Security Bulletin: IBM Kenexa LCMS Premier On Premise - CVE-2020-14782 (deferred from Oracle Oct 2020 CPU for Java 8)

Remediation/Fixes

IBM recommends updating to the latest release for customers who are using an affected version. The new version is available at IBM Passport Advantage web site.

Once on version 14.0, please proceed to download and apply the provided fix via Fix Central.

Steps to Download from Fix Central

• Log in to Fix Central (https://www-945.ibm.com/support/fixcentral/)
• Select "IBM Kenexa LCMS Premier” from the Product Selector dropdown
• Select "14.0" from the Installed version dropdown
• Select "Windows" from the Platform dropdown
• Click "Continue"
• Select "Browse for Fixes” and click "Continue"

Download the following 2 files:

• p_14.0.0058_2021-01-21_04-51.zip or above
• p_14.0.0058-NO-LCMS_JDK8.0.6.25_2021-03-10_07-16.zip 

Steps to Follow in Version 14.0 ONLY:

Perform Backups:

1. Stop LCMS Services

2. Perform Backups:

    In the LCMS installation directory, perform a backup of the existing JDK directories by renaming the Java directories ibmsdk32 and ibmsdk64.  We suggest appending "_backup” to the end. 

& Store the back-up folders in separate place/folders    

Important Note:  If the Step 1 (stopping of services) did not complete, you might have issues renaming the folders. Please ensure all LCMS services are no longer running prior to renaming/taking backup

Step 1: Deploy the latest LCMS patch: p_14.0.0058_2021-01-21_04-51.zip or above

1. Remove all plugins:

a. From ConfigWiz.exe, check "Advanced" checkbox, then click "Stop Services"

b. Move all jar and all zip files from plugin folder to somewhere else

c. From ConfigWiz.exe, click "Add/Remove Plugins".

2. Install this plugin:

a. Move or copy this plugin file into the plugin folder.

b. From ConfigWiz.exe, click "Advanced" checkbox, then click "Add/Remove Plugins"

   Note: A pop up will display to start the deployment & it will be closed automatically once done the patch deployment

Step 2: Deploy the JDK_Only patch/plugin: p_14.0.0058-NO-LCMS_JDK8.0.6.25_2021-03-10_07-16.zip [This is on-time activity]

a. Step#1 must complete to starts the JDK 8.0.6.25 upgrade

b. Add the JDK_Only patch/pligin in "plugins" folder [example: p_14.0.0058-NO-LCMS_JDK8.0.6.25_2021-03-10_07-16.zip or later patch] & LCMS patch need not be removed from plugin folder

c. From ConfigWiz.exe, click "Advanced" checkbox, then click "Add/Remove Plugins"

   Note: A pop up will display to start the deployment 

d. For plugins that have JDK upgrade: ◦ ConfigWiz.exe must be closed for JDK upgrade to complete [A popup will be displayed as an alert to close the ConfigWiz]. Anything else that might be using LCMS files or directories must also be closed.

   FYI...Steps:

   d.1. click OK on the pop-up which is related to close the ConfigWiz

   d.2. close the ConfigWiz

   Note: Once closed the configwiz, JDK upgrade will be started and the pop-up which has displayed on step#2.c will be closed automatically after completion of JDK upgrade

e. From ConfigWiz.exe, check "Advanced" checkbox, then click "Starts Services"

Special Feature with this JDK_Only patch:

Certificates which are available in "Security" folder [..\ibmsdk64\jre\lib\security] will be preserved after JDK8.0.6.25 version upgrade also [files with extension -> *.CER or *.CRT - Base64-encoded or DER-encoded binary X.509 Certificate]

Note:

1. In future, while deploying the upcoming patches, ensure JDK_Only patch/plugin deployment- "Add/Remove Plugins" needs to be run twice as part of step#1.1 [Remove all plugins]

2. Once, Step 1 & 2 are done, you will not be able to revert to the precious version of the JDK. However, applying the upcoming/future patches will only ensure that JDK is maintained with latest version or installed with upgraded version