Readme File for IBM® Spectrum Symphony 7.2.0.2 Interim Fix 535375
Readme file for: IBM Spectrum Symphony
Product/Component Release: 7.2.0.2
Update Name: Interim Fix 535375
Fix ID: sym-7.2.0.2-build535375
Publication date: December 16, 2019
This readme file provides guidance on upgrading the Jackson databind, core, and annotations packages to version 2.10.1 in IBM Spectrum Symphony 7.2.0.2 in order to fix security vulnerabilities CVE-2019-16942, CVE-2019-16943, CVE-2019-17267, and CVE-2019-17531.
Contents
1. List of fixes
2. Download location
3. Products or components affected
4. Installation and configuration
5. Uninstallation
6. Product notifications
7. Copyright and trademark information
1. List of fixes
APAR: P103344
2. Download location
Download interim fix 535375 from the following location: https://www.ibm.com/eserver/support/fixes/
3. Products or components affected
Component name, Platform, Fix ID:
PERF/MapReduce, Linux-x86_64, sym-7.2.0.2-build535375
4. Installation and configuration
Follow these steps to upgrade Jackson databind, core, and annotations .jar files in an IBM Spectrum Symphony 7.2.0.2 cluster:
a.
Log on to
the master host as the cluster administrator and stop the following services:
> egosh user logon -u Admin -x Admin
> egosh service stop MRSS plc purger
b.
On each management
and compute host in the cluster, download the following packages:
•
jackson-databind-2.10.1.jar (https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-databind/2.10.1)
•
jackson-core-2.10.1.jar (https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-core/2.10.1)
•
jackson-annotations-2.10.1.jar (https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-annotations/2.10.1)
c.
On each
management and compute host, move the following files to a backup directory for
recovery purposes:
> mkdir -p /tmp/hadoop-2.7.x/
> mkdir -p /tmp/guilib/
> mv $EGO_TOP/soam/mapreduce/7.2/linux-x86_64/lib/hadoop-2.7.x/jackson-annotations-2.2.3.jar /tmp/hadoop-2.7.x/
> mv $EGO_TOP/soam/mapreduce/7.2/linux-x86_64/lib/hadoop-2.7.x/jackson-core-2.2.3.jar /tmp/hadoop-2.7.x/
> mv $EGO_TOP/soam/mapreduce/7.2/linux-x86_64/lib/hadoop-2.7.x/jackson-databind-2.2.3.jar /tmp/hadoop-2.7.x/
> mv $EGO_TOP/wlp/usr/servers/gui/apps/ego/3.6/platformv5/WEB-INF/lib/jackson-annotations-2.8.0.jar /tmp/guilib/
> mv $EGO_TOP/wlp/usr/servers/gui/apps/ego/3.6/platformv5/WEB-INF/lib/jackson-core-2.8.7.jar /tmp/guilib/
> mv
$EGO_TOP/wlp/usr/servers/gui/apps/ego/3.6/platformv5/WEB-INF/lib/jackson-databind-2.8.7.jar
/tmp/guilib/
d.
On each
management and compute host, copy the following files to your cluster:
> cp -rf jackson-databind-2.10.1.jar $EGO_TOP/soam/mapreduce/7.2/linux-x86_64/lib/hadoop-2.7.x/
> cp -rf jackson-core-2.10.1.jar $EGO_TOP/soam/mapreduce/7.2/linux-x86_64/lib/hadoop-2.7.x/
> cp -rf jackson-annotations-2.10.1.jar $EGO_TOP/soam/mapreduce/7.2/linux-x86_64/lib/hadoop-2.7.x/
> cp -rf jackson-databind-2.10.1.jar $EGO_TOP/wlp/usr/servers/gui/apps/ego/3.6/platformv5/WEB-INF/lib/
> cp -rf jackson-core-2.10.1.jar $EGO_TOP/wlp/usr/servers/gui/apps/ego/3.6/platformv5/WEB-INF/lib/
> cp
-rf jackson-annotations-2.10.1.jar
$EGO_TOP/wlp/usr/servers/gui/apps/ego/3.6/platformv5/WEB-INF/lib/
NOTE: To avoid compatibility issues, move all old files to another directory altogether.
e.
From the
master host, start the following services:
> egosh user logon -u Admin -x Admin
> egosh service start MRSS plc purger
5. Uninstallation
If required, follow these steps to uninstall the upgraded .jar files in an IBM Spectrum Symphony 7.2.0.2 cluster:
a.
Log on to
the master host as the cluster administrator and stop the following services:
> egosh user logon -u Admin -x Admin
> egosh service stop MRSS plc purger
b.
On each
management and compute host, remove the following files that were introduced by
this interim fix:
> rm
-rf
$EGO_TOP/soam/mapreduce/7.2/linux-x86_64/lib/hadoop-2.7.x/jackson-databind-2.10.1.jar
> rm
-rf
$EGO_TOP/soam/mapreduce/7.2/linux-x86_64/lib/hadoop-2.7.x/jackson-core-2.10.1.jar
> rm
-rf
$EGO_TOP/soam/mapreduce/7.2/linux-x86_64/lib/hadoop-2.7.x/jackson-annotations-2.10.1.jar
> rm
-rf
$EGO_TOP/wlp/usr/servers/gui/apps/ego/3.6/platformv5/WEB-INF/lib/jackson-databind-2.10.1.jar
> rm
-rf $EGO_TOP/wlp/usr/servers/gui/apps/ego/3.6/platformv5/WEB-INF/lib/jackson-core-2.10.1.jar
> rm -rf $EGO_TOP/wlp/usr/servers/gui/apps/ego/3.6/platformv5/WEB-INF/lib/jackson-annotations-2.10.1.jar
c.
On each
management and compute host, restore the following files from your backup:
> mv
/tmp/hadoop-2.7.x/*.jar $EGO_TOP/soam/mapreduce/7.2/linux-x86_64/lib/hadoop-2.7.x/
> mv
/tmp/guilib/*
$EGO_TOP/wlp/usr/servers/gui/apps/ego/3.6/platformv5/WEB-INF/lib/
d.
From the
master host, start the following services:
> egosh user logon -u Admin -x Admin
> egosh service start MRSS plc purger
6. Product notifications
To receive information about product solution and patch updates automatically, subscribe to product notifications on the My Notifications page http://www.ibm.com/support/mynotifications/ on the IBM Support website (http://support.ibm.com). You can edit your subscription settings to choose the types of information you want to get notification about, for example, security bulletins, fixes, troubleshooting, and product enhancements or documentation changes.
7. Copyright and trademark information
© Copyright IBM Corporation 2019
U.S. Government Users Restricted Rights - Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.
IBM®, the IBM logo and ibm.com® are trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at www.ibm.com/legal/copytrade.shtml.