IJ54176: UPDATES TO XDH KEY AGREEMENT, AESGCM ALGORITHMS IN IBMJCEPLUS, IBMJCEPLUSFIPS PROVIDERS.

APAR status

• Closed as program error.

Error description

• Error Message: Client application has out of memory error when
  using XDHKeyAgreement algorithm.
  .
  Stack Trace: N/A
  .
  N/A
  

Local fix

• Java 8 SR8 FP30 introduced support for XDH named curves in JSSE.
  
  To disable XDH curves, update the jdk.disabled.namedCurves
  security property in the java.security file to include the XDH
  curves, x25519 and x448.
  
  Alternative use the jdk.tls.namedGroups system property as
  documented in IBM SDK, Java Technology Edition, Version 8 to
  disable XDH curves..
  

Problem summary

• Updates to XDH Key Agreement, AESGCM algorithms in IBMJCEPlus,
  IBMJCEPlusFIPS providers.
  
  Issue 1: IBMJCEPlus, IBMJCEPlusProviders leak memory while
  computing secret using XDHKeyAgreement. After computing secret,
  these providers were not freeing an internal context variable
  used in computing secret.
  
  Issue 2: IBMJCEPlus, IBMJCEPlusProviders were not checking for
  validity of a newly allocated AESGCM context variable. In rare
  instances, context creation could fail and result in incorrect
  behavior of these providers..
  

Problem conclusion

• The JVM has been updated to fix issue 1 and issue 2.
  
  GIT issues: 771, 778
  RTC problem report: 152507
  Austin APAR: IJ53682
  
  The affected files: ibmjceplus.jar and native libraries
  (libjgskit.so and jgskit.dll)
  ibmjceplus.jar build dates:
  FIPS140-2 - Build-Date: 20250314
  FIPS140-3 - Build-Date: 20250314
  
  The fixes were delivered for: Java 8.0 SR8 FP45.
  
  .
  This APAR will be fixed in the following Releases:
  .
  IBM Semeru Runtimes
  IBM SDK, Java Technology Edition
     8    SR8 FP45  (8.0.8.45)
  .
  Downloads and supplementary documentation can be found at the
  following locations:
  - For non z/OS operating systems:
    - IBM Semeru Runtimes, Version 11 and later
      https://www.ibm.com/semeru-runtimes/downloads/
    - IBM SDK, Java Technology Edition, Version 8
      https://www.ibm.com/support/pages/java-sdk-downloads/
  - For the z/OS operating system:
    - Java SDK Products on z/OS
      https://www.ibm.com/support/pages/java-sdk-products-zos
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels