APAR status
Closed as program error.
Error description
Error Message: N/A . Stack Trace: N/A . All certificates in the server's certificate chain are not validated to ensure compliance with the client's signature extension
Local fix
Problem summary
Many implementations do not follow a strict enforcement of RFC 5246 - TLS 1.2 Section 7.4.1.4.1. Signature Algorithms. Oracle's implementation and therefore, IBM's implementation do not validate that the entire server's certificate and its chain are in compliance with the signature extension that the client sent. Due to the incompatibility nature of such a change and the breakage which can ensue, a system property will be added, where the user can enable if they want strict compliance. Otherwise, the behavior will be unchanged. com.ibm.jsse2.strictServerSigCheck = true <PIPE> false default - false - do not verify that server's certificate chain matches client's signature constraint true - validate that server's certificate chain is in compliance with client's signature algorithm extension
Problem conclusion
Binary affected - ibmjsseprovider2.jar GIT Issue - #281 RTC - 149627 Build - 8.0 build_20230815--93 Build - FIPS140-3 Tech Preview - 8.0 build_20230815--96 JVM to be delivered in - JDK 8 SR8FP15 . This APAR will be fixed in the following Releases: . IBM SDK, Java Technology Edition 8 SR8 FP15 (8.0.8.15) . Contact your IBM Product's Service Team for these Service Refreshes and Fix Packs. For those running stand-alone, information about the available maintenance can be found at: https://www.ibm.com/support/pages/java-sdk
Temporary fix
Comments
APAR Information
APAR number
IJ47941
Reported component name
SECURITY
Reported component ID
620700125
Reported release
270
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt / Xsystem
Submitted date
2023-08-19
Closed date
2023-08-23
Last modified date
2023-08-23
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
Fix information
Fixed component name
SECURITY
Fixed component ID
620700125
Applicable component levels
[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSNVBF","label":"Runtimes for Java Technology"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"270","Line of Business":{"code":"LOB36","label":"IBM Automation"}}]
Document Information
Modified date:
24 August 2023