Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum Conductor

Remediation/Fixes

Before installation

1. Log in to the cluster management console as the cluster administrator and stop all Spark instance groups.
2. Log on to the primary management host as the cluster administrator:
   > egosh user logon -u Admin -x Admin
3. Stop all services and shut down the cluster:
   > egosh service stop all
   > egosh ego shutdown all

Installation

1. Log on to each host in your cluster (root or sudo to root permission).
2. Define the CLUSTERADMIN environment variable and set it to any valid operating user account, which then owns all installation files. For example:
   > export CLUSTERADMIN=egoadmin
3. Upgrade the JRE by using the RPM in this interim fix.
   NOTE: RPM version 4.2.1 or later must be installed on the host. Ensure that you replace dbpath_location in the following RPM commands with the path to your database.

   For IBM Spectrum Conductor with Spark 2.2.0, take Linux x86_64 as example
   > mkdir -p /tmp/cws22build504322
   > tar zxof cws-2.2.0.0_x86_64_build504322.tgz -C /tmp/cws22build504322
   > rpm -ivh --replacefiles --prefix $EGO_TOP --dbpath dbpath_location /tmp/cws22build504322/egojre-8.0.5.22.x86_64.rpm
   For IBM Spectrum Conductor with Spark 2.2.1, take Linux x86_64 as example:
   > mkdir -p /tmp/cws221build504323
   > tar zxof cws-2.2.1.0_x86_64_build504323.tgz -C /tmp/cws221build504323
   > rpm -ivh --replacefiles --prefix $EGO_TOP --dbpath dbpath_location /tmp/cws221build504323/egojre-8.0.5.22.x86_64.rpm

   For IBM Spectrum Conductor 2.3.0, take Linux x86_64 as example:
   > mkdir -p /tmp/sc230build504324
   > tar zxof conductor-2.3.0.0_x86_64_build504324.tgz -C /tmp/sc230build504324
   > rpm -ivh --replacefiles --prefix $EGO_TOP --dbpath dbpath_location /tmp/sc230build504324/egojre-8.0.5.22.x86_64.rpm 
4. The cshrc.jre and profile.jre files are updated to the current JRE version. If you made copies of these files, ensure that you update the copied files with the new JRE version.
5. Source the cluster profile again and start the cluster:
   > egosh ego start all
6. Log in to the cluster management console as the cluster administrator and start the required Spark instance groups.

Verify the installation

Run the rpm –qa command to verify the installation.

For IBM Spectrum Conductor with Spark 2.2.0, enter:
> rpm -qa --dbpath dbpath_location |grep egojre
  egojre-8.0.5.22-504322.x86_64

For IBM Spectrum Conductor with Spark 2.2.1, enter:
> rpm -qa --dbpath dbpath_location |grep egojre
  egojre-8.0.5.22-504323.x86_64

For IBM Spectrum Conductor 2.3.0, enter:
> rpm -qa --dbpath dbpath_location |grep egojre
  egojre-8.0.5.22-504324.x86_64

Uninstallation (if required)

1. Log in to the cluster management console as the cluster administrator and stop all Spark instance groups.
2. Log on to the primary management host as the cluster administrator:
   > egosh user logon -u Admin -x Admin
3. Stop services and shut down the cluster:
   > egosh service stop all
   > egosh ego shutdown all
4. Log on to each host in your cluster (root or sudo to root permission).
5. Define the CLUSTERADMIN environment variable and set it to any valid operating user account, which then owns all installation files. For example:
   > export CLUSTERADMIN=egoadmin
6. Uninstall the existing JRE and then install the old JRE.
   NOTE: RPM version 4.2.1 or later must be installed on the host. 
   Ensure that you replace dbpath_location in the following RPM commands with the path to your database.

   For IBM Spectrum Conductor with Spark 2.2.0, enter:
   > rpm -e egojre-8.0.5.22-504322.x86_64 --dbpath dbpath_location --nodeps
   > rpm -qa --dbpath dbpath_location |grep egojre
   For each previous egojre rpm, run:
   > rpm -e [egojre_name] --dbpath dbpath_location --nodeps
   Then, install the old JRE:
   > mkdir -p /tmp/extract22
   > cws-2.2.0.0_x86_64.bin --extract /tmp/extract22
   > rpm -ivh --prefix $EGO_TOP --dbpath dbpath_location /tmp/extract22/egojre-*.rpm
   For IBM Spectrum Conductor with Spark 2.2.1, enter:
   > rpm -e egojre-8.0.5.22-504323.x86_64 --dbpath dbpath_location --nodeps
   > rpm -qa --dbpath dbpath_location |grep egojre
   For each previous egojre rpm, run:
   > rpm -e [egojre_name] --dbpath dbpath_location --nodeps
   Then, install the old JRE:
   > mkdir -p /tmp/extract221
   > cws-2.2.1.0_x86_64.bin --extract /tmp/extract221
   > rpm -ivh --prefix $EGO_TOP --dbpath dbpath_location /tmp/extract221/egojre-*.rpm

   For IBM Spectrum Conductor 2.3.0, enter:
   > rpm -e egojre-8.0.5.22-504324.x86_64 --dbpath dbpath_location --nodeps
   > rpm -qa --dbpath dbpath_location |grep egojre
   For each previous egojre rpm, run:
   > rpm -e [egojre_name] --dbpath dbpath_location --nodeps
   Then, install the old JRE:
   > mkdir -p /tmp/extract23
   > conductor2.3.0.0_x86_64.bin --extract /tmp/extract23
   > rpm -ivh --prefix $EGO_TOP --dbpath dbpath_location /tmp/extract23/egojre-*.rpm
7. Source the cluster profile and start the cluster:
   > egosh ego start all
8. Log in to the cluster management console as the cluster administrator and start the required Spark instance groups.

Packages