IBM Support

IT35027: MQ appliance may unexpectedly reload while accessing an SSL session

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • An MQ appliance with active administrative SSL/TLS connections
    reloads unexpectedly.
    
    The decoded error report shows a memory exception (SIGSEGV) with
    functions in libcrypto.so/libssl.so libraries at the top of the
    stack
    

Local fix

Problem summary

  • ****************************************************************
    USERS AFFECTED:
    All MQ appliance users making SSL/TLS administrative connections
    to or from the appliance, for example to the administrative
    WebUI console or webUI over HTTPS, or where an external LDAP
    server has been configured through the Role Based Management
    (RBM) configuration.
    
    Please note that TLS-protected messaging channels to/from other
    IBM MQ queue managers or clients use alternate cryptographic
    libraries and are not a trigger condition for this issue,
    although a reload of the IBM MQ appliance will cause existing
    channel connections to terminate.
    
    
    Platforms affected:
    MultiPlatform
    
    ****************************************************************
    PROBLEM DESCRIPTION:
    A defect in reference counting for internal SSL objects caused a
    use-after-free error resulting in the reload.
    

Problem conclusion

  • The IBM MQ appliance code has been modified to prevent the the
    use-after-free error.
    
    ---------------------------------------------------------------
    The fix is targeted for delivery in the following PTFs:
    
    Version    Maintenance Level
    v9.1 LTS   9.1.0.9
    v9.2 LTS   9.2.0.3
    v9.x CD    9.2.3
    
    The latest available maintenance can be obtained from
    'WebSphere MQ Recommended Fixes'
    http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
    
    If the maintenance level is not yet available information on
    its planned availability can be found in 'WebSphere MQ
    Planned Maintenance Release Dates'
    http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
    ---------------------------------------------------------------
    

Temporary fix

Comments

APAR Information

  • APAR number

    IT35027

  • Reported component name

    MQ APPL M2002 V

  • Reported component ID

    5737H4701

  • Reported release

    920

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    YesHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2020-11-23

  • Closed date

    2021-06-30

  • Last modified date

    2021-11-03

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    MQ APPL M2002 V

  • Fixed component ID

    5737H4701

Applicable component levels

[{"Line of Business":{"code":"LOB36","label":"IBM Automation"},"Business Unit":{"code":"BU053","label":"Cloud \u0026 Data Platform"},"Product":{"code":"SS5K6E","label":"IBM MQ Appliance"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"920"}]

Document Information

Modified date:
04 November 2021