PH61948: FAILED VERIFICATION OF SIGNED JAR FILES EMBEDDED WITHIN AN UBER JAR

APAR status

• Closed as program error.

Error description

• Error Message: Caused by: java.lang.SecurityException: JCE
  cannot authenticate the provider BC
  .
  Stack Trace: Caused by: java.lang.SecurityException: JCE cannot
  authenticate the provider BC at
  java.base/javax.crypto.JceSecurity.getInstance(JceSecurity.java:
  229) at
  java.base/javax.crypto.SecretKeyFactory.getInstance(SecretKeyFac
  tory.java:248) at
  org.jasypt.encryption.pbe.StandardPBEByteEncryptor.initialize(St
  andardPBEByteEncryptor.java:733) ... 82 common frames omitted
  Caused by: java.lang.NullPointerException: Cannot invoke
  "java.lang.String.equals(java.lang.Object)" because "moduleName"
  is null at
  java.base/javax.crypto.JceSecurity.verifyProvider(JceSecurity.ja
  va:294) at
  java.base/javax.crypto.JceSecurity$2.apply(JceSecurity.java:385)
  at
  java.base/javax.crypto.JceSecurity$2.apply(JceSecurity.java:374)
  at
  java.base/java.util.concurrent.ConcurrentHashMap.computeIfAbsent
  (ConcurrentHashMap.java:1693) at
  java.base/javax.crypto.JceSecurity.getVerificationResult(JceSecu
  rity.java:374) at
  java.base/javax.crypto.JceSecurity.getInstance(JceSecurity.java:
  225) ... 84 common frames omitted
  .
  NA
  

Local fix

Problem summary

• The security provider verification code examines the url of the
  entity being verified. In the jar embedded in an uber jar case,
  the url ends with ".jar!" rather than ".jar". The check for
  endsWith ".jar" was failing, allowing the code to drop into the
  module name check. As there is not module the returned module
  name is null, resulting in a NullPointerException.
  

Problem conclusion

• Restructure the code to check for both ".jar" and ".jar!".
  .
  This APAR will be fixed in the following Releases:
  .
  IBM Semeru Runtimes
    17              17.0.11.0
    11              11.0.24.0
  .
  Downloads and supplementary documentation can be found at the
  following locations:
  - For the z/OS operating system:
   - Java SDK Products on z/OS
     https://www.ibm.com/support/pages/java-sdk-products-zos
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  JAVA Z/OS 64

• Fixed component ID

  620700104

Applicable component levels