Security Bulletin: Vulnerability in IBM Java Runtime affect DB2 Recovery Expert for Linux, Unix and Windows(IBM SDK, Java Technology Edition Quarterly CPU - Jul 2019 - Includes Oracle Jul 2019 CPU) )

Workarounds and Mitigations

There are no workarounds except to replace to the latest JRE.
To solve the problem without updating the entire Recovery Expert product, the user can replace the existing JRE that is installed into the product installation tree in the “jre” directory with a newer JRE that includes the security fixes.

Instructions to replace the IBM JRE for DB2 Recovery Expert for Linux, UNIX and Windows

1. Identify the version and platform of your DB2 Recovery Expert installation.
2. See the table below to find the IBM JRE download link that matches your product version and platform. If you cannot find a JRE download link for your product version and platform, contact IBM Technical Support and refer to this tech-note
3. Download the zip file (for example: ibm-java-jre-x.x-x.x-linux-x86_64.tgz) and extract it to a folder on a local file system (for example: /tmp/ibm-jre-x.x-x.x).
4. Stop the DB2 Recovery Expert server using the stop.sh command (for example: /opt/ibm/RE/stop.sh).
5. Back-up and then delete the contents of the “jre” folder from your product installation directory (for example: /opt/ibm/RE/jre).
6. Copy the contents of the “jre” folder from the latest IBM JRE that you downloaded in Step 3 (for example: /tmp/ibm-jre-x.x-x.x/jre/) to the “jre” folder in your product installation directory (for example: /opt/ibm/RE/jre/).*
7. Ensure that the file permissions for the new JRE files and folders match the file permissions for the original JRE files and folders. If necessary, set 775 recursively.
8. Restart the DB2 Recovery Expert server using the start.sh command (for example: /opt/ibm/RE/start.sh).

* NOTE: You must repeat from Step 6 again any time you install an APAR or upgrade to an affected version of DB2 Recovery Expert.