IBM Support

PI06341: The WebSphere eXtreme Scale Client might allow the cached HTTP session data of one user to be accessed by a different user.

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • In certain configurations, a security vulnerability exists in
    WebSphere eXtreme Scale Client, the client that is used with
    WebSphere eXtreme Scale and WebSphere DataPower XC10
    Appliance. WebSphere eXtreme Scale Client might allow cached
    HTTP session data of one user to be accessed by a different
    user when both users access the same web container.
    

Local fix

  • Disabling the caching by any other servers which are  infront
    of XS server.
    

Problem summary

  • ****************************************************************
    * USERS AFFECTED:  Users of WebSphere eXtreme Scale Client     *
    *                  with WebSphere eXtreme Scale HTTP session   *
    *                  management.                                 *
    ****************************************************************
    * PROBLEM DESCRIPTION: The WebSphere eXtreme Scale Client      *
    *                      might allow the cached HTTP session     *
    *                      data of one user to be accessed by a    *
    *                      different user.                         *
    ****************************************************************
    * RECOMMENDATION:                                              *
    ****************************************************************
    In certain configurations, a security vulnerability exists in
    WebSphere eXtreme Scale Client, the client that is used with
    WebSphere eXtreme Scale and WebSphere DataPower XC10
    Appliance. WebSphere eXtreme Scale Client might allow cached
    HTTP session data of one user to be accessed by a different
    user when both users access the same web container.
    

Problem conclusion

  • A program change has been made to fix the problem. See
    http://www-01.ibm.com/support/docview.wss?uid=swg21664641 for
    information about the problem and about how to get the fix.
    

Temporary fix

Comments

APAR Information

  • APAR number

    PI06341

  • Reported component name

    WS EXTREME SCAL

  • Reported component ID

    5724X6702

  • Reported release

    850

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt

  • Submitted date

    2013-11-17

  • Closed date

    2014-02-18

  • Last modified date

    2014-02-18

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

    PI09665 PI09901 PI09902

Fix information

  • Fixed component name

    WS EXTREME SCAL

  • Fixed component ID

    5724X6702

Applicable component levels

  • R711 PSY

       UP

  • R850 PSY

       UP

  • R860 PSY

       UP

[{"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSTVLU","label":"WebSphere eXtreme Scale"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"850","Edition":"","Line of Business":{"code":"LOB15","label":"Integration"}}]

Document Information

Modified date:
18 February 2014