CVE-2012-2162

If you are using the WebSphere Key and Certificate Management generated plug-in key store you are NOT affected. If, however, you are using the key store installed by default with the Web Server Plug-in for WebSphere Application Server and you have NEVER changed the key store’s password, then you must change the plug-in key store’s password, which removes the pending password expiration, to avoid a security exposure. Generally, as a best practice, IBM recommends you always change passwords from the default value to enhance the security of your system.

In reference to this specific security exposure concern, a majority of users do not reference the affected file at runtime and therefore are not impacted. However, a small minority of users must take action and use certificate management tools to remove the password expiration prior to April 26, 2012 to avoid experiencing this issue.

All the instructions for fixing this issue are contained in the technote, so take a read and make sure you’ve got this covered.

For the record, my advice when configuring a new Connections environment is to create a new keyfile with your own password, create a self-signed certificate or request a certified one from Verisign etc, then to import the certificates into WAS.  This is all detailed in the presentation that Rob Wunderlich and I gave at Lotusphere 2011.