Oracle WebLogic Server Stack Patch Bundle 12.2.1.4.240710

Oracle WebLogic Server Stack Patch Bundle 12.2.1.4.240710

Stack Patch Bundle (SPB): 36822778

Platform Patch for : Generic Platform

Product Patched : Oracle WebLogic Server

Product Version : 12.2.1.4.0

This document describes how to install patch 36822778.

 

 

Section 1: Introduction

The Oracle WebLogic Server (WLS) Stack Patch Bundle (SPB) provides a collection of required patches released quarterly with the Critical Patch Update program.

This WLS SPB is applicable to the following distributions:

• WLS 12.2.1.4 Generic
• WLS 12.2.1.4 Slim
• WLS 12.2.1.4 Lite
• FMW 12.2.1.4 Infrastructure

Note: The WebLogic Server SPB is supported only for products installed from the Oracle Fusion Middleware Infrastructure distribution or standalone WebLogic Server distributions. The SPB will only update the components listed in Section 2. Patches for other components included in the FMW Infrastructure distribution must be applied separately using the OPatch napply method. If any other Oracle product installs an FMW Infrastructure, then the SPBAT would not be supported. An example of this is Oracle Enterprise Manager Cloud Control 13c.

 

1.1 Installation Options

In this SPB release you now have two options to apply the patches. Review the following to determine which patching option to use:

• If you are running Linux, Solaris or Windows, then you can use the Stack Patch Bundle Automation Tool (SPBAT) patching option. This tool applies the patches in the SPB, but can also perform a precheck of the environment before patching to ensure that your WebLogic environment meets requirements. SPBAT will also update the OPatch version of the WebLogic environment (if necessary). After completing the required prerequisites, refer to Section 4.1 for more information about using the SPBAT.

• Use OPatch napply to install the bundled patches. This is recommended for other platforms or when you need more control over the process. Note the SPBAT can also be run in a precheck phase before upgrading OPatch or running opatch napply. If you prefer to use the OPatch napply method, complete the required prerequisites and then follow the procedures in Section 4.2.

 

1.2 Additional SPB Program Information

Refer to the following document for more program information, including a Webcast demonstrating how to apply the SPB:

Doc ID 2764636.1 Introducing the Stack Patch Bundle (SPB) with SPBAT Utility for Oracle WebLogic Server

https://support.oracle.com/epmos/faces/DocumentDisplay?id=2764636.1

 

Section 2: System Overview

Oracle WebLogic Stack Patch Bundle (SPB) contains patches applicable for the following supported platforms:

• Linux x86-64
• Solaris x86-64
• Solaris Sparc
• IBM AIX 64
• Windows 64
• HPUX-IA64
• IBM Linux on System Z

Patches included in this SPB are listed below. Note that each patch has its own README that contains a list of the bugs fixed.

Note: As mentioned above, the WebLogic Server SPB is supported only for products installed from the Oracle Fusion Middleware Infrastructure distribution or standalone WebLogic Server distributions. If any other Oracle product installs an FMW Infrastructure, then the SPBAT would not be supported and patches would need to be applied using the OPatch napply method. An example of this is Oracle Enterprise Manager Cloud Control 13c.

Serial Number	Patch Name	Patch Tracking Number	Comments
1	WLS STACK PATCH BUNDLE 12.2.1.4.240710 (PATCH 36822778) (INTERIM PATCH 36822782)	36822804	This patch allows for the Stack Patch Bundle to be included in the OPatch lsinventory output.
2	ADR FOR WEBLOGIC SERVER 12.2.1.4.0 - SIZE OPTIMIZED FOR JAN 2024	35965629	Applicable to Generic and Infrastructure distributions only.
3	WLS PATCH SET UPDATE 12.2.1.4.240704	36805124	Applicable to Generic and Infrastructure distributions only.
4	WEBLOGIC SAMPLES SPU 12.2.1.4.240416	36426672	Applicable to Generic and Infrastructure distributions only.
5	Coherence 12.2.1.4 Cumulative Patch 22 (12.2.1.4.22)	36725924	Applicable to all distributions (lspatches shows patch number as 1221421).
6	FMW PLATFORM 12.2.1.4.0 SPU FOR APRCPU2021	33093748
7	FMW Thirdparty Bundle Patch 12.2.1.4.240625	36770738
8	OPATCH 13.9.4.2.16 FOR EM 13.4 AND FMW/WLS 12.2.1.3.0, 12.2.1.4.0 AND 14.1.1.0.0	28186730	If you are using the opatch napply method, then you will need to manually upgrade OPatch. This is a separate upgrade applicable to all distributions.
9	JDBC 19.3.0.0 FOR CPUAPR2022 (WLS 12.2.1.4, WLS 14.1.1)	32720458
10	RDA release 24.3-2024716 for FMW 12.2.1.4.0	36553894

If you are using WebLogic Server Proxy Plug-In for IIS or Apache, download and apply the latest patches from the following link:: 

• Doc ID 2806740.2, Critical Patch Update (CPU) Patch Advisor for Oracle Fusion Middleware Patch WLS Proxy Plug-In for Third-Party Web Servers

Note: The updated WLS Proxy Plug-In for Oracle HTTP Server (mod_wl_ohs) is included in the latest OHS Bundle Patch for your version.

 

Section 3: Prerequisites

Follow these required steps before applying the SPB:

• 3.1 Stage and verify the SPB zip file
• 3.2 Check Java version
• 3.3 Create a full backup
• 3.4 Check OPatch version
• 3.5 Stop all processes for WebLogic Server
• 3.6 Disable all anti-virus software

 

3.1 Stage and Verify SPB Zip File

1. Check if Patch 23335292 exists in the ORACLE_HOME and rollback the patch before an OPatch upgrade.
   You can get the list of patches by executing lspatches: /OPatch/opatch lspatches

If patch 23335292 exists, rollback the patch by executing the following command: /OPatch/opatch rollback -id 23335292

Note: You should wait approximately 15-30 seconds before running any opatch commands. The rollback of Patch 23335292 should not be executed after the upgrade. 

2. Download the p36822778_122140_Generic.zip from My Oracle Support and decide where you want to extract the SPB.
• The location must be outside of your Oracle home.
• The location should have 4GB free disk space.
• The user should have read, write, and execute rights on the filesystem.
3. Extract the contents of the SPB download on the system you will be applying the patch.
• On Windows, use the jar utility to avoid issues with the native zip program:
  
  JDK_HOME\bin\jar -xvf p36822778_122140_Generic.zip
   
• On UNIX platforms, use unzip to preserve permissions:
  
  unzip p36822778_122140_Generic.zip

 

4. After extracting the patch, you should have a WLS_SPB_12.2.1.4.<VERSION> directory with the following contents:
   
   Note: Do not make any post-extraction changes to this directory structure.

        WLS_SPB_12.2.1.4.<VERSION>/

            -|spbat-bundle.properties (file)
            -|README.txt (file)
            -|README.html (file)
            -|binary_patches (dir)
            -|tools (dir)

5. Navigate to the SPBAT directory and verify it contains the following directory structure:
   
   Note: The default logs directory is created after running the SPBAT (shown below for reference). 

        WLS_SPB_12.2.1.4.<VERSION>/tools/spbat/generic/SPBAT

            -|ExecEngine (dir)
            -|README.txt (this file)
            -|bin (dir)
            -|config (dir)
            -|spbat.sh (file)
            -|spbat.bat (file)
            -|tools (dir)
            -|version.txt (file)
            -|logs (dir generated after running SPBAT)

 

3.2 Check for Minimum Java Version

There is a minimum update level of Java SE (JDK/JRE) requirement before installing the WLS SPB.

Included in this Stack Patch Bundle, certain fixes in the WebLogic Server PSU for deserialization vulnerabilities depend on JEP 290 filtering and JEP 290 global scope filtering features provided in July 2018 JDK Updates and later JDK updates. These fixes for deserialization vulnerabilities are not effective without these JDK updates. Users applying this SPB/PSU without these JDK updates will receive warnings in the WebLogic Server console and in WebLogic Server logs. Refer to the following document for details:

Doc ID 2421487.1 Restricting Incoming Serialized Java Objects to Oracle WebLogic Server

Refer to the following table for minimum and recommended Java SE versions:

Platform	JDK Vendor	Major JDK Version	Expected Minimum Version	Latest Recommended Version
Windows 64	Oracle	1.8.0	1.8.0_211+	Java SE 8u421
Linux x86-64	Oracle	1.8.0	1.8.0_211+	Java SE 8u421
Solaris x86-64	Oracle	1.8.0	1.8.0_211+	Java SE 8u421
Solaris Sparc	Oracle	1.8.0	1.8.0_211+	Java SE 8u421
IBM AIX 64	IBM	1.8.0	1.8.0 SR6 FP5+	Obtain from vendor
IBM Linux on System Z	IBM	1.8.0	1.8.0 SR6 FP5+	Obtain from vendor
HPUX-IA64	HP	1.8.0	1.8.0.19+	Obtain from vendor

Refer the following document to verify and upgrade to relevant JDK:

Doc ID 1492980.1 on How to Install and Maintain the Java SE Installed or Used with FMW 11g/12c/14.1.1 Products

 

3.3 Create a Complete Backup

Create a complete backup of DOMAIN_HOME, ORACLE_HOME and CENTRAL INVENTORY using standard backup software/utilities.

IMPORTANT: In some cases restoring from backup is the only way to roll back the patches. See Section 6 for additional rollback options.

Refer the following Backing Up Your Environment for Oracle recommended backup strategies.

 

               tar -cvf WLS_HOME_BACKUP.tar $ORACLE_HOME

 

 

3.4 Check OPatch Version

The Critical Patch Update program for July 2024 includes OPatch 13.9.4.2.16. The following should be noted about this version:

• The WebLogic Server Patch Set Update requires OPatch 13.9.4.2.13 or later in order to successfully apply new updates.
• The SPBAT script requires OPatch to be at 13.9.4.2.13 or later when performing prerequisite checks (precheck phase).
• OPatch will be upgraded if running SPBAT -phase apply during downtime, see "4.1.3 Applying the SPB Patches with SPBAT"

If running the optional SPBAT -phase precheck without being on at least OPatch 13.9.4.2.13:

1. Unzip OPatch (bundled as part of WLS SPB) to a temporary location outside of your Oracle home.
   
   Example for UNIX:
   
   unzip WLS_SPB_<RELEASE>.<VERSION>/tools/opatch/generic/<VERSION>_Generic.zip -d /tmp/opatch
2. Refer to the OPatch Readme file for instructions on upgrading OPatch in the ORACLE_HOME.
   
   In general, the command is:
   
   [Linux/UNIX] java -jar <PATCH_HOME>/6880880/opatch_generic.jar -silent oracle_home=<ORACLE_HOME>
   
   [Windows] java -jar <PATCH_HOME>\6880880\opatch_generic.jar -silent oracle_home=<ORACLE_HOME>
   
   Where <PATCH_HOME> is the directory you used to extract the <VERSION>_Generic.zip.
   
   
3. To verify the OPatch version, run the following command:
   
   ORACLE_HOME/OPatch/opatch version

Note: OPatch will be upgraded to 13.9.4.2.16 from any version if only running SPBAT -phase apply. To avoid unexpected issues, ensure all prerequisites are met in your environment.

3.5 Stop All Processes for WebLogic Server

Stop all WebLogic Server processes before proceeding with the patch installation.

3.6 Disable all anti-virus software

On Windows, anti-virus software should be temporarily stopped while applying patches in order to avoid problems copying files.

Section 4: Patch Installation Steps

As noted in the Introduction, there are two ways to apply the SPB. Review the following descriptions and then proceed to the designated section for detailed instructions:

• Using SPBAT (Linux, Solaris, and Windows only) SPBAT will help to make the patch installation easier by validating the patch target environment before patching (precheck phase) and then installing the patches (apply phase). The tool can also update your OPatch version if the existing OPatch version is not compatible with the new patches in the SPB. SPBAT can also be run in precheck-only phase, so you can prepare in advance for applying the patches. If you would like to use SPBAT, continue to Section 4.1.

• Using OPatch napply (all platforms) If you would like to continue to use the OPatch napply method to apply the SPB, continue to Section 4.2.

 

4.1 Using SPBAT (Linux, Solaris, and Windows only)

 

4.1.1 SPBAT Requirements

1. Log in and run commands as the OS user that installed Oracle WebLogic Server.
2. As noted in the prerequisites, OPatch 13.9.4.2.13 is the minimum required version to run the SPBAT precheck.
3. Verify that the JAVA_HOME setting in the ORACLE_HOME/oui/.globalEnv.properties is where you have installed your Java SE (JDK/JRE).

Note: SPBAT will not allow a location within the ORACLE_HOME, see Doc ID 1492980.1 for updating your Java SE.

 

4.1.2 SPBAT Patching Process Overview

Once the prerequisite steps from Section 3 are completed, the steps to apply the SPB patches using SPBAT include the following:

1. Run precheck phase (optional)
2. Stop services
3. Run precheck and apply phase during downtime
4. Restart services
5. Complete validation

 

4.1.3 Applying the SPB Patches with SPBAT

SPBAT Precheck Phase

Follow the steps below to check prerequisites in the WLS 12.2.1.4 environment during uptime or downtime without an intention of making changes. This requires OPatch 13.9.4.2.13, see the section, "3.4 Check OPatch Version".

1. Run the SPBAT utility with appropriate options for the optional precheck-only phase:
   
   a. Navigate to the SPBAT directory:
   
       WLS_SPB_<VERSION>/tools/spbat/generic/SPBAT

b. Run the SPBAT utility for the precheck phase:

   [Linux/UNIX] ./spbat.sh -phase precheck -oracle_home <ORACLE_HOME>

   [Windows] spbat.bat -phase precheck -oracle_home <ORACLE_HOME>

c. Review the standard out reports before proceeding with the next phase.

• If there are any issues that need to be addressed, you can run the precheck phase again.
• Repeat these steps on each node in a multi-node environment.
• To monitor the progress during execution on Windows platform, open a new terminal and monitor the log files as required.

 

SPBAT Apply Phase

When you are ready to apply updates during downtime, follow the steps below to upgrade OPatch, check prerequisites, and apply patches.

1. Stop all services and ensure that there are no Java processes running on this Oracle home.
2. Navigate to the SPBAT directory:

    WLS_SPB_<VERSION>/tools/spbat/generic/SPBAT

3. Run the SPBAT utility for the apply phase:

    [Linux/UNIX] ./spbat.sh -phase apply -oracle_home <ORACLE_HOME>

    [Windows] spbat.bat -phase apply -oracle_home <ORACLE_HOME>

    Where:

     -phase: The various phases of applying the patch, valid values are precheck and apply.

     -oracle_home: The directory path to Oracle home.

     -log_dir: (optional) The default directory is WLS_SPB_<VERSION>/tools/spbat/generic/SPBAT/logs or you can set your own location. The directory should already exist and be writable. Windows users should specify a custom log location with a shorter path in order to prevent long path issues known to Windows platforms.

     -skip_acl (optional - Windows platform only): True or False. True will preserve permissions in ORACLE_HOME whereas False will override ACL settings if any.

4. Review the standard out reports before proceeding with the next phase.
• If there are any issues that need to be addressed, you can run the precheck phase again.
• Repeat these steps on each node in a multi-node environment.
• To monitor the progress during execution on Windows platform, open a new terminal and monitor the log files as required.

 

5. Complete the post installation tasks in Section 5.

 

4.2 Using OPatch napply (All Platforms)

If Patch 23335292 was applied to OPatch 13.9.4.2.13, it should be rolled back before upgrading OPatch:

1. Check if Patch 23335292 exists in the Inventory: /OPatch/opatch lspatches

If patch 23335292 exists, rollback the patch by executing the following command: /OPatch/opatch rollback -id 23335292

Note:

1. You should wait approximately 15-30 seconds before running any opatch commands.
2. The rollback of Patch 23335292 should not be executed after the upgrade.

2.   Unzip OPatch (bundled as part of WLS SPB) to a temporary location outside of your Oracle home.
      
      Example for UNIX:
   
      unzip WLS_SPB_<RELEASE>.<VERSION>/tools/opatch/generic/<VERSION>_Generic.zip -d /tmp/opatch
3.   Refer to the OPatch Readme.txt for instructions on upgrading OPatch in the ORACLE_HOME. In general the command is:
   
   [Linux/UNIX] java -jar <PATCH_HOME>/6880880/opatch_generic.jar -silent oracle_home=<ORACLE_HOME>
   
   [Windows] java -jar <PATCH_HOME>\6880880\opatch_generic.jar -silent oracle_home=<ORACLE_HOME>
   
          Where <PATCH_HOME> is the directory you used to extract the <VERSION>_Generic.zip.

4.2.1 OPatch napply Requirements

1. Log in and run commands as the OS user that installed Oracle WebLogic Server.
2. Unset the JAVA_HOME and ORACLE_HOME environment variables.
3. Verify that the JAVA_HOME setting in the ORACLE_HOME/oui/.globalEnv.properties is where you have installed your Java SE (JDK/JRE).

Note: To prevent OPatch from entering into self-patching mode, and to avoid inventory corruption issues, ensure that no OPatch operations are consuming a JDK/JRE located inside the ORACLE_HOME. See Doc ID 1492980.1 for updating your Java SE installation.

4.2.2 OPatch napply - UNIX Platform Steps

1. (Optional) Run OPatch with the -report flag to produce a log of patches that will be applied, but does not actually update anything:
   
   a. Navigate to the binary patches directory:
   
       WLS_SPB_12.2.1.4.<VERSION>/binary_patches
   
   b. Run OPatch with the -report flag to produce a log to review:
   
       ORACLE_HOME/OPatch/opatch napply -report -oh <ORACLE_HOME> -phBaseFile <patch_list_file>

When composing the command line, make sure the -phBaseFile value corresponds to your specific UNIX operating platform.

linux64_patchlist.txt | solaris64_patchlist.txt | solaris_sparc64_patchlist.txt | aix64_patchlist.txt | hpuxia64_patchlist.txt | linux_zser_patchlist.txt | generic_patchlist.txt

Note: Use generic_patchlist.txt to apply generic patches only in case the install platform is different from the list detailed in Section 2 of this document.

Here is an example of the command for UNIX:

ORACLE_HOME/OPatch/opatch napply -report -oh <ORACLE_HOME> -phBaseFile linux64_patchlist.txt

• The patchlist files are bundled into the SPB and you do not need to provide a path to the file.
• Once the opatch napply -report command is executed, review the output of the command and the logs it produces to be aware of any possible issues.
• No changes have been made to your Oracle home even though the command output may say that patches were successfully applied.

     2.   Run OPatch to install the patches included in the SPB:

a. Navigate to the binary patches directory:

     WLS_SPB_12.2.1.4.<VERSION>/binary_patches

b. Run opatch napply:

    ORACLE_HOME/OPatch/opatch napply -oh <ORACLE_HOME> -phBaseFile <patch_list_file>

When composing the command line, make sure the -phBaseFile value corresponds to your specific UNIX operating platform.

linux64_patchlist.txt | solaris64_patchlist.txt | solaris_sparc64_patchlist.txt | aix64_patchlist.txt | hpuxia64_patchlist.txt | linux_zser_patchlist.txt | generic_patchlist.txt

Note: Use generic_patchlist.txt to apply generic patches only if the install platform is different from the list detailed in Section 2 of this document.

Here is an example of the command for UNIX:

ORACLE_HOME/OPatch/opatch napply -oh <ORACLE_HOME> -phBaseFile linux64_patchlist.txt

• The patchlist files are bundled into the SPB, so you do not need to provide a path to the file.
• Once the opatch napply command is executed, review the output of the command and the logs it produces to be aware of any possible issues.
• Changes have been made to your Oracle home if this command was successful.

4.2.3 OPatch napply - Windows Platform Steps

Open the command prompt as Administrator to execute the following steps:

1. (Optional) Run OPatch with the -report flag to produce a log to review:
   
   a. Navigate to the binary patches directory:
   
   WLS_SPB_12.2.1.4.<VERSION>\binary_patches
   
   b. Run opatch napply:
   
   ORACLE_HOME\OPatch\opatch napply -report -oh <ORACLE_HOME> -phBaseFile windows64_patchlist.txt
• The windows64_patchlist.txt file is bundled into the SPB, so you do not need to provide a path to the file.
• Once the opatch napply -report command is executed, review the output of the command and the log files it produces to be aware of any possible issues.
• No changes have been made to your Oracle home even though the command output may say that patches were successfully applied.

2. Run OPatch to install the patches included in the SPB:

a. Navigate to the binary patches directory:

   WLS_SPB_12.2.1.4.<VERSION>/binary_patches

b. Run opatch napply:

  ORACLE_HOME\OPatch\opatch napply -oh <ORACLE_HOME> -phBaseFile windows64_patchlist.txt

• The windows64_patchlist.txt file is bundled into the SPB and you do not need to provide a path to the file.
• Once the opatch napply command is executed, review the output of the command and the log files it produces to be aware of any possible issues.
• Changes have been made to your Oracle home if this command is successful.

Section 5: Post Installation Steps

1. Verify SPB Patches in ORACLE_HOME inventory.
   
   ORACLE_HOME/OPatch/opatch lspatches

Note: Refer to the SPB patch list under Section 2 to understand the list of expected patches in the lspatches output. For example, the most popular generic installation will have a minimum of the WLS PSU, Coherence and ADR patches. Other components may not be installed, and, in some cases, patching will be skipped.

2. Refer to the following document for important post-installation information:
   
   Doc ID 2764668.1 for Security Advice and Post-Install Information for Oracle WebLogic Server PSUs
   https://support.oracle.com/epmos/faces/DocumentDisplay?id=2764668.1
   
   
3. Start all WebLogic Servers.

 

Section 6: Rollback Steps

For a complete rollback, use the backups (created before the application of SPB) to restore the ORACLE_HOME and CENTRAL INVENTORY.

• If OPatch was upgraded and you need to roll back to the very beginning, then you must restore from backup.
• If it is confirmed that the OPatch upgrade was successful, and you only need to roll back the SPB patches, then use the following steps:

1. If you have applied any patches to resolve conflicts since applying the SPB, first ensure these overlay patches are rolled back first.

 

2. Use the following commands to roll back all patches included in the SPB:
   
   a. Navigate to the binary patches directory:
   
       WLS_SPB_12.2.1.4.<VERSION>/binary_patches
   
   b. Run the opatch nrollback command:
   
     ORACLE_HOME/OPatch/opatch nrollback -oh <ORACLE_HOME> -idFile rollback_patchlist.txt
• This command will rollback all patches included with the past and present Stack Patch Bundles. If any patch is not present, OPatch will return the patch is "not present in the Oracle Home".

 

• OPatch will re-activate any previously superseded patch (e.g., the WLS PSU). Any previously applied overlay patches will not be re-applied. Unless the goal is to apply a newer SPB or PSU, in order to get back to an original state, you must re-apply any overlay patches you previously had applied with the WLS PSU.

IMPORTANT: Oracle recommends that you do not roll back individual patches. Doing so can impact the integrity of the other patches. Note that some patches are specific to the SPB only.