PH46082: Add warning message when failed login delay is disabled

APAR status

• Closed as program error.

Error description

• Add a warning message if failed login delay is disabled for
  Federated Repositories which exposed the server to user
  enumeration attacks.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server                                      *
  *                  who have disabled the failed login delay    *
  *                  for                                         *
  *                  their Federated Repository.                 *
  ****************************************************************
  * PROBLEM DESCRIPTION: Add a warning message if the failed     *
  *                      login                                   *
  *                      delay is disabled for Federated         *
  *                      Repositories.                           *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  Disabling the failed login delay is disabled for
  Federated Repositories exposes the server to user
  enumeration attacks. Added a warning message if it is disabled.
  

Problem conclusion

• In traditional WebSphere Application Server, the CWWIM5132W
  message is logged to the SystemOut log when the failed login
  delay is disabled.
  
  In Open Liberty and WebSphere Liberty Application Server, the
  CWIMK0012W message is logged to the SystemOut log when the
  failed login delay is disabled.
  
  The fix for this APAR is targeted for inclusion in fix packs
  9.0.5.13 and 8.5.5.22 for traditional WebSphere Application
  Server and 22.0.0.7 for Open Liberty and WebSphere Liberty. For
  more information, see 'Recommended Updates for WebSphere
  Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels