PH65877: EXEC CICS INVOKE WEBSERVICE FAILS WITH AN ABEND U4038 IN DFHWSSE1

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• A CICS application is communicating with an external partner
  using EXEC CICS INVOKE WEBSERVICE. After the partner upgraded
  their certificate to allow more modern ciphers to be used the
  application started to experience an abend u4038 in DFHWSSE1.
  The log includes :
  
  DFHPI0500 The CICS Pipeline Manager DFHPIPM encountered an
            error while trying to link to program DFHWSSE1.
            The program abended. PIPELINE: xxxxxx
  
  A trace shows :
  
  PI 1202 WSSE EVENT - EXIT  DATA(XSECException::getMessage
             ("SecurityContext::processSignature - Signature
               Invalid"))
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All CICS users.                              *
  ****************************************************************
  * PROBLEM DESCRIPTION: DFHWSSE1 error when processing message  *
  *                      caused by an invalid signature.         *
  ****************************************************************
  A CICS application using WS-Security is communicating with
  an external partner via the EXEC CICS INVOKE WEBSERVICE
  command.
  
  During signature verification, CICS does not correctly handle
  similarly named namespaces, such as wsse11 and wsse.
  Specifically, CICS fails to add the wsse namespace because it
  mistakenly assumes it is already present due to the existence
  of wsse11. This leads to an incorrect hash value generated which
  fails verification.
  

Problem conclusion

• DFHWSSE1 has been modified so that this correctly adds all
  namespaces to the namespace list.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UO07125

Modules/Macros

• DFHWS002 DFHWS003 DFHWS004 DFHWS005 DFHWS006 DFHWS007 DFHWS008
  DFHWS009 DFHWS010 DFHWS011 DFHWS012 DFHWS013 DFHWS014 DFHWS015
  DFHWS016 DFHWS017 DFHWS018 DFHWS019 DFHWS020 DFHWS021 DFHWS022
  DFHWS023 DFHWS024 DFHWS025 DFHWS026 DFHWS027 DFHWS028 DFHWS029
  DFHWS030 DFHWS031 DFHWS032 DFHWS033 DFHWS034 DFHWS035 DFHWS036
  DFHWS037 DFHWS038 DFHWS039 DFHWS040 DFHWS041 DFHWS042 DFHWS043
  DFHWS044 DFHWS045 DFHWS046 DFHWS047 DFHWS048 DFHWS049 DFHWS050
  DFHWS051 DFHWS052 DFHWS053 DFHWS054 DFHWS055 DFHWS056 DFHWS057
  DFHWS058 DFHWS059 DFHWS060 DFHWS061 DFHWS062 DFHWS064 DFHWS065
  DFHWS066 DFHWS068 DFHWS069 DFHWS070 DFHWS071 DFHWS072 DFHWS073
  DFHWS074 DFHWS075 DFHWS076 DFHWS077 DFHWS078 DFHWS079 DFHWS081
  DFHWS082 DFHWS083 DFHWS084 DFHWS085 DFHWS086 DFHWS087 DFHWS088
  DFHWS089 DFHWS090 DFHWS091 DFHWS092 DFHWS122 DFHWS123 DFHWSSE1
  

Fix information

• Fixed component name

  CICS TS Z/OS V6

• Fixed component ID

  5655YA100

Applicable component levels

• R50W PSY UO07125

     UP26/03/19 P F603

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.