PH64671: CDI COMPONENT FUNCTIONALITY CHANGE. REMOVE WELD PROBE FROM WEBSPHERE

APAR status

• Closed as program error.

Error description

• CDI component functionality change. Remove Weld probe from
  Websphere
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server                                      *
  ****************************************************************
  * PROBLEM DESCRIPTION: When weld development mode is enabled   *
  *                      it would enable a web applicatoin       *
  *                      using javascript with associated CVEs   *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  The customer may raise an issue about CVEs detected in
  WebSphere. While there is very little risk, the customer would
  have to enable Weld Developer Mode on a system exposed to
  attackers (that should never be done) this fix will remove the
  affected javascript (jquery) entirely
  

Problem conclusion

• We removed that code entirely
  
  The fix for this APAR is targeted for inclusion in fix pack
  9.0.5.23. For more information, see 'Recommended Updates for
  WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels