Thinkfree Office JDK Security Vulnerability Remediation Guide

1. Overview

This guide describes the remediation steps for each operating environment in response to the security vulnerability CVE-2026-91403.

This guide covers the Installer, Single container, and Integrated container environments of Thinkfree Office.

2. Remediation for the Installer Environment

2.1 Update the CA Certificate Package

Log in to the production server where Thinkfree Office is installed and run the following commands in order.

① Check the existing certificate package version

rpm -q ca-certificates

② Update the certificate package

sudo dnf --refresh upgrade -y ca-certificates

③ Refresh the system certificate store

sudo update-ca-trust extract

④ Check the updated package version

rpm -q ca-certificates

Verified security patch version on Rocky Linux 8.9:

ca-certificates-2026.2.92_v9.0.319-81.3.el8_9.noarch

2.2 Restart the Thinkfree Office Service

After updating the certificates, restart the web office service to apply the changes.

./hancom_service restart

After the restart, confirm that you can access the web office and that the main features work normally.

A separate restart of the DB service is not required.

3. Remediation for the Single Container Environment

3.1 Modify the Dockerfile

Add the ca-certificates update steps to the existing OpenJDK 17 installation statement in the Dockerfile.

[Before]

RUN yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm && \
    yum install -y java-17-openjdk-devel && \
    yum install -y httpd && \
    yum install -y python3.12 python3.12-pip \
    ...

[After]

RUN yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm && \
    yum install -y java-17-openjdk-devel ca-certificates && \
    yum --refresh upgrade -y ca-certificates && \
    update-ca-trust extract && \
    yum install -y httpd && \
    yum install -y python3.12 python3.12-pip \
    ...

※ The code above is only part of the Dockerfile. Keep the existing commands that follow.

3.2 Rebuild and Apply the weboffice Container Image

Use the modified Dockerfile to rebuild only the weboffice container image and apply the changes.

① Move to the Docker Compose directory

Move to the directory where the docker-compose.yml file is located.

② Rebuild and apply the WAS container image

sudo docker compose up -d --build --force-recreate --no-deps weboffice

This command rebuilds only the weboffice image and recreates the container. The DB and other services are not rebuilt or restarted.

※ weboffice refers to the service name defined in Docker Compose. Change it according to your actual environment.

③ Check the weboffice container status

sudo docker compose ps weboffice

Confirm that the weboffice container is running normally.

3.3 Verify the Security Patch

Access the weboffice container created from the new image.

docker exec -it thinkfree-weboffice /bin/bash

Inside the container, run the following command to check the certificate package version.

rpm -q ca-certificates

Verified security patch version on Rocky Linux 8.9 is as follows.

ca-certificates-2026.2.92_v9.0.319-81.3.el8_10.noarch

After checking, exit the container with the exit command.

3.4 Replace the Container and Verify the Service

Stop the existing container, replace it with the new image, and then confirm that it works normally.

Precautions

• Confirm whether the data of the existing container has been backed up.
• If you use a Named Volume or Bind Mount, keep the existing data connection settings.
• If data is stored only inside the container, back up and migrate the data before replacing it with the new container.

4. Remediation for the Integrated Container Environment

4.1 Delivery of the Security-Patched Image

A new integrated container image with the ca-certificates security patch applied will be provided.

4.2 Apply the New Image

① Download the new container image

Depending on how the image is provided, choose one of the following methods to download or load the new image.

• Provided via Docker Hub: Download the new image with the docker pull command.

sudo docker pull <image name:tag>

• Provided as an image file: Load the received image file with the docker load command.

sudo docker load -i <image file name.tar.gz>

② Apply the new container

1. Stop the existing container.
2. Create a container from the new image and apply the same environment variables and volume settings as the existing one.
3. Confirm that the service works normally.

Precautions

• Backing up the data of the existing container before applying the new image is recommended.
• If you use a Named Volume or Bind Mount, you must keep the existing volume and mount settings.
• If data is stored only inside the container, back up and migrate the data to the new container before replacing the container.