APAR status
Closed as program error.
Error description
Error Message, as reported by customer: java.lang.ArrayIndexOutOfBoundsException: Array index out of range: 64 Stack Trace, if applicable: javax.net.ssl.SSLException: java.lang.ArrayIndexOutOfBoundsException: Array index out of range: 64 at com.ibm.jsse2.o.a(o.java:10) at com.ibm.jsse2.SSLSocketImpl.a(SSLSocketImpl.java:216) at com.ibm.jsse2.SSLSocketImpl.a(SSLSocketImpl.java:864) at com.ibm.jsse2.SSLSocketImpl.a(SSLSocketImpl.java:618) at com.ibm.jsse2.SSLSocketImpl.a(SSLSocketImpl.java:500) at com.ibm.jsse2.SSLSocketImpl.startHandshake(SSLSocketImpl.java:22 0) at com.ibm.net.ssl.www2.protocol.https.c.afterConnect(c.java:184) at com.ibm.net.ssl.www2.protocol.https.d.connect(d.java:40) at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpU RLConnection.java:1207) at java.net.HttpURLConnection.getResponseCode(HttpURLConnection.jav a:390) at com.ibm.net.ssl.www2.protocol.https.b.getResponseCode(b.java:29) Other Error Information, as reported by customer: The problem happens when the server side uses large DH key (e.g. 2048 bit) in TLSv1/TLSv1.1 key exchange.
Local fix
Disable cipher suites which uses DH/DHE key exchange.
Problem summary
When TLSv1 or TLSv1.1 was used, the large pre-master secret generated from 2048 bit DH key was not properly hashed to derive the master secret. ERROR DESCRIPTION: When SSL server was using 2048 bit or above DH key exchange, handshake will fail with ArrayIndexOutOfBoundsException on the SSL client.
Problem conclusion
A fix is made to IBMJSSE2 and IBMJCE provider to handle large pre-master secret in TLSv1 and TLSv1.1 The associated Hursley RTC Problem Report is 93670 and 94644 The associated Austin CMVC defect is 116692 and 116765 JVMs affected: Java 6.0, Java 626, Java 7.0, Java 727 and Java 8 The fix was delivered for Java 6.0 SR16FP7, Java 626 SR8FP7, Java 7.0 SR9FP10, Java 727 SR3FP10 and Java 8 SR1FP10 The affected jar are "ibmjsseprovider2.jar" and "ibmjceprovider.jar". The build level of ibmjceprovider.jar for the affected releases is "20150604". The build level of ibmjsseprovider2.jar for the affected releases is "20150604".
Temporary fix
Comments
APAR Information
APAR number
IV73472
Reported component name
JAVA SECURE SOC
Reported component ID
TIVSECJSS
Reported release
100
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt
Submitted date
2015-05-21
Closed date
2015-07-13
Last modified date
2015-07-16
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
PI45389
Fix information
Fixed component name
JAVA SECURE SOC
Fixed component ID
TIVSECJSS
Applicable component levels
R100 PSY
UP
[{"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSCZL3Z","label":"JSSE"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"100","Edition":"","Line of Business":{"code":"","label":""}}]
Document Information
Modified date:
16 July 2015