Fixes are available
8.0.0.7: WebSphere Application Server V8.0 Fix Pack 7
8.0.0.8: WebSphere Application Server V8.0 Fix Pack 8
8.0.0.9: WebSphere Application Server V8.0 Fix Pack 9
8.0.0.10: WebSphere Application Server V8.0 Fix Pack 10
8.0.0.11: WebSphere Application Server V8.0 Fix Pack 11
8.0.0.12: WebSphere Application Server V8.0 Fix Pack 12
8.0.0.13: WebSphere Application Server V8.0 Fix Pack 13
8.0.0.14: WebSphere Application Server V8.0 Fix Pack 14
8.0.0.15: WebSphere Application Server V8.0 Fix Pack 15
APAR status
Closed as program error.
Error description
Cookie's secure attribute is not set in a secure connection
Local fix
Problem summary
**************************************************************** * USERS AFFECTED: IBM WebSphere Application Server version * * 8.0 and 8.5 users of JSF MyFaces * **************************************************************** * PROBLEM DESCRIPTION: JSF MyFaces Flash scope cookies do * * not have the secure attribute set in * * a secure connection. * **************************************************************** * RECOMMENDATION: * **************************************************************** The Flash cookies are always sent in clear text. However, when a Flash cookie is sent in a secure connection, the cookie's secure attribute is not set.
Problem conclusion
These cookies do not contain sensitive information but will be updated. The following fix was pulled into WebSphere Application Server from the Apache MyFaces Open Source Community to resolve this problem: https://issues.apache.org/jira/browse/MYFACES-3177 The fix for this APAR is currently targeted for inclusion in fix pack 8.0.0.7 and the fix pack following 8.5.0.2. Please refer to the recommended updates page for delivery information: http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
Temporary fix
Comments
APAR Information
APAR number
PM82121
Reported component name
WEBSPHERE APP S
Reported component ID
5724J0800
Reported release
800
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt
Submitted date
2013-02-05
Closed date
2013-04-10
Last modified date
2013-04-10
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
PM85504 PM85505
Fix information
Fixed component name
WEBSPHERE APP S
Fixed component ID
5724J0800
Applicable component levels
R800 PSY
UP
R850 PSY
UP
Document Information
Modified date:
29 October 2021