IT10353: CONFIGURING A WEAK TLS CIPHERSPEC FOR MQV8.0.0.3 IS ALLOWED WITHOUT THE ENVIRONMENT VARIABLE OR THE QM.INI ATTRIBUTE.

APAR status

• Closed as program error.

Error description

• Changes made for IBM MQ v8.0.0.3 intended to prevent non-FIPS
  Transport Level Security(TLS) Cipher Specifications from being
  used without an environment variable of
  AMQ_SSL_WEAK_CIPHER_ENABLE being set.
  
  This change was incomplete, correctly preventing channels with
  non-FIPS Cipher Specifications from starting, but still allowing
  non-FIPS TLS Cipher Specifications to be defined on channels
  without error.
  

Local fix

• N/A
  

Problem summary

• ****************************************************************
  USERS AFFECTED:
  Users of MQ v8.0.0.3 attempting to define or alter a channel to
  use a deprecated cipher specification.
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  MQ 8.0.0.3 contained changes with the intention of checking for
  cipher specification deprecation when a channel was being
  selected defined or altered, as well as checking it at the time
  that the channel is started.
  
  This change was only partially implemented, only preventing the
  channels from starting.
  

Problem conclusion

• The MQ v8 queue manager has been updated so that error AMQ8242
  is returned when defining or altering a channel to use a
  deprecated cipher specification.
  
  Deprecated cipher specifications can be re-enabled as described
  in the follow section of the product knowledge center:
  https://www-01.ibm.com/support/knowledgecenter/SSFKSJ_8.0.0/com.
  ibm.mq.sec.doc/q120565_.htm
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v8.0       8.0.0.4
  
  The latest available maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WMQ BASE MULTIP

• Fixed component ID

  5724H7251

Applicable component levels

• R800 PSY

     UP