Fix Readme
Abstract
This readme file provides important information about Security Fix Pack 6 2022.12 for Dynamic Workload Console version 9.5.
Content
Note
Before using this information and the product it supports, read the information in Notices.
This edition applies to Fix Pack 6 security for version 9, release 5, modification level 0 of IBM Dynamic Workload Console.
Dynamic Workload Console version 9.5.0 Readme File for Fix Pack 6 Security 2022.12
- Date
- Dec 16, 2022
- Fix Pack Name
- 9.5.0 fix pack 6 security -IBM-DWC-FP0006
- Product
- IBM Dynamic Workload Console version 9.5.0 fix pack 6 security
- General Description
- IBM Dynamic Workload Console Fix Pack 6 security for version 9.5.0
- Security pack
- IBM V9.5 Fix Pack 6 Security is a security update of V9.5 Fix Pack 6, released in June 2022. If you already installed V9.5 Fix Pack 6 and apply the security update, the version is the same as the previous one (9.5.0.06), but the build date is changed.
This readme file provides important information about Fix Pack 6 security for IBM Dynamic Workload Console version 9.5.0. Fix Pack 6 security
This readme file is the most current information for the fix pack and takes precedence over all other documentation for Dynamic Workload Console version 9.5.0 Fix Pack 6 security.
The most up-to-date version of this readme can be accessed at the following URL: Fix Pack readmes.
IBM Dynamic Workload Console version 9.5.0 Fix Pack 6 Security supports all product versions indicated in the Dynamic Workload Console Version 9.5 Release Notes.
For the most up-to-date information about supported operating systems, software and hardware requirements, see the Dynamic Workload Console Detailed System Requirements.
Review the following sections thoroughly before installing or using this fix pack.
About this Fix Pack
This section contains information specific for this Fix Pack including what has been modified or introduced, what has been fixed, product versions or components to which the Fix Pack applies, and compatibility issues, if any.
This section includes the following subsections:
Features introduced with Fix Pack 6 Security
- Version 9.5 Fix Pack 6 Security delivers the following enhancements:
- Changed features and feature capabilities
- CVE-2022-31160
- CVE-2022-27664
- CVE-2022-32149
- CVE-2022-36033
- CVE-2022-42003
APARs and defects fixed in IBM Dynamic Workload Console Fix Pack 6 Security for version 9.5.0
This section lists APARs and internal defects resolved by Fix Pack 6.Security
APAR | ABSTRACT |
---|---|
IJ43867 |
DWC PENETRATION CONDUCTED AND REMEDIATION REQUIRED |
IJ44020 |
AUTHENTICATED XXE VULNERABILITY IN IBM TIVOLI WORKLOAD SCHEDULER |
IJ36579 |
IT IS OBSERVED THAT APPLICATION IS VULNERABLE TO HOST HEADER INJECTION |
IJ43726 |
CREDENTIALS AUTO UPDATE WITH LOGIN USER ID |
IJ44019 |
IBM SDK, JAVA TECHNOLOGY EDITION QUARTERLY CPU - APR 2022 - INCLUDES ORACLE APRIL 2022 |
IJ43699 |
XSS EXPLOITATION IS OCCURRING ON THE LOGIN PAGE |
DEFECT | ABSTRACT |
---|---|
WA-110627 |
[APPSCAN-IAST] : 9.5FP6 SECURITY : CRYPTOGRAPHY.POORENTROPY |
WA-110251 |
[APPSCAN-IAST] : 9.5FP6 SECURITY : PATHTRAVERSAL |
WA-110243 |
[APPSCAN-IAST] : 9.5FP6 SECURITY : CRYPTOGRAPHY.INSECUREALGORITHM |
WA-110242 |
[APPSCAN-IAST] : 9.5FP6 SECURITY : CRYPTOGRAPHY.INSECUREALGORITHM |
WA-110185 |
[APPSCAN STANDARD] COOKIE WITH INSECURE OR IMPROPER OR MISSING SAME SITE ATTRIBUTE |
WA-104021 |
[APPSCAN STANDARD] MISSING OR INSECURE "X-XSS-PROTECTION" HEADER WITH PARTICULAR URL |
WA-103880 |
[APPSCAN STANDARD] MISSING OR INSECURE "SCRIPT-SRC" POLICY IN "CONTENT-SECURITY-POLICY" HEADER |
WA-103203 |
[APPSCAN STANDARD] MISSING OR INSECURE HTTP STRICT-TRANSPORT-SECURITY HEADER |
WA-103201 |
[APPSCAN STANDARD] MISSING OR INSECURE "X-CONTENT-TYPE-OPTIONS" HEADER |
WA-103200 |
[APPSCAN STANDARD] MISSING "CONTENT-SECURITY-POLICY" HEADER |
WA-110085 |
XSS IN JOB DEFINITION DESCRIPTION FIELD - LIST WORKLOAD DEFINITION |
WA-107825 |
9.5 FP6 - DWCINST , --SKIPCHECKPREREQ IN PROPERTY FILE MUST BE SPECIFIED IN UPPERCASE |
WA-111328 |
ADD AIX 7.3 ON CHECK PREREQ |
WA-111295 |
PREDEFINED REPORT : DELETE POPUP IS NOT CLOSING AFTER CLICK ON OKAY |
WA-111253 |
IN MONITOR WORKLOAD, WHEN WE FILTER WITH JOB SECOND TIME. IT IS NOT SHOWING ENGINE, DEFAULT. WHICH WE SELECTED FIRST TIME |
WA-111265 |
WHEN WE OPEN DEFINITION THROUGH VIEW PRODUCTION PLAN THEN IT IS SHOWING BLANK |
WA-110979 |
RERUN, PRIORITY, PROPERTIES BUTTONS ARE NOT WORKING IN MONITOR WORKLOAD |
WA-110977 |
ENGINE CONNECTION SUCCESSFUL BUT WHEN OPEN WORKLOAD DEFINITION PAGE, IT'S SHOWING ERROR |
WA-110831 |
PERSONALIZED REPORTS PAGE IS SHOWING BLANK |
WA-111244 |
WORKSTATION WORKLOAD SUMMARY REPORT IS NOT SAVING WHEN WE R TRYING TO GIVE THIS AS DESCRIPTION " #$@(*&)3245879SDFGHJ:;AKFLHALFKAFALKFAFHASLFSAFHSALKFHALFAHFALKFHALKFHSAFOITQYTQOIYTQOIYQOWIYROQI ", EVEN IT IS NOT THROWING ANY ERROR/WARNING MESSAGE ALSO |
WA-111297 |
PREDEFINED REPORT: IF USER PROVIDE ANY JOB NAME WHILE CREATING JOB RUN HISTORY THEN WHILE EDITING GETTING ERROR FOR NOT VALID CHARACTER FOR FRENCH LANGUAGE |
Known limitations and workarounds
The following are software limitations and workarounds that affect Dynamic Workload Console version 9.5.0 Fix Pack 6 Security. For a list of known problems and limitations documented for the V9.5 General Availability release, refer to the Dynamic Workload Console Release Notes.
9.5 Fix Pack 6 Security
- WebSphere Liberty minimum required version
- the minimum required WebSphere Liberty version to successfully install the fixpack is 22.0.0.3
Fix Pack structure
This section describes the structure of the images contained in this Fix Pack.
Fix pack files available for IBM Workload Scheduler using FixCentral
+---9.5.0-IBM-DWC-README-FP0006-Security-202212.zip
|
+---9.5.0-IBM-DWC-AIX-FP0006-Security-202212.zip
|
+---9.5.0-IBM-IWS-console-container-s390x-FP0006-Security-202212
|
+---9.5.0-IBM-DWC-LINUX390-FP0006-Security-202212.zip
|
+---9.5.0-IBM-DWC-LINUX_X86_64-FP0006-Security-202212.zip
|
+---9.5.0-IBM-DWC-WINDOWS_X86_64-FP0006-Security-202212.zip
|
+---9.5.0-IBM-IWS-console-container-FP0006-Security-202212
|
+---9.5.0-IBM-IWS-DWC_Zsystem-FP0006-Security-202212.tar
|
+---9.5.0-IBM-IWS_OpenShift_Server_UI_Agent_FP0006-Security-202212.zip
Installing the Fix Pack
This section describes how to apply Fix Pack 6 Security to Dynamic Workload Console.
- The Dynamic Workload Console is active.
- No user is connected to the Dynamic Workload Console to prevent the data related to their working session from being lost.
Installation notes
Read this section thoroughly before installing this Fix Pack.
- Before installing the Fix Pack, ensure you have installed the required prerequisite software. To obtain the latest information about software requirements for IBM Workload Scheduler, run the Software Requirements report and browse to the relevant section.
-
- Supported WebSphere Application Server Liberty Base versions
- The minimum required WebSphere Liberty version to successfully install the fixpack is 22.0.0.3 or later.
- On UNIX systems only: Before installing either the Dynamic Workload Console version 9.5 or this Fix Pack, make sure that umask is set to 022. To verify that umask is set to the correct value, from a command prompt, run the umask command. If the value is different from 022, modify it by running the command:
umask 022
- If you plan to connect the Dynamic Workload Console version 9.5 Fix Pack 1 to a z/OS engine, ensure the following APAR for the z/OS platform is installed if you plan to use the two new columns in the DB2 reports (SUBSYSTEM NAME and WORKSTATON TYPE):
- PH12689
- Support for multiple controller for DB2 reporting and new keywords added to JOBREC statement.
Interoperability notes
Dynamic Workload Console version 9.5.0 Fix Pack 6 Security supports all product versions indicated in the Dynamic Workload Console version 9.5 Release Notes which can be accessed at the following link: Dynamic Workload Console Release Notes.
Installation methods
- You can install directly the Dynamic Workload Console General Availability version 9.5 together with the latest fix pack level, as described in Installing from the CLI in Planning and Installation Guide.
- You can update the Dynamic Workload Console from General Availability version 9.5 to the latest fix pack level, as described in Updating the Dynamic Workload Console to the latest Fix Pack level in Planning and Installation Guide.
- You can upgrade the Dynamic Workload Console from version 9.3 or later to General Availability version 9.5 and then update to the latest fix pack level, as described in the following topics in Planning and Installation Guide:
-
You can install the Dynamic Workload Console version 9.5 Fix Pack 6 Security as fresh install for more information. For further information, see Installing IBM Workload Scheduler.
If necessary, you can also return to a previous product version level, as described in Returning the Dynamic Workload Console to a previous product version level in Planning and Installation Guide.
Configuring your master domain manager in SSL mode
- Install the master domain manager or upgrade your current master domain manager to version 9.5.0.6 Security pack
- Replace the values of the following parameters in the localopts file with the following values:
- nm SSL full port = 31113
- SSL key =TWA_home/TWS/ssl/OpenSSL/TWSClient.key
- SSL certificate = TWA_home/TWS/ssl/OpenSSL/TWSClient.cer
- SSL key pwd = TWA_home/TWS/ssl/OpenSSL/password.sth
- SSL CA certificate = TWA_home/TWS/ssl/OpenSSL/TWSTrustCertificates.cer
- SSL random seed =TWA_home/TWS/ssl/OpenSSL/TWS.rnd
- SSL Encryption Cipher = TLSv1.2
- Modify the master domain manager and broker using the composer mod command, as follows:
CCPUNAME your_master_domain_manager_workstation DESCRIPTION "MANAGER CPU" OS UNIX NODE localhost TCPADDR 31111 SECUREADDR 31113 DOMAIN MASTERDM FOR MAESTRO TYPE MANAGER AUTOLINK ON BEHINDFIREWALL OFF SECURITYLEVEL FORCE_ENABLED FULLSTATUS ON END
CPUNAME your_broker_workstation DESCRIPTION "This workstation was automatically created." OS OTHER NODE localhost TCPADDR 41114 SECUREADDR 41114 DOMAIN MASTERDM FOR MAESTRO TYPE BROKER AUTOLINK ON BEHINDFIREWALL OFF SECURITYLEVEL FORCE_ENABLED FULLSTATUS OFF END
- Modify the Broker.Workstation.PortSSL parameter in the BrokerWorkstation.properties file from false to true.
The Broker.Workstation.PortSSL parameter specifies the port used by the broker server to listen to the incoming traffic (equivalent to the Netman port) in SSL mode. It is first assigned at installation time. This port number must always be the same for all the broker servers that you define in your IBM Workload Scheduler network (one with the master domain manager and one with every backup master domain manager you install) to ensure consistency when you switch masters.
- Stop and start WebSphere Application Server Liberty Base, as described in Application server - starting and stopping.
- Stop and start all IBM Workload Scheduler processes.
- Run
Jnextplan -for 0000
Disk space requirements
Before starting the Fix Pack installation, ensure that you have the following space available in the file system. The values indicated in the table show the disk space required by the Dynamic Workload Console alone. For the disk space required by other components, see the relevant documentation.
To obtain the latest information about permanent disk space requirements when installing IBM Workload Scheduler on supported operating systems, run the Hardware requirements report and click on the relevant operating system link
Operating System | Installation directory | Temporary directory |
---|---|---|
AIX® | 2 GB | 800 MB |
Linux s390x | 2 GB | 800 MB |
Linux x86-64 | 2 GB | 800 MB |
Windows 64 | 2,5 GB | 1 GB |
/usr
file system.If the installation fails because of lack of free disk space, you must stop the installation, free space on your disk, and start the installation again.
Documentation updates for IBM Dynamic Workload Console Fix Pack 6 Security, version 9.5.0
Any additions or changes to the documentation as a result of this Fix Pack have been integrated into the online product documentation available in IBM Documentation.
Contacting IBM Software Support
Before contacting IBM Software Support with a problem, refer to the IBM Software Support site by accessing the following Web address: http://www.ibm.com/software/support
To access IBM support, click the IBM support link at the bottom right of the page.
If you want to contact IBM Software Support, see the IBM Software Support Handbook at the following Web site: http://techsupport.services.ibm.com/guides/handbook.html
- Registration and eligibility.
- Telephone numbers, depending on the country in which you are located.
- Information you must have before contacting IBM Software Support.
Notices
This information was developed for products and services offered in the US. This material might be available from IBM in other languages. However, you may be required to own a copy of the product or product version in that language in order to access it.
IBM may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user's responsibility to evaluate and verify the operation of any non-IBM product, program, or service.
IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not grant you any license to these patents. You can send license inquiries, in writing, to:
IBM Director of Licensing
IBM Corporation
North Castle Drive, MD-NC119
Armonk, NY 10504-1785
US
For license inquiries regarding double-byte character set (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to:
Intellectual Property Licensing
Legal and Intellectual Property Law
IBM Japan Ltd.
19-21, Nihonbashi-Hakozakicho, Chuo-ku
Tokyo 103-8510, Japan
INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some jurisdictions do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you.
This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice.
Any references in this information to non-IBM websites are provided for convenience only and do not in any manner serve as an endorsement of those websites. The materials at those websites are not part of the materials for this IBM product and use of those websites is at your own risk.
IBM may use or distribute any of the information you provide in any way it believes appropriate without incurring any obligation to you.
Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged, should contact:
IBM Director of Licensing
IBM Corporation
North Castle Drive, MD-NC119
Armonk, NY 10504-1785
US
Such information may be available, subject to appropriate terms and conditions, including in some cases, payment of a fee.
The licensed program described in this document and all licensed material available for it are provided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement or any equivalent agreement between us.
The performance data discussed herein is presented as derived under specific operating conditions. Actual results may vary.
Information concerning non-IBM products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-IBM products. Questions on the capabilities of non-IBM products should be addressed to the suppliers of those products.
This information is for planning purposes only. The information herein is subject to change before the products described become available.
This information contains examples of data and reports used in daily business operations. To illustrate them as completely as possible, the examples include the names of individuals, companies, brands, and products. All of these names are fictitious and any similarity to actual people or business enterprises is entirely coincidental.
COPYRIGHT LICENSE:
This information contains sample application programs in source language, which illustrate programming techniques on various operating platforms. You may copy, modify, and distribute these sample programs in any form without payment to IBM, for the purposes of developing, using, marketing or distributing application programs conforming to the application programming interface for the operating platform for which the sample programs are written. These examples have not been thoroughly tested under all conditions. IBM, therefore, cannot guarantee or imply reliability, serviceability, or function of these programs. The sample programs are provided "AS IS", without warranty of any kind. IBM shall not be liable for any damages arising out of your use of the sample programs.
© (IBM) (2022).
Portions of this code are derived from IBM Sample Programs.
© Copyright IBM Corp. _2022_.
Trademarks
IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the web at "Copyright and trademark information" at www.ibm.com/legal/copytrade.shtml.
Adobe™, the Adobe logo, PostScript™, and the PostScript logo are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States, and/or other countries.
IT Infrastructure Library™ is a Registered Trade Mark of AXELOS Limited.
Linear Tape-Open™, LTO™, the LTO Logo, Ultrium™, and the Ultrium logo are trademarks of HP, IBM Corp. and Quantum in the U.S. and other countries.
Intel™, Intel logo, Intel Inside™, Intel Inside logo, Intel Centrino™, Intel Centrino logo, Celeron™, Intel Xeon™, Intel SpeedStep™, Itanium™, and Pentium™ are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries.
Linux™ is a registered trademark of Linus Torvalds in the United States, other countries, or both.
Microsoft™, Windows™, Windows NT™, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both.
![]() |
Java™ and all Java-based trademarks and logos are trademarks or registered trademarks of Oracle and/or its affiliates. |
Cell Broadband Engine™ is a trademark of Sony Computer Entertainment, Inc. in the United States, other countries, or both and is used under license therefrom.
ITIL™ is a Registered Trade Mark of AXELOS Limited.
UNIX™ is a registered trademark of The Open Group in the United States and other countries.
Terms and conditions for product documentation
Permissions for the use of these publications are granted subject to the following terms and conditions.
Applicability
These terms and conditions are in addition to any terms of use for the IBM website.
Personal use
You may reproduce these publications for your personal, noncommercial use provided that all proprietary notices are preserved. You may not distribute, display or make derivative work of these publications, or any portion thereof, without the express consent of IBM.
Commercial use
You may reproduce, distribute and display these publications solely within your enterprise provided that all proprietary notices are preserved. You may not make derivative works of these publications, or reproduce, distribute or display these publications or any portion thereof outside your enterprise, without the express consent of IBM.
Rights
Except as expressly granted in this permission, no other permissions, licenses or rights are granted, either express or implied, to the publications or any information, data, software or other intellectual property contained therein.
IBM reserves the right to withdraw the permissions granted herein whenever, in its discretion, the use of the publications is detrimental to its interest or, as determined by IBM, the above instructions are not being properly followed.
You may not download, export or re-export this information except in full compliance with all applicable laws and regulations, including all United States export laws and regulations.
IBM MAKES NO GUARANTEE ABOUT THE CONTENT OF THESE PUBLICATIONS. THE PUBLICATIONS ARE PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE.
Was this topic helpful?
Document Information
Modified date:
27 April 2023
UID
ibm16848493