Skip to content

Commit 2afb018

Browse files
IsmathBadshagithub-actions
IsmathBadsha
authored and
github-actions
committed
25.0.0.9
1 parent 7d06b92 commit 2afb018

File tree

1 file changed

+306
-0
lines changed

1 file changed

+306
-0
lines changed

‎posts/2025-09-09-25.0.0.9.adoc‎

Lines changed: 306 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,306 @@
1+
---
2+
layout: post
3+
title: "TITLE"
4+
# Do NOT change the categories section
5+
categories: blog
6+
author_picture: https://avatars3.githubusercontent.com/IsmathBadsha
7+
author_github: https://github.com/IsmathBadsha
8+
seo-title: TITLE - makes sure it ends with - OpenLiberty.io
9+
seo-description: DESCRIPTION
10+
blog_description: DESCRIPTION
11+
open-graph-image: https://openliberty.io/img/twitter_card.jpg
12+
open-graph-image-alt: Open Liberty Logo
13+
---
14+
= TITLE
15+
Ismath Badsha <https://github.com/IsmathBadsha>
16+
:imagesdir: /
17+
:url-prefix:
18+
:url-about: /
19+
//Blank line here is necessary before starting the body of the post.
20+
21+
// // // // // // // //
22+
// In the preceding section:
23+
// Do not insert any blank lines between any of the lines.
24+
// Do not remove or edit the variables on the lines beneath the author name.
25+
//
26+
// "open-graph-image" is set to OL logo. Whenever possible update this to a more appropriate/specific image (For example if present a image that is being used in the post). However, it
27+
// can be left empty which will set it to the default
28+
//
29+
// "open-graph-image-alt" is a description of what is in the image (not a caption). When changing "open-graph-image" to
30+
// a custom picture, you must provide a custom string for "open-graph-image-alt".
31+
//
32+
// Replace TITLE with the blog post title eg: MicroProfile 3.3 is now available on Open Liberty 20.0.0.4
33+
// Replace IsmathBadsha with your GitHub username eg: lauracowen
34+
// Replace DESCRIPTION with a short summary (~60 words) of the release (a more succinct version of the first paragraph of the post).
35+
// Replace Ismath Badsha with your name as you'd like it to be displayed, eg: Laura Cowen
36+
//
37+
// Example post: 2020-04-09-microprofile-3-3-open-liberty-20004.adoc
38+
//
39+
// If adding image into the post add :
40+
// -------------------------
41+
// [.img_border_light]
42+
// image::img/blog/FILE_NAME[IMAGE CAPTION ,width=70%,align="center"]
43+
// -------------------------
44+
// "[.img_border_light]" = This adds a faint grey border around the image to make its edges sharper. Use it around screenshots but not
45+
// around diagrams. Then double check how it looks.
46+
// There is also a "[.img_border_dark]" class which tends to work best with screenshots that are taken on dark
47+
// backgrounds.
48+
// Change "FILE_NAME" to the name of the image file. Also make sure to put the image into the right folder which is: img/blog
49+
// change the "IMAGE CAPTION" to a couple words of what the image is
50+
// // // // // // // //
51+
52+
RELEASE_SUMMARY
53+
54+
// // // // // // // //
55+
// In the preceding section:
56+
// Leave any instances of `tag::xxxx[]` or `end:xxxx[]` as they are.
57+
//
58+
// Replace RELEASE_SUMMARY with a short paragraph that summarises the release. Start with the lead feature but also summarise what else is new in the release. You will agree which will be the lead feature with the reviewers so you can just leave a placeholder here until after the initial review.
59+
// // // // // // // //
60+
61+
// // // // // // // //
62+
// Replace the following throughout the document:
63+
// Replace 25.0.0.9 with the version number of Open Liberty, eg: 22.0.0.2
64+
// Replace 25009 with the version number of Open Liberty wihtout the periods, eg: 22002
65+
// // // // // // // //
66+
67+
In link:{url-about}[Open Liberty] 25.0.0.9:
68+
69+
* <<SUB_TAG_0, Add ECDH-ES support to JwtBuilder>>
70+
* <<CVEs, Security Vulnerability (CVE) Fixes>>
71+
* <<bugs, Notable bug fixes>>
72+
73+
74+
// // // // // // // //
75+
// If there were updates to guides since last release, keep the following, otherwise remove section.
76+
// // // // // // // //
77+
Along with the new features and functions added to the runtime, we’ve also made <<guides, updates to our guides>>.
78+
79+
// // // // // // // //
80+
// In the preceding section:
81+
// Replace the TAG_X with a short label for the feature in lower-case, eg: mp3
82+
// Replace the FEATURE_1_HEADING with heading the feature section, eg: MicroProfile 3.3
83+
// Where the updates are grouped as sub-headings under a single heading
84+
// (eg all the features in a MicroProfile release), provide sub-entries in the list;
85+
// eg replace SUB_TAG_1 with mpr, and SUB_FEATURE_1_HEADING with
86+
// Easily determine HTTP headers on outgoing requests (MicroProfile Rest Client 1.4)
87+
// // // // // // // //
88+
89+
View the list of fixed bugs in link:https://github.com/OpenLiberty/open-liberty/issues?q=label%3Arelease%3A25009+label%3A%22release+bug%22[25.0.0.9].
90+
91+
Check out link:{url-prefix}/blog/?search=release&search!=beta[previous Open Liberty GA release blog posts].
92+
93+
94+
[#run]
95+
96+
// // // // // // // //
97+
// LINKS
98+
//
99+
// OpenLiberty.io site links:
100+
// link:{url-prefix}/guides/maven-intro.html[Maven]
101+
//
102+
// Off-site links:
103+
//link:https://openapi-generator.tech/docs/installation#jar[Download Instructions]
104+
//
105+
// IMAGES
106+
//
107+
// Place images in ./img/blog/
108+
// Use the syntax:
109+
// image::/img/blog/log4j-rhocp-diagrams/current-problem.png[Logging problem diagram,width=70%,align="center"]
110+
// // // // // // // //
111+
112+
== Develop and run your apps using 25.0.0.9
113+
114+
If you're using link:{url-prefix}/guides/maven-intro.html[Maven], include the following in your `pom.xml` file:
115+
116+
[source,xml]
117+
----
118+
<plugin>
119+
<groupId>io.openliberty.tools</groupId>
120+
<artifactId>liberty-maven-plugin</artifactId>
121+
<version>3.8.2</version>
122+
</plugin>
123+
----
124+
125+
Or for link:{url-prefix}/guides/gradle-intro.html[Gradle], include the following in your `build.gradle` file:
126+
127+
[source,gradle]
128+
----
129+
buildscript {
130+
repositories {
131+
mavenCentral()
132+
}
133+
dependencies {
134+
classpath 'io.openliberty.tools:liberty-gradle-plugin:3.6.2'
135+
}
136+
}
137+
apply plugin: 'liberty'
138+
----
139+
// // // // // // // //
140+
// In the preceding section:
141+
// Replace the Maven `3.8.2` with the latest version of the plugin: https://search.maven.org/artifact/io.openliberty.tools/liberty-maven-plugin
142+
// Replace the Gradle `3.6.2` with the latest version of the plugin: https://search.maven.org/artifact/io.openliberty.tools/liberty-gradle-plugin
143+
// TODO: Update GHA to automatically do the above. If the maven.org is problematic, then could fallback to using the GH Releases for the plugins
144+
// // // // // // // //
145+
146+
Or if you're using link:{url-prefix}/docs/latest/container-images.html[container images]:
147+
148+
[source]
149+
----
150+
FROM icr.io/appcafe/open-liberty
151+
----
152+
153+
Or take a look at our link:{url-prefix}/start/[Downloads page].
154+
155+
If you're using link:https://plugins.jetbrains.com/plugin/14856-liberty-tools[IntelliJ IDEA], link:https://marketplace.visualstudio.com/items?itemName=Open-Liberty.liberty-dev-vscode-ext[Visual Studio Code] or link:https://marketplace.eclipse.org/content/liberty-tools[Eclipse IDE], you can also take advantage of our open source link:https://openliberty.io/docs/latest/develop-liberty-tools.html[Liberty developer tools] to enable effective development, testing, debugging and application management all from within your IDE.
156+
157+
[link=https://stackoverflow.com/tags/open-liberty]
158+
image::img/blog/blog_btn_stack.svg[Ask a question on Stack Overflow, align="center"]
159+
160+
// // // // DO NOT MODIFY THIS COMMENT BLOCK <GHA-BLOG-TOPIC> // // // //
161+
// Blog issue: https://github.com/OpenLiberty/open-liberty/issues/32660
162+
// Contact/Reviewer: tloodu
163+
// // // // // // // //
164+
[#SUB_TAG_0]
165+
== Add ECDH-ES support to JwtBuilder
166+
167+
Please provide a summary of the update, including the following points:
168+
169+
- A sentence or two that introduces the update to someone new to the general technology/concept.
170+
- JwtBuilder now supports use of ECDH-ES (Elliptic Curve Diffie-Hellman Ephemeral Static) as a key management algorithm. This enables usage of Elliptic Curve algorithms for wrapping the Content Encryption Key (CEK) of a JWE.
171+
- The Human-readable name and short feature name for your feature- eg WebSockets feature (websockets-1.0).
172+
- This is enabled in the `keyManagementKeyAlgorithm` attribute in the `jwtBuilder` element of the `JSON Web Token 1.0` (`jwt-1.0`) feature.
173+
- Who is the target persona? Who do you expect to use the update? eg application developer, operations.
174+
- Application developers.
175+
- What was the problem before and how does your update make their life better? (Why should they care?)
176+
- Developers were limited to using RSA-OAEP as the key management algorithm when encrypting or deriving the Content Encryption Key of a JWE. The ECDH-ES option allows for an alternative with better security.
177+
- Briefly explain how to make your update work. Include screenshots, diagrams, and/or code snippets, and provide a `server.xml` snippet.
178+
- To use ECDH-ES, an Elliptic Curve public key must be defined in the `keyManagementKeyAlias` attribute. An EC public and private key pair can be created using securityUtility or keytool:
179+
- `./securityUtility createSSLCertificate --sigAlg=SHA256withECDSA --keySize=256 --server=myServer --validity=3650 --password=password`
180+
- `keytool -genkeypair -alias eccert -keyalg EC -groupname secp256r1 -validity 3650 -storetype pkcs12 -keystore myKeystore.p12 -storepass password`
181+
- ECDH-ES can be configured under the `keyManagementKeyAlgorithm` attribute in a JwtBuilder configuration.
182+
- The EC public key for encryption must be specified with its alias under `keyManagementKeyAlias`. Additionally, its keystore must be specified under `trustStoreRef`.
183+
- Server.xml:
184+
185+
```xml
186+
<jwtBuilder
187+
keyManagementKeyAlgorithm="ECDH-ES"
188+
keyManagementKeyAlias="myECPublicKey"
189+
trustStoreRef="myTrustStore" ... />
190+
```
191+
- Where can they find out more about this specific update (eg Open Liberty docs, Javadoc) and/or the wider technology?
192+
- https://openliberty.io/docs/latest/reference/config/jwtBuilder.html
193+
194+
195+
196+
197+
198+
// DO NOT MODIFY THIS LINE. </GHA-BLOG-TOPIC>
199+
200+
201+
For more details, check the LINK[LINK_DESCRIPTION].
202+
203+
// // // // // // // //
204+
// In the preceding section:
205+
// Replace TAG_X/SUB_TAG_X with the given tag of your secton from the contents list
206+
// Replace SUB_FEATURE_TITLE/FEATURE_X_TITLE with the given title from the contents list
207+
// Replace FEATURE with the feature name for the server.xml file e.g. mpHealth-1.4
208+
// Replace LINK with the link for extra information given for the feature
209+
// Replace LINK_DESCRIPTION with a readable description of the information
210+
// // // // // // // //
211+
212+
[#CVEs]
213+
== Security vulnerability (CVE) fixes in this release
214+
[cols="5*"]
215+
|===
216+
|CVE |CVSS Score |Vulnerability Assessment |Versions Affected |Notes
217+
218+
|Link[CVE-XXXX-XXXXX]
219+
|Score
220+
|vulnerability
221+
|Affected versions
222+
|Affected Features and other notes
223+
|===
224+
// // // // // // // //
225+
// In the preceding section:
226+
// If there were any CVEs addressed in this release, fill out the table. For the information, reference https://github.com/OpenLiberty/docs/blob/draft/modules/ROOT/pages/security-vulnerabilities.adoc. If it has not been updated for this release, reach out to Kristen Clarke or Michal Broz.
227+
// Note: When linking to features, use the
228+
// `link:{url-prefix}/docs/latest/reference/feature/someFeature-1.0.html[Some Feature 1.0]` format and
229+
// NOT what security-vulnerabilities.adoc does (feature:someFeature-1.0[])
230+
//
231+
// If there are no CVEs fixed in this release, replace the table with:
232+
// "There are no security vulnerability fixes in Open Liberty [25.0.0.9]."
233+
// // // // // // // //
234+
For a list of past security vulnerability fixes, reference the link:{url-prefix}/docs/latest/security-vulnerabilities.html[Security vulnerability (CVE) list].
235+
236+
237+
[#bugs]
238+
== Notable bugs fixed in this release
239+
240+
241+
We’ve spent some time fixing bugs. The following sections describe just some of the issues resolved in this release. If you’re interested, here’s the link:https://github.com/OpenLiberty/open-liberty/issues?q=label%3Arelease%3A25009+label%3A%22release+bug%22[full list of bugs fixed in 25.0.0.9].
242+
243+
* link:https://github.com/OpenLiberty/open-liberty/issues/32507[IBM WebSphere Application Server Liberty is affected by a denial of service due to Apache Commons FileUpload (CVE-2025-48976)]
244+
+
245+
246+
* link:https://github.com/OpenLiberty/open-liberty/issues/32497[`CORBA MARSHAL` when sending a `Comparable` field containing a `String`]
247+
+
248+
249+
* link:https://github.com/OpenLiberty/open-liberty/issues/32487[IBM WebSphere Application Server Liberty is affected by a security bypass vulnerability (CVE-2025-36124 CVSS 5.9)]
250+
+
251+
252+
* link:https://github.com/OpenLiberty/open-liberty/issues/32478[Address CVE-2025-36000]
253+
+
254+
255+
* link:https://github.com/OpenLiberty/open-liberty/issues/32446[IBM WebSphere Application Server Liberty is affected by a denial of service (CVE-2025-36047 CVSS 5.3)]
256+
+
257+
258+
* link:https://github.com/OpenLiberty/open-liberty/issues/32197[MP OpenAPI does not preserve the order of maps when merging documents]
259+
+
260+
261+
* link:https://github.com/OpenLiberty/open-liberty/issues/32151[Using parentLast delegation causes inconsistent parent delegation when using common library references]
262+
+
263+
264+
* link:https://github.com/OpenLiberty/open-liberty/issues/32118[DuplicateHomeNameException occurs during EJB application restart after an error occurs during the application start]
265+
+
266+
267+
* link:https://github.com/OpenLiberty/open-liberty/issues/31962[openidConnectClient cannot handle low case "bearer" as token_type]
268+
+
269+
270+
* link:https://github.com/OpenLiberty/open-liberty/issues/31949[Cannot stop generating `trace.log` file]
271+
+
272+
273+
* link:https://github.com/OpenLiberty/open-liberty/issues/31374[For HTTP stats, the http route attribute is not merging/abstracting requests that contain Path params for springboot application]
274+
+
275+
276+
277+
// // // // // // // //
278+
// In the preceding section:
279+
// For this section ask either Michal Broz or Tom Evans or the #openliberty-release-blog channel for Notable bug fixes in this release.
280+
// Present them as a list in the order as provided, linking to the issue and providing a short description of the bug and the resolution.
281+
// If the issue on Github is missing any information, leave a comment in the issue along the lines of:
282+
// "@[issue_owner(s)] please update the description of this `release bug` using the [bug report template](https://github.com/OpenLiberty/open-liberty/issues/new?assignees=&labels=release+bug&template=bug_report.md&title=)"
283+
// Feel free to message the owner(s) directly as well, especially if no action has been taken by them.
284+
// For inspiration about how to write this section look at previous blogs e.g- 20.0.0.10 or 21.0.0.12 (https://openliberty.io/blog/2021/11/26/jakarta-ee-9.1.html#bugs)
285+
// // // // // // // //
286+
287+
288+
// // // // // // // //
289+
// If there were updates to guides since last release, keep the following, otherwise remove section.
290+
// Check with Gilbert Kwan, otherwise Michal Broz or YK Chang
291+
// // // // // // // //
292+
[#guides]
293+
== New and updated guides since the previous release
294+
As Open Liberty features and functionality continue to grow, we continue to add link:https://openliberty.io/guides/?search=new&key=tag[new guides to openliberty.io] on those topics to make their adoption as easy as possible. Existing guides also receive updates to address any reported bugs/issues, keep their content current, and expand what their topic covers.
295+
296+
// // // // // // // //
297+
// In the following section, list any new guides, or changes/updates to existing guides.
298+
// The following is an example of how the list can be structured (similar to the bugs section):
299+
// * link:{url-prefix}/guides/[new/updated guide].html[Guide Title]
300+
// ** Description of the guide or the changes made to the guide.
301+
// // // // // // // //
302+
303+
304+
== Get Open Liberty 25.0.0.9 now
305+
306+
Available through <<run,Maven, Gradle, Docker, and as a downloadable archive>>.

0 commit comments

Comments
 (0)