JR49123: BPMCONFIG LOG FILE CONTAINS CONFIDENTIAL IBM BPM ADMIN PASSWORD INFORMATION IN CUSTOM NODES

Version 8.5 Refresh Pack 5 for the IBM Business Process Manager products
Version 8.5.0 Fix Pack 2 for the IBM Business Process Manager products

APAR status

• Closed as program error.

Error description

• After creating an IBM BPM 8501 Advanced Process Center
  environment using the BPMConfig command, the IBM BPM admin
  password information is written to the
  <install_root>/logs/config/BPMConfig_<timestamp>.log file. For
  example:
  
  2014-01-22 04:39.42.126
  com.ibm.bpm.config.util.ConfigHelper.invokeAdminCommand():
  ENTRY Class:
  com.ibm.bpm.config.model.complexType.ConfigModelNode Class
  prefix: node
  Class scope: node Field: name Property: name Simple type:
  WasTopologyName [...]
  bpm.de.authenticationAlias.2.password=Password,
  bpm.de.name=BPM,[...]
  

Local fix

• No Local fix
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  IBM BPM V8.5.0.1 Advanced, Standard, and    *
  *                  Express                                     *
  ****************************************************************
  * PROBLEM DESCRIPTION: After creating an IBM BPM 8501          *
  *                      Advanced Process Center environment     *
  *                      using the BPMConfig command, the IBM    *
  *                      BPM admin password information is       *
  *                      written to the                          *
  *                      <install_root>/logs/config/BPMConfig_<t *
  *                      imestamp>.log.                          *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  IBM BPM user password information must not be written to any
  IBM BPM related log file.
  

Problem conclusion

• A fix is available so that the password is no longer written
  to the BPMConfig_<timestamp>.log file.
  
  On Fix Central (http://www.ibm.com/support/fixcentral), search
  for JR49123:
  
   1. Select the product group, product, installed version, and
  platform, and click Continue.
   2. Select APAR or SPR, enter JR49123, and click Continue.
  
  When downloading fix packages, ensure that you also download
  the readme file for each fix. Review each readme file for
  additional installation instructions and information about the
  fix.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  BPM ADVANCED

• Fixed component ID

  5725C9400

Applicable component levels

• R800 PSY

     UP