weblogic10.3.6最新补丁 【2022-1-18日】发布的最新补丁

Oracle� WLS Patch Set Update 10.3.6.0.220118 README --------------------------------------------------- This README provides information about how to apply WLS Patch Set Update 10.3.6.0.220118. It also provides information about reverting to the original version. Oracle recommends that you see following key notes - My Oracle Support NOTE: 1306505.1 Announcing Oracle WebLogic Server PSUs (Patch Set Updates) https://support.oracle.com/oip/faces/secure/km/DocumentDisplay.jspx?id=1306505.1 - My Oracle Support NOTE: 1470197.1 Master Note on WebLogic Server Patch Set Updates (PSUs) https://support.oracle.com/oip/faces/secure/km/DocumentDisplay.jspx?id=1470197.1 - Beginning January 2019, WLS 10.3.6 is under Extended Support. It is recommended that you upgrade to 12c R2 Only customers who have contracted for Extended Support are entitled to download and use PSUs created for a product in Extended Support https://support.oracle.com/oip/faces/secure/km/DocumentDisplay.jspx?id=2067900.1 - Download the Error Correction Policy document and see "4.2 Policies - Critical Patch Update Program" https://support.oracle.com/oip/faces/secure/km/DocumentDisplay.jspx?id=944866.1 - It is required to use Java SE 7 with WLS 10.3.6 as Java SE 6 has reached the end of Extended Support https://support.oracle.com/oip/faces/secure/km/DocumentDisplay.jspx?id=952075.1 Smart Update Details of WLS Patch Set Update 10.3.6.0.220118 ----------------------------------------------------------- WLS Patch ID - HYG5 WLS Patch Number - 33494814 This document includes the following sections: Section 1: Preparing to Install WLS Patch Set Update 10.3.6.0.220118 Section 2: Installing WLS Patch Set Update 10.3.6.0.220118 Section 3: Troubleshooting Patching Failures Section 4: Post-Installation Instructions Section 5: Uninstalling WLS Patch Set Update 10.3.6.0.220118 Section 6: Post-Uninstallation Instructions Section 7: Bugs Fixed by this Patch Section 1: Preparing to Install WLS Patch Set Update 10.3.6.0.220118 --------------------------------------------------------------- WebLogic Server Patch Set Update (PSU) can be applied on a per-domain basis (or on a more fine-grained basis), Oracle recommends that PSU be applied on an installation-wide basis. PSU applied to a WebLogic Server installation using this recommended practice affect all domains and servers sharing that installation. Follow the below steps before installing the WebLogic PSU patch. - Stop all WebLogic server processes - Remove any previously applied WebLogic Server Patch Set Update and associated overlay patches - Update Java SE (JDK/JRE): For users of Oracle JDKs and JVMs, we strongly recommend applying the latest Java 7 Critical Patch Updates (CPUs) as soon as they are released. Certain WebLogic Server fixes for deserialization vulnerabilities that are provided in WebLogic Server Patch Set Updates (PSUs) depend on JEP 290 filtering and JEP 290 global scope filtering features provided in July 2018 JDK Updates and later JDK updates. These WebLogic Server fixes for deserialization vulnerabilities are not effective without these JDK updates, or later JDK updates. Oracle strongly recommends that you ensure WebLogic Server is running with a supported JDK version, and the following JDK update level at a minimum: JDK 7 Update 191 (JDK 7u191) or later (for WebLogic Server versions that are supported on JDK 7) Refer to the following for further information: Doc ID 1506916.1 Obtaining Java SE (JDK/JRE) for Oracle Fusion Middleware Products https://support.oracle.com/rs?type=doc&id=1506916.1 - Unzip p33494814_1036_Generic.zip to {MW_HOME}/utils/bsu/cache_dir or any local directory Where, MW_HOME is path of the Oracle Middleware Home. Notes: - You must make sure that the target directory for unzip has required write and executable permissions for "user" with which the component being patched is installed. - On some platforms, the zip/unzip utility may not be able to extract the jar files in the zip correctly. On Windows, the native zip utility will show a 'path too long' error. Java provides the jar utility which will avoid this problem, e.g., jar -xvf p33494814_1036_Generic.zip - Navigate to the {MW_HOME}/utils/bsu directory. - Apply WLS BSU (Smart Update) fix for quicker patch application. This step can be skipped if the fix is already applied. https://support.oracle.com/epmos/faces/DocumentDisplay?id=2271366.1 - Configuring Memory options For Microsoft Windows systems Edit the bsu.cmd script and change memory options as follows: set MEM_ARGS=-Xms1024m -Xmx4096m For UNIX Systems Edit the bsu.sh script and change memory options as follows: MEM_ARGS="-Xms1024m -Xmx4096m" Section 2: Installing WLS Patch Set Update 10.3.6.0.220118 ----------------------------------------------------- Ensure all the steps are taken to prepare for patch installation and then execute this step. - Execute bsu.sh -install -patch_download_dir={MW_HOME}/utils/bsu/cache_dir -patchlist={PATCH_ID} -prod_dir={MW_HOME}/{WL_HOME} Where, WL_HOME is the path of the WebLogic home, PATCH_ID is HYG5 (Unique identifier for WLS Patch Set Update 10.3.6.0.220118). Reference: How to Apply WebLogic Server (WLS) Patches Using Smart Update https://support.oracle.com/epmos/faces/DocumentDisplay?id=876004.1 BSU Command line interface http://docs.oracle.com/cd/E14759_01/doc.32/e14143/commands.htm Section 3: Troubleshooting Patching Failures -------------------------------------------------------- WebLogic Server PSU - Popular Known Issues (Doc ID 2458832.1) https://support.oracle.com/epmos/faces/DocumentDisplay?id=2458832.1 WLS BSU (Smart Update) Takes a Very Long Time to Apply Patches - Especially When Checking for Patch Conflicts https://support.oracle.com/epmos/faces/DocumentDisplay?id=2271366.1 Diagnosing "Encountered unrecognized patch ID" Failures When Trying to Patch WLS Using BSU https://support.oracle.com/epmos/faces/DocumentDisplay?id=1186923.1 Conflict Detected - New PSU for WLS 10.3.6 is "mutually exclusive and cannot coexist with patch(es)" https://support.oracle.com/epmos/faces/DocumentDisplay?id=2267696.1 Native Windows Zip/Unzip Tools Fail to Extract Patch Zip Files - "Path Too Long" or "is Invalid" Errors https://support.oracle.com/epmos/faces/DocumentDisplay?id=2259579.1 Section 4: Post-Installation Instructions ----------------------------------------------------- - Refer following document: Doc ID 2764668.1 Security Advice and Post-Install Information for Oracle WebLogic Server PSUs https://support.oracle.com/rs?type=doc&id=2764668.1 Section 5: Uninstalling WLS Patch Set Update 10.3.6.0.220118 ------------------------------------------------------- - Stop all WebLogic Servers - Navigate to the {MW_HOME}/utils/bsu directory. - Execute bsu.sh -remove -patchlist={PATCH_ID} -prod_dir={MW_HOME}/{WL_HOME} Section 6: Post-Uninstallation Instructions ------------------------------------------------------- - Restart all WebLogic Servers Section 7: Bugs Fixed by this Patch ----------------------------------------------- Bug fixes in this patch are shown in the following list: Issues Resolved in WLS Patch Set Update 10.3.6.0.220118 33560373 : Fix for Bug 33560373 33379618 : Fix for Bug 33379618 33446922 : Fix for Bug 33446922 33145710 : Fix for Bug 33145710 33270388 : Fix for Bug 33270388 33270137 : Fix for Bug 33270137 33287665 : CVE-2021-29425 33261059 : Fix for Bug 33261059 33277149 : Fix for Bug 33277149 Issues Resolved in WLS Patch Set Update 10.3.6.0.211019 33245345 : CVE-2021-35620 33114718 : CHECK FOR UNAUTHENTICATED DOT NET JMS CLIENT 32962304 : ANONYMOUS .NET JMS CLIENT HUNG ON CREATING INITIAL CONTEXT TO A 14.1.2 SERVER 325