PI22001: POTENTIAL CACHING OF SENSITIVE DATA

Rational Build Forge Interim Fix 3 for 8.0.0.2

APAR status

• Closed as suggestion for future release.

Error description

• Potentially sensitive information sent over SSL may be being
  cached in
  the browser. Some pages were returned with the 'Cache-Control'
  not set,
  meaning that the response can be cached in the requesting
  browsers
  cache. This poses a risk if the page contains sensitive data and
  an
  attacker obtains access to the browser cache.
  
  Recommendation: If caching is not required, the 'Cache-Control'
  header
  should be set to no-cache or no-store.
  
  .
  Business impact ( BusImpact )
  This item discovered during a Security Assessment, risk level is
  Low -
  COSO Level 2
  

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

• There is no sensitive data in these cache,but we improve this by
  set cache flag
  

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels