===============================
Bundle Patch for Bug: 35186834
===============================

Date:  Wed Mar 15 18:43:24 2023
---------------------------------
Platform Patch for : Generic
Product Patched : MIDDLEWARE COMMON LIBRARIES AND TOOLS
Product Version      : 12.2.1.3.0


This document describes how to install the patch for
bug #  35186834. It includes the following sections:

	Section 1, "Zero Downtime Patching"

 	Section 2, "Prerequisites"

	Section 3, "Pre-Installation Instructions"

	Section 4, "Installation Instructions"

	Section 5, "Post-Installation Instructions"

	Section 6, "Deinstallation Instructions"

	Section 7, "Post Deinstallation Instructions"

	Section 8, "Bugs Fixed by This Patch"


 
1 Zero Downtime Patching
------------------------------
This patch has been marked as eligible for Zero Downtime Patching. 
The type of Zero Downtime Patching supported by this patch is FMW_ROLLING_ORACLE_HOME.

With Zero Downtime Patching, a Patch can be applied to a system in a manner
that does not incur any downtime. This ensures that the system can remain
available and functioning during the patching process. Certain
pre-requisites, however, must be met before the patch can be applied.

For more information, consult the My Oracle Support MOS Note: 1942159.1

 

2 Prerequisites
----------------
Ensure that you meet the following requirements before you install or
deinstall the patch:

1. Before applying the non-mandatory patches, ensure that you have the
exact symptoms described in the bug.



2. Oracle Fusion Middleware 12.2.1 products are installed with OPatch
NextGen 13.3 to apply interim patches.
The OPatch utility may be updated over time to resolve known issues.

You can check your version using the following command:

ORACLE_HOME/OPatch/opatch version

Versions 12.2.1.0-12.2.1.2 do not require an update. For version 12.2.1.3, 
OPatch 13.9.4 is required. 

OPatch 13.9.4 is available as Patch 28186730: 
https://support.oracle.com/rs?type=patch&id=28186730 

Review the following for more OPatch information: 

Doc ID 1587524.1 Using OUI NextGen OPatch 13 for Oracle Fusion Middleware 12c 
https://support.oracle.com/rs?type=doc&id=1587524.1 



3. Verify the OUI Inventory.
OPatch needs access to a valid OUI inventory to apply patches.

Note: This needs the ORACLE_HOME to be set(refer section "2. Pre-Installation Instructions")
prior to run the below commands:

Validate the OUI inventory with the following commands:

$ opatch lsinventory -jre $ORACLE_HOME/oracle_common/jdk/jre

Note:
Make sure the JDK version you use is the certified version for your product.

If the command errors out, contact Oracle Support and work to validate
and verify the inventory setup before proceeding.


4. Create a location for storing the unzipped patch: 

This location will be referred to later in the document as PATCH_TOP.

NOTE: On WINDOWS, the preferred location is the drive root directory.
For example, "C:\PATCH_TOP" and avoid choosing locations like,
"C:\Documents and Settings\username\PATCH_TOP".
This is necessary due to the 256 characters limitation on windows
platform.

3 Pre-Installation Instructions
-------------------------------

1. Set the ORACLE_HOME environment variable to the directory where you have installed MIDDLEWARE COMMON LIBRARIES AND TOOLS.




4 Installation Instructions
---------------------------

1. Unzip the patch zip file into the PATCH_TOP.

$ unzip -d PATCH_TOP p35186834_122130_Generic.zip

NOTE: On WINDOWS, the unzip command has a limitation of 256 characters in the path name.
If you encounter this, please use an alternate ZIP utility like 7-Zip to unzip the patch.

For example: To unzip using 7-zip, run the command:
"c:\Program Files\7-Zip\7z.exe" x  p35186834_122130_Generic.zip

2. Set your current directory to the directory where the patch is located.

$ cd PATCH_TOP/35186834

3. Run OPatch to apply the patch.

$ opatch apply


Note:
-----
When OPatch starts, it validates the patch and makes sure that there are no
conflicts with the software already installed in the ORACLE_HOME.

In case of opatch conflict, you will see a warning message similar to the one mentioned below:

Interim Patch XXXX has Conflict with patch(es) [ YYYY ] in OH ...
Conflict patches: YYYY
Patch(es) YYYY conflict with the patch currently being installed (XXXX).
If you continue, patch(es) YYYY will be rolled back and the new patch (XXXX) will be installed.

If a merge of the new patch (XXXX) and the conflicting patch(es) ( YYYY) is required,contact Oracle Support Services and request a Merged patch.

Do you want to proceed? [y|n]
n

You must stop the patch installation and contact oracle support on how to proceed.

5 Post-Installation Instructions
---------------------------------

NONE


6 Deinstallation Instructions
------------------------------

If you experience any problems after installing this patch, remove the patch as
follows:

1. Make sure to follow the same Prerequisites or pre-install steps (if any)
when deinstalling a patch.
This includes setting up any environment variables like ORACLE_HOME and
verifying the OUI inventory before deinstalling.

2. Change to the directory where the patch was unzipped.

$ cd PATCH_TOP/35186834

3. Run OPatch to deinstall the patch.

$ opatch rollback -id  35186834

7 Post Deinstallation Instructions
-----------------------------------
Restart all servers (AdminServer and all Managed server(s)).

This is necessary to redeploy the original applications and bring the
environment back to it's original state.

8 Bugs Fixed by This Patch
--------------------------
 
FMW Thirdparty Bundle Patch 12.2.1.3.230315
33597049: CVE-2021-36374
34666403: CVE-2022-33980
30436564: CVE-2016-5725
34841025: CVE-2022-42890
34495552: CVE-2022-29599
34914573: CVE-2022-36033

 
FMW Thirdparty Bundle Patch 12.2.1.3.230112
 33862100: Fix for Bug 33862100
 33862123: Fix for Bug 33862123
 33862026: Fix for Bug 33862026
 33240946: CVE-2021-23926 - UPDATE XMLBEANS to v4.0
 33485467: CVE-2021-37714 - Update JSoup to v 1.14.3
 33234654: UPDATE GSON to 2.8.7
 34237213: CVE-2021-42575 IN OWASP JAVA HTML SANITIZER UPDATE TO V20211018.2
 32992083: REVERT 31470239 FOR 12.2.1.3
 32055018: CVE-2019-10086
 34169141: Fix for Bug 34169141
 31470239: CVE-2020-10683
 33731231: CVE-2021-42575
 33974003: CVE-2022-22965
 34315295: CVE-2022-25647
 34488471: CVE-2022-23305
 34362892: CVE-2022-22971
 34196080: CVE-2022-23457
 33731248: CVE-2020-13956 for http client library to 4.5.13
 34697537: Fix for Bug 34697537
 34676390: Update Hibernate Validator to 5.2.5 Final


-----------------------------------------------------------------------------
DISCLAIMER:


This Bundle patch has only undergone basic unit testing, 
and has not been through a complete test cycle generally followed for a 
production patch set.
Though the fixes in this document rectifies the bug, Oracle Corporation will
not be responsible for other issues that may arise due to these fixes.
Oracle Corporation recommends to later upgrade to the next production patch
set, when available. Applying this patch could overwrite other interim
patches applied since the last patch set. Customers need to make a request
to Oracle Support for a patch that includes those fixes, as well as inform
Oracle Support about all the patches installed when a Service Request is
opened. Please download, test, and provide feedback as soon as possible
to assist in the timely resolution of this problem.

Copyright (c)  2023, Oracle and/or its affiliates. All rights reserved.
----------------------------------------------------------------------------- 
