APAR status
Closed as program error.
Error description
Add a warning message if failed login delay is disabled for Federated Repositories which exposed the server to user enumeration attacks.
Local fix
Problem summary
**************************************************************** * USERS AFFECTED: All users of IBM WebSphere Application * * Server * * who have disabled the failed login delay * * for * * their Federated Repository. * **************************************************************** * PROBLEM DESCRIPTION: Add a warning message if the failed * * login * * delay is disabled for Federated * * Repositories. * **************************************************************** * RECOMMENDATION: * **************************************************************** Disabling the failed login delay is disabled for Federated Repositories exposes the server to user enumeration attacks. Added a warning message if it is disabled.
Problem conclusion
In traditional WebSphere Application Server, the CWWIM5132W message is logged to the SystemOut log when the failed login delay is disabled. In Open Liberty and WebSphere Liberty Application Server, the CWIMK0012W message is logged to the SystemOut log when the failed login delay is disabled. The fix for this APAR is targeted for inclusion in fix packs 9.0.5.13 and 8.5.5.22 for traditional WebSphere Application Server and 22.0.0.7 for Open Liberty and WebSphere Liberty. For more information, see 'Recommended Updates for WebSphere Application Server': https://www.ibm.com/support/pages/node/715553
Temporary fix
Comments
APAR Information
APAR number
PH46082
Reported component name
WEBS APP SERV N
Reported component ID
5724H8800
Reported release
900
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt / Xsystem
Submitted date
2022-05-03
Closed date
2022-06-30
Last modified date
2022-06-30
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
Fix information
Fixed component name
WEBS APP SERV N
Fixed component ID
5724H8800
Applicable component levels
[{"Line of Business":{"code":"LOB45","label":"Automation"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"9.0"}]
Document Information
Modified date:
01 July 2022