STIGQter: STIG Summary: IBM WebSphere Liberty Server Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Apr 2026:

The WebSphere Liberty Server must remove all export ciphers to protect the confidentiality and integrity of transmitted information.

DISA Rule

SV-250347r961632_rule

Vulnerability Number

V-250347

Group Title

SRG-APP-000439-AS-000274

Rule Version

IBMW-LS-001110

Severity

CAT II

CCI(s)

• CCI-002418 - Protect the confidentiality and/or integrity of transmitted information.

Weight

10

Fix Recommendation

Review the ${server.config.dir}/server.xml file and if needed, modify the "enabledCiphers" setting for each affected SSL configuration.

<ssl id="myDefaultSSLConfig"
keyStoreRef="defaultKeyStore"
trustStoreRef="defaultTrustStore"
clientAuthentication="true"
sslProtocol="TLS"
enabledCiphers="SSL_xxx_yyy_zzz"/>

where xxx, yyy, and zzz do not contain "EXPORT".

Check Contents

Review the ${server.config.dir}/server.xml file and check the "enabledCiphers" setting. If any of the ciphers specified in the enabledCiphers setting contains the word "EXPORT", this is a finding.

<ssl id="myDefaultSSLConfig"
keyStoreRef="defaultKeyStore"
trustStoreRef="defaultTrustStore"
clientAuthentication="true"
sslProtocol="TLS"
enabledCiphers="SSL_xxx_yyy_zzz"/>

Vulnerability Number

V-250347

Documentable

False

Rule Version

IBMW-LS-001110

Severity Override Guidance

Review the ${server.config.dir}/server.xml file and check the "enabledCiphers" setting. If any of the ciphers specified in the enabledCiphers setting contains the word "EXPORT", this is a finding.

<ssl id="myDefaultSSLConfig"
keyStoreRef="defaultKeyStore"
trustStoreRef="defaultTrustStore"
clientAuthentication="true"
sslProtocol="TLS"
enabledCiphers="SSL_xxx_yyy_zzz"/>

Check Content Reference

M

Target Key

5424