PI41706: EDGE CACHING PROXY INCORRECTLY SENDS SSLV2 CLIENTHELLO CAUSING THE BACK END SERVER SSL CONNECTION TO FAIL

8.5.5.8: WebSphere Application Server V8.5.5 Fix Pack 8
8.0.0.12: WebSphere Application Server V8.0 Fix Pack 12
8.5.5.9: WebSphere Application Server V8.5.5 Fix Pack 9
8.5.5.10: WebSphere Application Server V8.5.5 Fix Pack 10
8.5.5.11: WebSphere Application Server V8.5.5 Fix Pack 11
8.0.0.13: WebSphere Application Server V8.0 Fix Pack 13
8.5.5.12: WebSphere Application Server V8.5.5 Fix Pack 12
8.0.0.14: WebSphere Application Server V8.0 Fix Pack 14
8.5.5.13: WebSphere Application Server V8.5.5 Fix Pack 13
8.0.0.15: WebSphere Application Server V8.0 Fix Pack 15
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14
8.5.5.15: WebSphere Application Server V8.5.5 Fix Pack 15
8.5.5.17: WebSphere Application Server V8.5.5 Fix Pack 17
8.5.5.20: WebSphere Application Server V8.5.5.20
8.5.5.18: WebSphere Application Server V8.5.5 Fix Pack 18
8.5.5.19: WebSphere Application Server V8.5.5 Fix Pack 19
8.5.5.16: WebSphere Application Server V8.5.5 Fix Pack 16
8.5.5.21: WebSphere Application Server V8.5.5.21

APAR status

• Closed as program error.

Error description

• The GSKit code in the Caching Proxy server incorrectly sends a
  SSLv2+SSLv3 ClientHello to the back end Domino Server even
  when SSLv2 and SSLv3 has been disabled on Domino. SSLv3 has
  been disabled on the Caching Proxy server.
  
  A Wireshark trace shows that the Caching proxy sends
  SSLv2 Record Layer to the Domino mail server which is unable to
  accept SSLv2 requests. The SSLv2 request is terminated on the
  Domino server with a FIN and then a RST.
  
  The GSKit code will be corrected to disable the SSLv2 Record
  Layer
  
  Problem is reported on Caching Proxy 8.5.5.4_1 on Windows
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  ALL                                         *
  ****************************************************************
  * PROBLEM DESCRIPTION: EDGE CACHING PROXY INCORRECTLY SENDS    *
  *                      SSLV2 CLIENTHELLO CAUSING THE BACK      *
  *                      END SERVER SSL CONNECTION TO FAIL       *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  The GSKit code in the Caching Proxy server incorrectly sends a
  SSLv2+SSLv3 ClientHello to the back end Domino Server even
  when SSLv2 and SSLv3 has been disabled on Domino. SSLv3 has
  been disabled on the Caching Proxy server.
  A Wireshark trace shows that the Caching proxy sends
  SSLv2 Record Layer to the Domino mail server which is unable to
  accept SSLv2 requests. The SSLv2 request is terminated on the
  Domino server with a FIN and then a RST.
  The GSKit code will be corrected to disable the SSLv2 Record
  Layer
  

Problem conclusion

• Added code to disable SSLV2 CLIENTHELLO
  The fix for this APAR is currently targeted for inclusion in
  fixpack 8.0.0.12 and 8.5.5.8
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS CACH PROXY

• Fixed component ID

  5724H8810

Applicable component levels

• R800 PSY

     UP

• R850 PSY

     UP