IBM WebSphere Application Server Liberty Weaker Than Expected Security Vulnerability

A vulnerability exists in IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.2, where the Security Utility may introduce weaker than anticipated security when managing security settings. This issue is related to the use of hard-coded cryptographic keys, potentially compromising the integrity of encoded secrets.

Impact

This vulnerability could lead to inadequate security measures, allowing for potential manipulation or exposure of sensitive information that relies on the affected security settings.

Remediation

Users are advised to upgrade to IBM WebSphere Application Server Liberty Fix Pack 26.0.0.3 or later, or to apply the available interim fix that addresses APAR PH69658. Additional interim fixes may also be available.