PH55695: WEB SERVICES APPLICATION IBMASYNCRSP.EAR MAY BE FLAGGED BY SCANNERS

APAR status

• Closed as program error.

Error description

• The web.xml of web services application ibmasyncrsp.ear has
  individual HTTP methods listed in <security-constraint> which
  may cause some scanners to incorrectly report this as security
  vulnerability.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  IBM WebSphere Application Server users of   *
  *                  JAX-WS Web services applications            *
  ****************************************************************
  * PROBLEM DESCRIPTION: HTTP methods in web.xml of              *
  *                      ibmasyncrsp.ear may cause scanner to    *
  *                      incorrectly report vulnerability.       *
  ****************************************************************
  * RECOMMENDATION:  Install a fixpack which includes this APAR  *
  ****************************************************************
  The web.xml of web services application ibmasyncrsp.ear has
  individual HTTP methods listed in <security-constraint> which
  may cause some scanners to incorrectly report this as
  vulnerability.
  

Problem conclusion

• The web.xml of web services application ibmasyncrsp.ear has
  individual HTTP methods listed in <security-constraint> which
  may cause some scanners to incorrectly report this as security
  vulnerability.
  The web.xml of web services application ibmasyncrsp.ear is
  updated to remove individual HTTP methods from web.xml.
  
  The fix for this APAR is targeted for inclusion in fix packs
  8.5.5.25 and 9.0.5.18 For more information, see 'Recommended
  Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels