PH44393: CRASH IN AP_SCAN_HTTP_FIELD_CONTENT WITH IFIX IFPH43122

PH44393:crash in ap_scan_http_field_content with interim fix IFPH43122
PH44271: Vulnerability in IBM HTTP Server used by IBM WebSphere Application Server due to Expat (CVE-2022-25315 CVSS 7.8 and more)
PH44829:Multiple vulnerabilities in IBM HTTP Server used by IBM WebSphere Application Server (CVE-2022-22720 CVSS 7.3 and more)

APAR status

• Closed as program error.

Error description

• Crash in ap_scan_http_field_content with ifix IFPH43122
  
  9.0 only, n/a on z/OS.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM HTTP Server on             *
  *                  distributed                                 *
  *                  platforms with ifix IFPH43122               *
  ****************************************************************
  * PROBLEM DESCRIPTION: IHS can crash in function               *
  *                      ap_scan_http_field_content() when       *
  *                      processing special characters in URLs   *
  *                      or headers.                             *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  A build/packaging error omitted the fix for PH43887 from the
  interim fixes for PH43122.
  New tests added for this issue during PH43887 did not catch the
  omission.
  Note: IBM Installation Manager will warn users upgrading to
  9.0.5.11 that PH44393 will be lost. This warning can be ignored
  and will be silenced in 9.0.5.12 and later.
  

Problem conclusion

• New interim fixes will be issued under PH44393. No fixpack is
  affected.
  
  If ANY interim fix was installed on 9.0.5.10, installation of
  9.0.5.11 will likely report:
  WARNING: One or more fixes will be uninstalled when IBM HTTP
  Server for WebSphere Application Server is updated to 9.0.5.11
  - "PH42587 in the fix package 9.0.5.10-WS-WASIHS..."
  - "PH43887..."
  - "PH44393..."
  
  This error can be ignored. No replacement ifix is necessary
  and the problem will not be reported in 9.0.5.12 or later.
  
  The fix for this APAR is targeted for inclusion in IBM HTTP
  Server fix pack 9.0.5.11. For more information, see
  'Recommended Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM HTTP SERVER

• Fixed component ID

  5724J0801

Applicable component levels

• R900 PSY

     UP