Skip to content

Commit 740c994

Browse files
navaneethsnair1navaneethsnair1
authored
Merge pull request #4516 from OpenLiberty/25.0.0.9-post
Update 25.0.0.9-post into draft
2 parents 9d884a7 + 04b2653 commit 740c994

File tree

2 files changed

+11
-61
lines changed

2 files changed

+11
-61
lines changed

‎blog_tags.json‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@
22
"blog_tags": [
33
{
44
"name": "announcements",
5-
"posts": ["25.0.0.9-beta", "25.0.0.8", "25.0.0.7",
5+
"posts": ["25.0.0.9", "25.0.0.9-beta",
6+
"25.0.0.8", "25.0.0.7",
67
"25.0.0.7-beta", "25.0.0.6",
78
"25.0.0.6-beta", "25.0.0.5",
89
"25.0.0.4", "25.0.0.4-beta",
@@ -187,7 +188,8 @@
187188
},
188189
{
189190
"name": "release",
190-
"posts": ["25.0.0.9-beta", "25.0.0.8", "25.0.0.7",
191+
"posts": ["25.0.0.9", "25.0.0.9-beta",
192+
"25.0.0.8", "25.0.0.7",
191193
"25.0.0.7-beta", "25.0.0.6",
192194
"25.0.0.6-beta", "25.0.0.5",
193195
"25.0.0.4", "25.0.0.4-beta",
@@ -311,7 +313,8 @@
311313
},
312314
{
313315
"name": "security",
314-
"posts": ["25.0.0.9-beta", "25.0.0.3", "25.0.0.3-beta",
316+
"posts": ["25.0.0.9", "25.0.0.9-beta",
317+
"25.0.0.3", "25.0.0.3-beta",
315318
"25.0.0.2", "25.0.0.1-beta",
316319
"24.0.0.12", "zero-migration",
317320
"24.0.0.10-beta", "liberty-olo-rh-sso",

‎posts/2025-09-09-25.0.0.9.adoc‎

Lines changed: 5 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,6 @@ In link:{url-about}[Open Liberty] 25.0.0.9:
6868

6969
* <<ECDH_ES, Add ECDH-ES support to JWT Builder>>
7070
* <<CVEs, Security Vulnerability (CVE) Fixes>>
71-
* <<bugs, Notable bug fixes>>
7271

7372
// // // // // // // //
7473
// In the preceding section:
@@ -158,9 +157,9 @@ image::img/blog/blog_btn_stack.svg[Ask a question on Stack Overflow, align="cent
158157
[#ECDH_ES]
159158
== Add ECDH-ES support to JWT Builder
160159

161-
Open Liberty has enhanced its JSON Web Token 1.0 (`jwt-1.0`) feature by introducing support for ECDH-ES (Elliptic Curve Diffie-Hellman Ephemeral Static) as a key management algorithm in the JWT Builder configuration. This update allows application developers to use Elliptic Curve (EC)Cryptography to determine the Content Encryption Key (CEK) of a JSON Web Encryption (JWE) token, providing a modern alternative to the previously supported RSA-OAEP with enhanced security.
160+
Open Liberty enhances its JSON Web Token 1.0 (`jwt-1.0`) feature by introducing support for ECDH-ES (Elliptic Curve Diffie-Hellman Ephemeral Static) as a key management algorithm in the `jwtBuilder` configuration. This update allows application developers to use Elliptic Curve Cryptography to determine the Content Encryption Key (CEK) of a JSON Web Encryption (JWE) token, providing a modern alternative to the previously supported RSA-OAEP with enhanced security.
162161

163-
To use ECDH-ES, developers must define an Elliptic Curve (EC) public key in the `keyManagementKeyAlias` attribute. The EC public and private key pair can be generated using securityUtility or keytool, for example:
162+
To use ECDH-ES, developers must define an Elliptic Curve (EC) public key in the `keyManagementKeyAlias` attribute. The EC public and private key pair can be generated using the securityUtility or the keytool, for example:
164163

165164
----
166165
./securityUtility createSSLCertificate --sigAlg=SHA256withECDSA --keySize=256 --server=myServer --validity=3650 --password=password
@@ -170,9 +169,9 @@ To use ECDH-ES, developers must define an Elliptic Curve (EC) public key in the
170169
keytool -genkeypair -alias eccert -keyalg EC -groupname secp256r1 -validity 3650 -storetype pkcs12 -keystore myKeystore.p12 -storepass password
171170
----
172171

173-
ECDH-ES can be configured under the `keyManagementKeyAlgorithm` attribute in aJWT Builder element of `JSON Web Token 1.0` (jwt-1.0) feature. The EC public key used for encryption must be referenced by its alias in `keyManagementKeyAlias`, and the keystore must be specified using the `trustStoreRef` attribute.
172+
ECDH-ES can be configured under the `keyManagementKeyAlgorithm` attribute in a `jwtBuilder` element of `JSON Web Token 1.0` (jwt-1.0) feature. Reference the EC public key used by the ECDH-ES key management algorithm by its alias in `keyManagementKeyAlias`, and specify the keystore using the `trustStoreRef` attribute.
174173

175-
Sample server.xml configuration:
174+
Sample `server.xml` configuration:
176175
[source, xml]
177176
----
178177
<jwtBuilder
@@ -181,7 +180,7 @@ Sample server.xml configuration:
181180
trustStoreRef="myTrustStore" ... />
182181
----
183182

184-
For more details on configuring `JWT Builder`, check the link:https://openliberty.io/docs/latest/reference/config/jwtBuilder.html[Open Liberty documentation].
183+
For more details on configuring `jwtBuilder`, check the link:https://openliberty.io/docs/latest/reference/config/jwtBuilder.html[Open Liberty documentation].
185184

186185
// DO NOT MODIFY THIS LINE. </GHA-BLOG-TOPIC>
187186

@@ -236,58 +235,6 @@ For more details on configuring `JWT Builder`, check the link:https://openlibert
236235
// // // // // // // //
237236
For a list of past security vulnerability fixes, reference the link:{url-prefix}/docs/latest/security-vulnerabilities.html[Security vulnerability (CVE) list].
238237

239-
240-
[#bugs]
241-
== Notable bugs fixed in this release
242-
243-
244-
We’ve spent some time fixing bugs. The following sections describe just some of the issues resolved in this release. If you’re interested, here’s the link:https://github.com/OpenLiberty/open-liberty/issues?q=label%3Arelease%3A25009+label%3A%22release+bug%22[full list of bugs fixed in 25.0.0.9].
245-
246-
* link:https://github.com/OpenLiberty/open-liberty/issues/32507[IBM WebSphere Application Server Liberty is affected by a denial of service due to Apache Commons FileUpload (CVE-2025-48976)]
247-
+
248-
249-
* link:https://github.com/OpenLiberty/open-liberty/issues/32497[`CORBA MARSHAL` when sending a `Comparable` field containing a `String`]
250-
+
251-
252-
* link:https://github.com/OpenLiberty/open-liberty/issues/32487[IBM WebSphere Application Server Liberty is affected by a security bypass vulnerability (CVE-2025-36124 CVSS 5.9)]
253-
+
254-
255-
* link:https://github.com/OpenLiberty/open-liberty/issues/32478[Address CVE-2025-36000]
256-
+
257-
258-
* link:https://github.com/OpenLiberty/open-liberty/issues/32446[IBM WebSphere Application Server Liberty is affected by a denial of service (CVE-2025-36047 CVSS 5.3)]
259-
+
260-
261-
* link:https://github.com/OpenLiberty/open-liberty/issues/32197[MP OpenAPI does not preserve the order of maps when merging documents]
262-
+
263-
264-
* link:https://github.com/OpenLiberty/open-liberty/issues/32151[Using parentLast delegation causes inconsistent parent delegation when using common library references]
265-
+
266-
267-
* link:https://github.com/OpenLiberty/open-liberty/issues/32118[DuplicateHomeNameException occurs during EJB application restart after an error occurs during the application start]
268-
+
269-
270-
* link:https://github.com/OpenLiberty/open-liberty/issues/31962[openidConnectClient cannot handle low case "bearer" as token_type]
271-
+
272-
273-
* link:https://github.com/OpenLiberty/open-liberty/issues/31949[Cannot stop generating `trace.log` file]
274-
+
275-
276-
* link:https://github.com/OpenLiberty/open-liberty/issues/31374[For HTTP stats, the http route attribute is not merging/abstracting requests that contain Path params for springboot application]
277-
+
278-
279-
280-
// // // // // // // //
281-
// In the preceding section:
282-
// For this section ask either Michal Broz or Tom Evans or the #openliberty-release-blog channel for Notable bug fixes in this release.
283-
// Present them as a list in the order as provided, linking to the issue and providing a short description of the bug and the resolution.
284-
// If the issue on Github is missing any information, leave a comment in the issue along the lines of:
285-
// "@[issue_owner(s)] please update the description of this `release bug` using the [bug report template](https://github.com/OpenLiberty/open-liberty/issues/new?assignees=&labels=release+bug&template=bug_report.md&title=)"
286-
// Feel free to message the owner(s) directly as well, especially if no action has been taken by them.
287-
// For inspiration about how to write this section look at previous blogs e.g- 20.0.0.10 or 21.0.0.12 (https://openliberty.io/blog/2021/11/26/jakarta-ee-9.1.html#bugs)
288-
// // // // // // // //
289-
290-
291238
== Get Open Liberty 25.0.0.9 now
292239

293240
Available through <<run,Maven, Gradle, Docker, and as a downloadable archive>>.

0 commit comments

Comments
 (0)