PH70078:IBM WebSphere Application Server Liberty could provide weaker than expected security (CVE-2025-14917 CVSS 6.7)

Download Description

PH70078 resolves the following problem:

ERROR DESCRIPTION:
Confidential for Security Integrity interim fix CVE-2025-14917. 

PROBLEM SUMMARY:
Confidential for Security Integrity interim fix CVE-2025-14917. 

PROBLEM CONCLUSION:
Confidential for CVE-2025-14917.

After this fix is installed, the default LTPA keys password is removed. Before the server is started, action is required if the LTPA keys password is not set; otherwise, the LTPA service fails. Perform the following actions:

1. Check for an explicit password for the LTPA keys. An explicit LTPA keys password exists in the following two conditions:
   • A keysPassword attribute is provided for the <ltpa /> element in the server.xml file.
   • The keystore_password environment variable exists in the server.env file.

2. If an explicit password is not found, you must add the following environment variable to the server.env file:

   keystore_password=(your-desired-password)

• When the server starts, the keystore_password is used to re-encrypt the LTPA keys that were previously encrypted with the default keysPassword.

The fix for this APAR is targeted for inclusion in 26.0.0.4.

For more information, see Recommended Updates for WebSphere Application Server: https://www.ibm.com/support/pages/node/715553.