OpenJDK Vulnerability

Products

• CA Application Performance Management Agent (APM / Wily / Introscope)
• CA Application Performance Management (APM / Wily / Introscope)
• INTROSCOPE
• DX Application Performance Management

Issue/Introduction

We have been notified of a OpenJDK instance installed on our Introscope servers in  /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.41.x86_64/jre/bin  Last weekend, we attempted to stop Introscope, move that directory, and then start Introscope.  I believe that this directory was not being used, so it was planned to delete it if there were no issues starting up.  However, after starting it, we got these errors on the log file on the MOM.

[ERROR] [Manager.Bootstrap] XML problem while parsing /opt/wily/Introscope10.5.2.52/config/modules/WMBManagementModule.jar

[ERROR] [Manager] XML Problem while parsing at line 44 and column 27: cvc-complex-type.2.4.d: Invalid content was found starting with element 'Description'. No child element is expected at this point.

[ERROR] [Manager.Bootstrap] XML problem while parsing /opt/wily/Introscope10.5.2.52/config/modules/PPCTGServer_ManagementModule.jar

[ERROR] [Manager] XML Problem while parsing at line 46 and column 27: cvc-complex-type.2.4.d: Invalid content was found starting with element 'Description'. No child element is expected at this point.

[ERROR] [Manager.Bootstrap] XML problem while parsing /opt/wily/Introscope10.5.2.52/config/modules/PPCTGClient_ManagementModule.jar

[ERROR] [Manager] XML Problem while parsing at line 10098 and column 27: cvc-complex-type.2.4.d: Invalid content was found starting with element 'Description'. No child element is expected at this point.

[ERROR] [Manager.Bootstrap] XML problem while parsing /opt/wily/Introscope10.5.2.52/config/modules/PPOracleDB_ManagementModule.jar

Once we reverted our changes and moved the OpenJDK directory back Introscope started without errors.  It appears then that the OpenJDK instance is being referenced in these Management Modules.  Would you agree?  Or do you have any idea on how we would clean this up?

 

Environment

Release : 10.5

Component : APM Agents

Resolution

I think at this point as we don’t have an answer as to when we can perform the steps, so it is safe to close this case. I will work with the team to try the below steps, but it does not seem to be affecting performance.

Additional Information

Follow these steps:

1. Open the problematic MM in Webview or workstation.

2. Then go to the description field and edit it, then save that and restart the EM and see if you still get the error for that MM.

3. If you didn't receive the error, then repeat the steps for all the Management Module which is exhibiting this problem.

 

One more question: are you receiving this error on the default Management Module which we ship with the product?