PH42293: THE HTTP LISTENER IS VULNERABLE TO THE SWEET32 BIRTHDAY ATTACK

APAR status

• Closed as program error.

Error description

• The HTTP Listener has a SWEET32 birthday attack security
  vulnerability when operating in SSL mode, which indicates that
  3DES ciphers can be used when establishing a secure connection.
  

Local fix

• ITXCQ - ITX00060940
  GM / AD
  Circumvention: None
  

Problem summary

• Users Affected:
  IBM Transformation Extender using HTTP Listener.
  
  Problem Description:
  The HTTP Listener is Vulnerable to the SWEET32 birthday attack.
  
  Platforms Affected:
  All
  

Problem conclusion

• Added fix to prevent SWEET32 birthday attack in GSK module.
  
  Applies to:
  9.0.0.4, 10.0.0.0, 10.0.3.0, 10.1.0.1, 10.1.1.0
  
  Fixed in the next service packs and releases.
  
  To obtain the fix for this APAR:
  
  To see if the next service pack or product release is available,
  check the IBM Transformation Extender Release Notes page:
  https://www.ibm.com/support/docview.wss?uid=swg27008337
  
  If the service pack or product release is available, download it
  from Fix Central:
  http://www.ibm.com/support/fixcentral/
  
  If the service pack or product release is not available and you
  require the APAR fix immediately, request a Limited Availability
  Interim Fix (LAIF) by opening a case:
  https://www.ibm.com/mysupport/
  
  Prior to version 9.0.0, IBM Transformation Extender was called
  IBM WebSphere Transformation Extender.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  ITX

• Fixed component ID

  5724Q2300

Applicable component levels