PH56383: CONNECTION KEPT ALIVE UNDER ERROR CONDITION

APAR status

• Closed as program error.

Error description

• When a request contains both Content-Length and
  Transfer-Encoding, the connection is kept open for subsequent
  requests.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM HTTP Server                *
  ****************************************************************
  * PROBLEM DESCRIPTION: When a request with both Content-Length *
  *                      and Transfer-Encoding is                *
  *                      processed, Content-Length is ignored as *
  *                      expected but the TCP connection         *
  *                      is kept open to read a subsequent       *
  *                      request.                                *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  Scanners assume that the connection being kept open is a sign
  that Transfer-Encoding was not used, causing false positives for
  HTTP request smuggling.
  

Problem conclusion

• The code was updated to initialize the connection state prior to
  the check for C-L + T-E, so the side effect of having both C-L
  and T-E are effective.
  
  The fix for this APAR is targeted for inclusion in IBM HTTP
  Server fix packs 8.5.5.25 and 9.0.5.18. For more information, se
  'Recommended Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM HTTP SERVER

• Fixed component ID

  5724J0801

Applicable component levels