PM62380: WORKFLOW VALIDATOR EXPOSES ENCRYPTED PASSWORD

Rational Software Architect Interim Fix 1 for 8.0.4.2
Rational Software Architect for WebSphere Software Interim Fix 1 for 8.0.4.2

APAR status

• Closed as program error.

Error description

• RSA Workflow validator exposes encrypted password.
  
  Steps to repro:
  
  1. create topology with core.unit and windows user
  
  2. create requirement on unit for windows user
  
  3. configure automation signature for core.unit
  
  4. create in attribute, match with windows user password
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  Automation signature parameters that are based on encrypted
  attributes do not carry that encryption forward, and
  therefore result in the possibilty of the attribute value
  being exposed. One example of this was the workflow
  validation when a password value did not match the expected
  value from the signature.
  

Problem conclusion

• Solution was to add the necessary encyrption to the extended
  attributes
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SW ARCHITECT WI

• Fixed component ID

  5724I7001

Applicable component levels

• R804 PSN

     UP