IBM Support

PH12630: JSESSIONID VALUE MAY CONTAIN 2 CONSECUTIVE DASHES

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as new function.

Error description

  • Customer's web-application-firewall (WAF) finds an instance of
    JSESSIONID cookie value contains 2 consecutive dashes (--), for
    example,
      111--11111111
    and WAF then complains this is a potential SQL-injection
    attack.
    

Local fix

  • N/A
    

Problem summary

  • ****************************************************************
    * USERS AFFECTED:  All users of IBM WebSphere Application      *
    *                  Server                                      *
    ****************************************************************
    * PROBLEM DESCRIPTION: Avoid using double dashes in the        *
    *                      JSESSIONID cookies                      *
    ****************************************************************
    * RECOMMENDATION:                                              *
    ****************************************************************
    When there is 2 consecutive dashes (--) found in the
    JSESSIONID cookie, Web-Application-Firewall (WAF) always gave
    false alarm of potential SQL-injection attack. This caused
    many alerts were logged and was unable to filter from WAF.
    

Problem conclusion

  • Code changes were made to skip any double dashes in the
    JSESSIONID cookies and regenerate new one.
    
    The fix for this APAR is currently targeted for inclusion in
    fix pack 8.5.5.16 and 9.0.5.1.  Please refer to the Recommended
    Updates page for delivery information:
    http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
    

Temporary fix

Comments

APAR Information

  • APAR number

    PH12630

  • Reported component name

    WEBS APP SERV N

  • Reported component ID

    5724H8800

  • Reported release

    850

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2019-05-29

  • Closed date

    2019-07-08

  • Last modified date

    2019-07-08

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    WEBS APP SERV N

  • Fixed component ID

    5724H8800

Applicable component levels

  • R850 PSY

       UP

  • R900 PSY

       UP

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"8.5","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
11 January 2022