":{"code":"SSHLPS","label":"IBM QRadar Vulnerability Manager"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"740"}]

Document Information

Modified date:
29 January 2021