IBM Support

Security Bulletin: IBM Kenexa LCMS Premier On Premise - IBM SDK, Java Technology Edition Quarterly CPU - Oct 2020 - Includes Oracle Oct 2020 CPU

Security Bulletin


Summary

We have identified that the IBM Kenexa LCMS Premier is affected by one or more security vulnerabilities. These have been addressed in LCMS Premier 14.0 version.

Vulnerability Details

CVEID:   CVE-2020-14779
DESCRIPTION:   An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/190097 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:   CVE-2020-14792
DESCRIPTION:   An unspecified vulnerability in Java SE related to the Hotspot component could allow an unauthenticated attacker to cause low confidentiality impact, low integrity impact, and no availability impact.
CVSS Base score: 4.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/190110 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N)

CVEID:   CVE-2020-14796
DESCRIPTION:   An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors.
CVSS Base score: 3.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/190114 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N)

CVEID:   CVE-2020-14797
DESCRIPTION:   An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/190115 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID:   CVE-2020-14798
DESCRIPTION:   An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact.
CVSS Base score: 3.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/190116 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N)

Affected Products and Versions

Affected Product(s)Version(s)
IBM Kenexa LCMS Premier on premise14.0 and Below

Remediation/Fixes

IBM recommends updating to the latest release for customers who are using an affected version. The new version is available at IBM Passport Advantage web site.

Once on version 14.0, please proceed to download and apply the provided fix via Fix Central.


Steps to Download from Fix Central

  • Log in to Fix Central (https://www-945.ibm.com/support/fixcentral/)
  • Select "IBM Kenexa LCMS Premier” from the Product Selector dropdown
  • Select "14.0" from the Installed version dropdown
  • Select "Windows" from the Platform dropdown
  • Click "Continue"
  • Select "Browse for Fixes” and click "Continue"

Download the following 2 files:

  • p_14.0.0058_2021-01-21_04-51.zip or above
  • p_14.0.0058-NO-LCMS_JDK8.0.6.20_2021-01-21_05-04.zip 

Steps to Follow in Version 14.0 ONLY:

Perform Backups:

1. Stop LCMS Services

2. Perform Backups:

    In the LCMS installation directory, perform a backup of the existing JDK directories by renaming the Java directories ibmsdk32 and ibmsdk64.  We suggest appending "_backup” to the end. 

& Store the back-up folders in separate place/folders    


Important Note:  If the Step 1 (stopping of services) did not complete, you might have issues renaming the folders. Please ensure all LCMS services are no longer running prior to renaming/taking backup


 

Step 1: Deploy the latest LCMS patch: p_14.0.0058_2021-01-21_04-51.zip or above

 

1. Remove all plugins:

a. From ConfigWiz.exe, check "Advanced" checkbox, then click "Stop Services"

b. Move all jar and all zip files from plugin folder to somewhere else

c. From ConfigWiz.exe, click "Add/Remove Plugins".

 

2. Install this plugin:

a. Move or copy this plugin file into the plugin folder.

b. From ConfigWiz.exe, click "Advanced" checkbox, then click "Add/Remove Plugins"

   Note: A pop up will display to start the deployment & it will be closed automatically once done the patch deployment

 

Step 2: Deploy the JDK_Only patch/plugin: p_14.0.0058-NO-LCMS_JDK8.0.6.20_2021-01-21_05-04.zip [This is on-time activity]

 

a. Step#1 must complete to starts the JDK 8.0.6.20 upgrade

b. Add the JDK_Only patch/pligin in "plugins" folder [example: p_14.0.0058-NO-LCMS_JDK8.0.6.20_2021-01-21_05-04.zip or later patch] & LCMS patch need not be removed from plugin folder

c. From ConfigWiz.exe, click "Advanced" checkbox, then click "Add/Remove Plugins"

   Note: A pop up will display to start the deployment 

d. For plugins that have JDK upgrade: ◦ ConfigWiz.exe must be closed for JDK upgrade to complete [A popup will be displayed as an alert to close the ConfigWiz]. Anything else that might be using LCMS files or directories must also be closed.

   FYI...Steps:

   d.1. click OK on the pop-up which is related to close the ConfigWiz

   d.2. close the ConfigWiz

   Note: Once closed the configwiz, JDK upgrade will be started and the pop-up which has displayed on step#2.c will be closed automatically after completion of JDK upgrade

e. From ConfigWiz.exe, check "Advanced" checkbox, then click "Starts Services"

 

Special Feature with this JDK_Only patch:

Certificates which has avaibale in "Secuirty" folder [..\ibmsdk64\jre\lib\security] will be preserved after JDK8.0.6.20 version upgrade also [files with extension -> *.CER or *.CRT - Base64-encoded or DER-encoded binary X.509 Certificate]

 

Note:

1. In future, while deploying the upcoming patches, ensure JDK_Only patch/plugin deployment- "Add/Remove Plugins" needs to be run twice as part of step#1.1 [Remove all plugins]

2. Once, Step 1 & 2 are done, you will not be able to revert to the precious version of the JDK. However, applying the upcoming/future patches will only ensure that JDK is maintained with latest version or installed with upgraded version

Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

References

Off

Change History

19 Feb 2021: Initial Publication

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Document Location

Worldwide

[{"Business Unit":{"code":"BU006","label":"Kenexa (Talent Management)"},"Product":{"code":"SSDN47","label":"IBM Kenexa LCMS Premier"},"Component":"","Platform":[{"code":"PF033","label":"Windows"}],"Version":"LCMS Premier 14.0 and Below","Edition":""}]

Document Information

Modified date:
22 February 2021

UID

ibm16416443