CVE-2023-50314 is a Medium severity (CVSS 5.3) certificate validation flaw in IBM WebSphere Application Server Liberty versions 17.0.0.3 through 24.0.0.8. An attacker with network access and a certificate from a trusted authority could spoof a server. Apply interim fix PH58796 or Liberty 24.0.0.9 and later.
What's affected
Product: IBM WebSphere Application Server Liberty. Affected: 17.0.0.3 through 24.0.0.8. Fixed: apply interim fix PH58796, after upgrading to the minimum fix pack level the interim fix requires, or apply Liberty fix pack 24.0.0.9 or later. IBM lists the fix pack's availability as targeted for the third quarter of 2024. IBM's bulletin says there are no workarounds or mitigations. NVD published the record on 14 August 2024.
Severity: NVD scores it 5.3 Medium with vector AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, an adjacent network attacker with high complexity. IBM's bulletin shows the same base score of 5.3, so there is no conflict between sources.
The affected range is wide, covering more than seven years of Liberty releases, so older installs need an upgrade plan as well as the interim fix.
How to check if you're exposed
Check the Liberty version on each server with the product information tool in the Liberty installation.
wlp/bin/productInfo version
Run it from the Liberty install directory on each host. If the version is between 17.0.0.3 and 24.0.0.8 inclusive, you are in the range IBM names. Include servers inside container images, because Liberty is often shipped as a base image and its version is easy to forget.
Then check how outbound TLS is used by applications on that server, since certificate validation is the subject of the issue. Applications that call internal services over TLS are the main place to look.
What to do now
- Apply Liberty fix pack 24.0.0.9 or later, or apply interim fix PH58796 after bringing the server to the minimum fix pack level IBM states.
- Rebuild container images that use a Liberty base image from the patched base.
- Keep Liberty hosts off shared network segments where an adjacent attacker can sit between the server and its peers.
- Use certificate pinning or a private trust store for service to service connections where you can.
- Record each Liberty version in your inventory and add a check for it to your patch cycle.
Why it matters
The weakness is CWE-295, improper certificate validation. IBM says an attacker with network access could carry out spoofing attacks using a certificate issued by a trusted authority to obtain sensitive information. The point is that having a valid certificate is not the same as being the right server. If the code does not check that the certificate matches the party it meant to contact, anyone with a certificate from a trusted authority can pose as that party.
This is a quiet class of bug. Traffic is encrypted, so everything appears normal, but it may be encrypted to the wrong end. The vector reflects the difficulty: the attacker has to be on the adjacent network and the conditions are not easy to reach, so the score is moderate.
KEV is false, and IBM does not claim exploitation. Patch within your normal cycle, and sooner if Liberty servers call external services. The free gold.safeguard.sh/scan scan and the Gold directory can help you track the open source libraries in your own builds.
Quick check
Is there a workaround?
IBM says there are no workarounds or mitigations. The remedy is the interim fix or a later fix pack.
Which versions are affected?
Liberty 17.0.0.3 through 24.0.0.8, per IBM. The fix pack that contains the fix is 24.0.0.9.
Sources
Last reviewed: 19 October 2026.
