Fixes are available
PH44393:crash in ap_scan_http_field_content with interim fix IFPH43122
PH44271: Vulnerability in IBM HTTP Server used by IBM WebSphere Application Server due to Expat (CVE-2022-25315 CVSS 7.8 and more)
PH44829:Multiple vulnerabilities in IBM HTTP Server used by IBM WebSphere Application Server (CVE-2022-22720 CVSS 7.3 and more)
APAR status
Closed as program error.
Error description
Crash in ap_scan_http_field_content with ifix IFPH43122 9.0 only, n/a on z/OS.
Local fix
Problem summary
**************************************************************** * USERS AFFECTED: All users of IBM HTTP Server on * * distributed * * platforms with ifix IFPH43122 * **************************************************************** * PROBLEM DESCRIPTION: IHS can crash in function * * ap_scan_http_field_content() when * * processing special characters in URLs * * or headers. * **************************************************************** * RECOMMENDATION: * **************************************************************** A build/packaging error omitted the fix for PH43887 from the interim fixes for PH43122. New tests added for this issue during PH43887 did not catch the omission. Note: IBM Installation Manager will warn users upgrading to 9.0.5.11 that PH44393 will be lost. This warning can be ignored and will be silenced in 9.0.5.12 and later.
Problem conclusion
New interim fixes will be issued under PH44393. No fixpack is affected. If ANY interim fix was installed on 9.0.5.10, installation of 9.0.5.11 will likely report: WARNING: One or more fixes will be uninstalled when IBM HTTP Server for WebSphere Application Server is updated to 9.0.5.11 - "PH42587 in the fix package 9.0.5.10-WS-WASIHS..." - "PH43887..." - "PH44393..." This error can be ignored. No replacement ifix is necessary and the problem will not be reported in 9.0.5.12 or later. The fix for this APAR is targeted for inclusion in IBM HTTP Server fix pack 9.0.5.11. For more information, see 'Recommended Updates for WebSphere Application Server': https://www.ibm.com/support/pages/node/715553
Temporary fix
Comments
APAR Information
APAR number
PH44393
Reported component name
IBM HTTP SERVER
Reported component ID
5724J0801
Reported release
900
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt / Xsystem
Submitted date
2022-02-25
Closed date
2022-02-25
Last modified date
2022-03-07
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
Fix information
Fixed component name
IBM HTTP SERVER
Fixed component ID
5724J0801
Applicable component levels
R900 PSY
UP
[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSEQTJ","label":"IBM HTTP Server"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"9.0","Line of Business":{"code":"LOB45","label":"Automation"}}]
Document Information
Modified date:
03 May 2022