IJ36410: CONCURRENT READ/CLOSE OF SSLSOCKETS CAUSES SSLSESSIONS TO BE INVALIDATED UNNECESSARILY

APAR status

• Closed as program error.

Error description

• Error Message: N/A
  .
  Stack Trace: N/A
  .
  High percentage of TLS sessions without id in the ClientHello
  (new sessions)
  

Local fix

Problem summary

• A race in the code in SocketImpl for closing and reading from
  SSLSockets causes SSLSessions to be invalidated unnecessarily.
  The
  problem happens when one thread calls SSLSocketImpl.close()
  while another thread is in SSLSocketImpl.AppInputStream.read().
  Do not invalidate SSLSession when an exception occurs due to
  concurrent read/close of SSLSockets.
  

Problem conclusion

• Binary affected - ibmjsseprovider2.jar
  GIT Issue - #192
  RTC - 146684
  Build - 8.0 build_20211119--433
  The fix was delivered for: Java 8.0 SR7 FP5
  .
  This APAR will be fixed in the following Java Releases:
   8 SR7 FP5 (8.0.7.5)
  .
  Contact your IBM Product's Service Team for these Service
  Refreshes and Fix Packs.
  For those running stand-alone, information about the available
  Service Refreshes and Fix Packs can be found at:
   https://www.ibm.com/developerworks/java/jdk/
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels