PH60195: OIDC v1.5.3; IBM WebSphere Application Server is vulnerable to a denial of service due to jose4j (CVE-2023-51775 CVSS 7.5)

View the Security Bulletin

When you are administering a cluster, the fix for this APAR must be applied to each cluster member. Failure to update all cluster members produces unpredictable results on both the updated and nonupdated cluster members.

•  WHAT'S NEW IN VERSION 1.5.2

  • The jose4j open source component is upgraded to the latest level: 0.9.5

  • Bug fixes

  •  WHAT'S NEW IN VERSION 1.5.1
    • Support introspection by using the UserInfo endpoint

      To use the UserInfo endpoint for introspection, set the provider_<id>.introspectMethod property to userinfo. When the provider_<id>.introspectMethod property is set to introspect (the default), the introspect endpoint is used for introspection. This new function is delivered in APAR PH55077.

    • Bug fixes

    •  WHAT'S NEW IN VERSION 1.5.0
      • Add OIDC PKCE

        The OIDC TAI is updated to support PKCE when authenticating by using the code authorization flow. This new feature is delivered in APAR PH55042.  You can configure the TAI to use PKCE by setting the provider_<id>.usePkce property to true. 

      • The jose4j open source component is upgraded to the latest level: 0.9.3

      • Serviceability enhancements

      • Bug fixes

    •  VERSION 1.4.0
      • Add regex and logical OR to the provider_<id>.filter property

        Two new operators are added to the provider_<id>.filter property: regular expression (~=) and logical OR (||). These new operators are delivered in APAR PH49279.

      • A new keyword is added to the values for the provider_<id>.useRealm property

        To use the default WebShpere realm name, set the provider_<id>.useRealm custom property to WAS_DEFAULT. This new value is delivered in APAR PH47482.

      • The default value for the provider_<id>.signatureAlgorithm property is changed to HEADER

        A new keyword called HEADER is added to the list of supported values for the When the provider_<id>.signatureAlgorithm property. When the signatureAlgorithm property is set to HEADER, the value is obtained from the header of each inbound token. Two new properties are added to support this new behavior delivered in APAR PH47272:

        • provider_<id>.signatureAllowList
          Specifies a comma-separated list of signature algorithms that are allowed to secure messages from the OpenID Connect provider. If the signatureAlgorithm property is set to a value other than HEADER, this property is ignored. This list can include any value that is supported by the jose4j open source project except HS256.
        • provider_<id>.signatureDenyList
          Specifies a comma separated list of signature algorithms that are not allowed to secure messages from the OpenID Connect provider. If the signatureAlgorithm property is set to a value other than HEADER, this property is ignored. This list can include any value that is supported by the jose4j open source project and the values are not validated by the OIDC TAI. If the configured list does not include HS256, HS256 might be added to the list.

      • Add ability to filter requests based on the issuer in the JWT

        Starting in OIDC 1.4.0, the OIDC TAI can filter inbound JWT authentication requests based on the issuer of the JWT. The following OIDC TAI custom properties are added to support this feature delivered in APAR PH44467:

        • provider_<id>.allowJwtIssuerSelection
          Set this property to true if want to allow the runtime to filter requests based on the iss claim in the JWT in the Authorization header of the HTTP request. The filter will match if the iss claim in the JWT matches this provider's issuer.

      • Add support for encrypted JWT (JWE) and idTokens

        Starting in OIDC version 1.4.0, the OpenID Connect Trust Association Interceptor can process an encrypted JWT. An encrypted JWT can be used with both the traditional OpenID Connect Relying Party and JWT Authentication. Using the OIDC RP allows an encrypted JWT to be the ID token, access token, or both. The following OIDC TAI custom properties are added to support the encrypted JWT feature delivered in APAR PH36335:

        • provider_<id>.keyStore
          Specifies the keystore from which to obtain the decrypting key.
        • provider_<id>.decryptAlias
          Specifies the alias of the keyEntry in the keystore that is used to decrypt an encrypted JWT or ID token.
        • provider_<id>.decryptKeyPassword
          Specifies the password for the decrypting key.

      • Add support for OIDC RP-Initiated logout

        The OIDC RP is updated so that it can perform an RP-Initiated logout. If configured to do so, an RP-Initiated logout is performed when HttpServeletRequest.logout() or ibm_security_logout (form logout) is invoked. Note: A fix for APAR PH48145 is required for the OIDC TAI to log out when ibm_security_logout is invoked. The following OIDC TAI custom properties are added to support this feature delivered in APAR PH48083:

        • provider_<id>.endSessionEndpointEnabled
          Set this property to true if you want to enable RP-Initiated logout with the URL specified on the provider_<id>.endSessionEndpoint property.
        • provider_<id>.endSessionRedirectUrl
          Set this property to the value for the post_logout_redirect_uri parameter on the request to the end session endpoint on the OP. The OP redirects to this URL after logout is complete.
        • provider_<id>.endSessionUseLogoutExitPage
          Set this property to true if you want to use the value for the logoutExitPage parameter on an ibm_security_logout request as the value for the post_logout_redirect_uri parameter on the end session request to the OP. This requires 8.5.5.23 or 9.0.5.14.
        • The following OidcClientHelper APIs are added:

          logout(HttpServletRequest req, HttpServletResponse rsp)
          logout(HttpServletRequest req, HttpServletResponse rsp, String endSessionRedirectUrl)
          opLogout(HttpServletRequest req, HttpServletResponse rsp, String endSessionRedirectUrl)

      • Add OidcClientHelper APIs to validate JWTs

        Starting in OIDC 1.4.0, the OIDC TAI can filter inbound JWT authentication requests based on the issuer of the JWT.The following OIDC TAI custom properties are added to support this feature delivered in APAR PH44692:

        • provider_<id>.useIssuer
          When this property is set to true, the runtime can use the provider entry to service JSON Web Token (JWT) verification requests by API.
        • The following OidcClientHelper APIs are added:

          verifyJwt(String jwtString)
          verifyJwt(String jwtString, String defaultIssuer)
          verifyJwtUsingDiscovery(String jwtString)
          verifyJwtUsingDiscovery(String jwtString, String discoveryUrl)
          verifyJwtUsingTAIConfig(String jwtString)
          verifyJwtUsingTAIConfig(String jwtString, String defaultIssuer)

•  JAVA™ 7 OR LATER IS REQUIRED

  The OIDC v1.5.2 runtime on this page requires the use of Java version 7 or later:

  • The PH60195 interim fix for WebSphere traditional v8.5.5 installs on any fix pack to which it applies.
  • When an application server is running Java 6 or earlier:
    • The OpenID Connect (OIDC) Relying Party (RP) TAI is not initialized when the server is started.
    • When the OIDC TAI was configured to intercept requests previous to installing PH60195, after installing PH60195, your previously intercepted requests will be redirected to the default form login.

•  PREREQ APARS
  APAR PH48145 is required for the OIDC TAI to complete the logout when the logout is initiated from a form logout (ibm_security_logout).  APAR PH48145 is delivered in fix packs 8.5.5.23 and 9.0.5.14.  There are no interim fixes available for APAR PH48145.

  What this means is, when an application that is protected by OIDC logs out by using a form logout, OIDC cookies aren't deleted and, if configured, RP-Initiated logout is not performed.  If your application uses form logout and you care about these two issues, you must install 8.5.5.23 or 9.0.5.14 or later to ensure that the OIDC TAI logs the user out properly.

• LIVE SERVICE REPOSITORY INSTALLATION
  If you are installing by using the IBM Installation Manager GUI, you can install an interim fix for PH60195 from the IBM live service repository instead of downloading it.  Do the following actions in the Installation Manager:

  Select File > Preferences Click 'Repositories' from the list on the left Make sure that ' Search service repositories during installation and updates' is selected: Click OK Make sure that 'Update all packages with recommended updates and recommended fixes' is not selected: Choose the WebSphere instance that you want to update. Click Next If prompted, enter your IBMid and password If you are not at the most recent fix pack level, the Update Packages window displays with the most recent fix pack preselected, for example: Do the following steps: If you are at the most recent fix pack level, do the following: Select 'Show recommended only'. Clear any recommended update that you do not want to install. Make sure that you do not clear the update for PH60195. Click Next Click Update If you are not at the most recent fix pack level, do the following: Do the following actions based on whether you want to also update your fix pack level: If you want to update to the most recent fix pack level, do the following: Click Next Go back and complete the previous steps as if you are at the most recent fix pack level. If you want to update your fix pack to a level that is not the most recent, do the following: Clear 'Show recommended only'. Select the fix pack level that you want to install. Click Next If you do not want to update your fix pack level, do the following: Clear 'Show recommended only'. Select 'Only fixes for version x.x.x.x', where x.x.x.x is your version and fix pack, for example: Click Next Clear any recommended update that you do not want to install. Make sure that you do not clear the update for PH60195, for example. Click Next Click Update

• COMMAND LINE INSTALLATION
  The fixes for PH60195 are installed by using the IBM Installation Manager. You can use the Installation Manager imcl command to install an interim fix from the command prompt.
  
  When you install an interim fix from the command prompt, you need to know the name of the fix that is contained within the interim fix file. The following table lists the fixes that are contained in each interim fix file for PH60195.

  Interim fix file	Fix names	Fix packs
  8.5.5.10-WS-WASProd-IFPH60195.zip	8.5.5.10-WS-WASProd-IFPH58024_8.5.5010.20231108_1515	8.5.5.10 through 8.5.5.24
  9.0.0.0-WS-WASProd-IFPH60195.zip	9.0.0.0-WS-WASProd-IFPH58024_9.0.0.20231108_1401	9.0.0.0 through 9.0.5.17

  
    Example command:
  The following example shows how to install a fix for PH60195 from the command line by using the imcl command:

  ./imcl install 8.5.5.10-WS-WASProd-IFPH60195_8.5.5010.20231108_1515 -installationDirectory /opt/IBM/WebSphere/AppServer -repositories /tmp/ifixes/8.5.5.10-WS-WASProd-IFPH60195.zip

  
  IBM Documentation references:
  Installing interim fixes on distributed operating systems by using the command line
  Command line arguments for the imcl command
  
   

• SUPERSEDED APAR FIXES
  The fixes for PH60195 on this page supersede the fixes published for PI47460, PI55697, PI64573, PI65751, PI74857, PI80317, PI82308, PI96508, PI82308, PH08804,  PH13175,  PH21827, PH29099, PH39666, PH49566, PH52459, and PH58024 Those fixes are removed from their pages and are replaced by these fixes for PH60195.
  
  Since the fixes for PH60195 included on this page supersede the fixes for PI47460, PI55697, PI64573, PI65751, PI74857, PI80317, PI82308, PI96508, PH08804, PH13175, PH21827, PH29099, PH39666, PH49566, PH52459, and PH50824 the Installation Manager allows it to be installed on top of any of those fixes. It is up to you to decide to uninstall or any or all of those fixes before you install a fix for PH60195.

• APPLICABLE FIX PACKS
  The OpenID Connect feature of WebSphere Application Server v855 is supported starting in fix pack 8.5.5.3.  Therefore, this APAR does not apply to, nor are interim fixes available for fix packs 8.5.5.0 through 8.5.5.2.  Also, no interim fixes are provided for 8.5.5.3 through 8.5.5.9 due to the age of the fix packs.
  
   

Keywords: IBMWL3WSS, OIDC, INTERIMFIX