PH43887: PH42862 INTERIM FIXES MAY CRASH IN IHS 9.0

PH43887:PH42862 interim fixes may crash in ihs 9.0
PH43122: Vulnerability in IBM HTTP Server used by IBM WebSphere Application Server (CVE-2022-23852 CVSS 9.8 and more)
PH44393:crash in ap_scan_http_field_content with interim fix IFPH43122
PH44271: Vulnerability in IBM HTTP Server used by IBM WebSphere Application Server due to Expat (CVE-2022-25315 CVSS 7.8 and more)
PH44829:Multiple vulnerabilities in IBM HTTP Server used by IBM WebSphere Application Server (CVE-2022-22720 CVSS 7.3 and more)

APAR status

• Closed as program error.

Error description

• PH42862 interim fixes may crash in IHS 9.0
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM HTTP Server 9.0 on         *
  *                  distributed platforms with                  *
  *                  IFIX PH42862                                *
  ****************************************************************
  * PROBLEM DESCRIPTION: IHS may crash in function               *
  *                      ap_scan_http_field_content              *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  IHS may crash in function ap_scan_http_field_content.
  Note: This issue does not appear to impact z/OS, so no PTF has
  been generated.
  Note: IBM Installation Manager will warn users upgrading to
  9.0.5.11 that PH43887 will be lost. This warning can be ignored
  and will be silenced in 9.0.5.12 and later.
  

Problem conclusion

• An Interim Fix for PH43887 will supersede IFPH42862.
  This problem never appeared in any fixpack.
  
  If ANY interim fix was installed on 9.0.5.10, installation of
  9.0.5.11 will likely report:
  WARNING: One or more fixes will be uninstalled when IBM HTTP
  Server for WebSphere Application Server is updated to 9.0.5.11
  - "PH42587 in the fix package 9.0.5.10-WS-WASIHS..."
  - "PH43887..."
  - "PH44393..."
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM HTTP SERVER

• Fixed component ID

  5724J0801

Applicable component levels

• R900 PSY

     UP