IV49984: GENERALSIGNATURE::ENGINEVERIFY, IS NOT CANCELLING THE OPERATION WHEN A SIGNATUREEXCEPTION IS THROWN.

APAR status

• Closed as program error.

Error description

• Error Message: Within the IBMPKCS11Impl security provider
  GeneralSignature::engineVerify, is not cancelling the operation
  when a SignatureException is thrown.
  When attempting to use the underlying hardware for further
  Signature operations, the hardware throws a
  CKR_OPERATION_ACTIVE return code.  Causing the provider to throw
  "PKCS11Exception: Another operation is
  already active".  engineVerify() should catch the
  SignatureException specifically, call cancelOperation()
  then re-throw the SignatureException.  This situation appears to
  exist in engineSign() as well.
  .
  Stack Trace: N/A
  .
  

Local fix

Problem summary

• Within the IBMPKCS11Impl security provider
  GeneralSignature::engineVerify, is not cancelling the operation
  when a SignatureException is thrown.
  When attempting to use the underlying hardware for further
  Signature operations, the hardware throws a
  CKR_OPERATION_ACTIVE return code.  Causing the provider to throw
  "PKCS11Exception: Another operation is
  already active".  engineVerify() should catch the
  SignatureException specifically, call cancelOperation()
  then re-throw the SignatureException.  This situation appears to
  exist in engineSign() as well.
  

Problem conclusion

• This defect will be fixed in:
  7.0.0 SR6
  .
  Within the IBMPKCS11Impl security provider
  engineVerify() and engineSign() should catch the
  SignatureException specifically, call cancelOperation()
  then re-throw the SignatureException.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels

• R260 PSY

     UP