================================================================================
         Fixlist for IBM Secure Proxy 6.0.3.0 (SP6030) iFix 09
                                November 2023

  ACTION: After applying 6.0.3.0, SSPCM web sessions may be rejected if the
          hostname does not match the hostnames in the new
          <SSPCM>/conf/cmconfig.properties file. See See SSP-5088/ADV0031920
          below for more information.
  ACTION: With 6.0.3.0, TLSv1 and TLSv1.1 security protocols are disabled by
          default.  See SSP-5483 below for instructions to enable.
  ACTION: The SSP Engine and SSP provided remote Perimeter Servers should be
          updated at the same time.  See SSP-5756/ADV0040204.

================================================================================

This cumulative maintenance iFix includes the GA release of SSP Engine and SSP
Configuration Manager 6.0.3.0 as well as the fixes for the issues mentioned
below. The install images for the SSP Engine, CM and PS may be used to install
a new image or upgrade an existing image in place.

Contents:
   I.   HIPER fixes / Fixes requiring Action by iFix
   II.  Summary of Fixes by iFix/Build (Latest iFix / Builds first)
   III. Detailed Description of Fixes

===============================================================================
I. HIPER (High Impact PERvasive) Fixes / Fixes Requiring Action
===============================================================================

  ACTION - iFix images for zLinux(s390) are not placed on Fix Central.  Contact
           Support if you need an iFix build loaded for this platform.

  ACTION - It is a good practice to take a full backup of the install directory
           before putting on a new build.

In SP 6.0.3.0 (SP6030) iFix 08 Build 312 (August 2023):

  HIPER  - ADV0083077 - Container - Silent install may log credentials 
  HIPER  - ADV0078528 - Update Apache Commons FileUpload to 1.5 
  HIPER  - ADV0083078 - Update Codehaus Jettison to 1.5.4
  HIPER  - ADV0083297 - Update JDOM version to 2.0.6.1
  HIPER  - ADV0084109 - Upgrade Eclipse Jetty to 9.4.51
  HIPER  - ADV0084858 - Upgrade IBM MQ Client to 9.3.0.5
  HIPER  - ADV0093561 - Java deserialization filters (JEP 290) ignored during
						IBM ORB deserialization
  HIPER  - ADV0088146 - IBM Apr 2023 Java CPU - Upgrade JRE to 8.0.8.5

In SP 6.0.3.0 (SP6030) iFix 07 Build 277 (Apr 2023):

  HIPER  - ADV0070229 - IBM Java CPU Oct2022
  HIPER  - ADV0070230 - IBM Java OpenJ9
  HIPER  - ADV0077814 - IBM Java CPU Jan2023
  HIPER  - ADV0081465 - IBM Java XML vulnerability deferred from Oracle 
                        Apr 2022 CPU 
           Now deliver IBM JRE 8.0.8.0.
  NOTE: In build 277, the SSP Engine prints an comes up with a benign Error message

In SP 6.0.3.0 (SP6030) iFix 06 Build 246 (Jan 2023):

  HIPER  - ADV0054861 - CM host header checking in containers
  HIPER  - ADV0054854 - Generate unique encryption vector during install
  HIPER  - ADV0043524 - Upgrade Apache Xerces to xerces-2.12.0
  HIPER  - ADV0069566 - Upgrade IBM Websphere MQ Client to 9.3.02
           (See the descriptions at the bottom for more information)

In SP 6.0.3.0 (SP6030) iFix 05 Build 224 (Nov 2022):

  ACTION - ADV0054062 – Insecure TLS/SSL in use
  HIPER  - ADV0034524 - Oracle Deferred CVE from Java Apr 2021 CPU
           Now deliver IBM JRE 8.0.7.16.

In SP 6.0.3.0 (SP6030) iFix 04 Build 198 (Jul 2022):

  ACTION - ADV0040204 - SSP Engine and SSP provided remote Perimeter Servers
           should be updated at the same time.  See SSP-5756/ADV0040204.
  HIPER  - ADV0049489,ADV0059312 - Upgrade Eclipse Jetty to 9.4.48

In SP 6.0.3.0 (SP6030) iFix 03 Build 190 (May 2022):

  HIPER  - ADV0031889 - Hostname verification
           (see ADV0031889 description below for more information)
  HIPER  - ADV0034524 - Oracle Java Jul 2021 CPU
  HIPER  - ADV0038361 - Oracle Java Oct 2021 CPU
  HIPER  - ADV0043610 - Oracle Java Jan 2022 CPU
           (see ADV0043610 description below for more information)

In SP 6.0.3.0 (SP6030) iFix 02 Build 177 (March 2022):

  HIPER  - General Protection Fault (GPF, product down) when connecting to SFTP 
           server with DSA host key. See MFT-13118.

In SP 6.0.3.0 (SP6030) iFix 02 Build 167 (February 2022):

  HIPER  - ADV0038393 - Validate input size limits (Jetty)
           (see ADV0038393 description below for link to security bulletin)
  HIPER  - ADV0038394 (CM,Engine) - Resource leak on an exceptional path
           (see ADV0038394 description below for link to security bulletin)

In SP 6.0.3.0 (SP6030) iFix 01 Plus Build 142 (January 2022):

  HIPER  - ADV0040738 - Log4j CVE-2021-45105 JNDILookup issue - Follow on
           (see ADV0040738 description below for link to security bulletin)
  HIPER  - ADV0040950 - Log4j CVE-2021-44832 JNDILookup issue - Follow on
           (see ADV0040950 description below for link to security bulletin)

In SP 6.0.3.0 (SP6030) iFix01 Plus Build 135 (December 2021):

  HIPER  - ADV0040239 - Log4j CVE-2021-45046 JNDILookup issue
           See SSP-5743/ADV0040239 below for details.

In SP 6.0.3.0 (SP6030) iFix01 Build 134 (December 2021):

  HIPER  - ADV0040089 - Log4j CVE-2021-44228 JNDILookup issue
           See MFT-12762/ADV0040089 below for details.

In SP 6.0.3.0 (SP6030) GA Build 120 (October 2021):

  ACTION - After applying 6.0.3.0, SSPCM web sessions may be rejected if the
           hostname in the URL https://<hostname>:<port>/SSPDashboard does not 
           match one of the hostnames in the new <SSPCM>/conf/cmconfig.properties
           file. See SSP-5088/ADV0031920 below for more information
  ACTION - With 6.0.3.0, TLSv1 and TLSv1.1 security protocols are disabled by
           default.  See SSP-5483 below for instructions to enable.

In SP 6.0.2.0 (SP6020) iFix 03 Build 204 (August 2021):

  HIPER  - Addressed various security advisories (links to security bulletins
           under fix descriptions):
           ADV0028445 - Oracle Java Oct 2020 CPU deferred CVE
           ADV0029859 - Oracle Java Jan 2021 CPU
           ADV0031846 - Risky cryptographic algorithm vulnerability
           ADV0031847 - Hard-coded secrets vulnerability
           ADV0031848 - Weak hash vulnerability
           ADV0032087 - Container environment compoments vulnerability
  ACTION:  For this iFix, the TLSv1 and TLSv1.1 protocols continue to be
           allowed.  In the next iFix, they will be disabled by default. 
           Customers should change all TLS connections to use the TLSv1.2 
           protocol.

In SP 6.0.2.0 (SP6020) iFix 02 Build 192 (June 2021):

  HIPER  - Addressed various security advisories (links to security bulletins
           under fix descriptions):
           ADV0027664 - Upgrade httpcomponents-client tooolkit
           ADV0031827 - Upgrade Eclipse Jetty toolkit
           ADV0031888 - Resource leakage
           ADV0031895 - Unrestricted document type definition

           The following have been re-evaluated and determined to not be
           vulnerabilities.
           ADV0023803 - Upgrade Apache Santuario toolkit
           ADV0031824 - Upgrade Guava: Google Core Libraries for Java
                        toolkit
           ADV0031843 - Upgrade Apache ActiveMQ toolkit
           ADV0031845 - Dubious method issue

In SP 6.0.2.0 (SP6020) iFix 00 Plus Build 148 (April 2021):

  HIPER/ACTION - Keycert passwords visible as clear text in engine audit logs
           when configuration is pushed. See MFT-11965

  HIPER/ACTION - Before upgrading to SSP6011 or SSP6020, the admin should check
           that the Sessionid Cookie Domain field in the GUI is either blank or
           it is the fully qualified domain name of the SSPCM.  See MFT-11971.

In SP 6.0.2.0 (SP6020) iFix 00 Plus Build 143 (March 2021):

  HIPER  - Updated code signing certificate for signing jarfiles. See SSP-4965.

In SP 6.0.2.0 (SP6020) iFix 00 Plus Build 135 (March 2021):

  HIPER  - Revert to older Maverick SFTP toolkit to alleviate hangs during
           uploading and downloading of files. See MFT-11830 for details.

In SP 6.0.2.0 (SP6020) iFix 00 Plus Build 132 (February 2021):

  HIPER  - New Jetty keeps SSPCM from coming up if multiple keycerts are
           detected - See MFT-11742
  ACTION - If your site has rebranded the HTTP Signon pages or scripts, you
           must re-apply your customizations after the upgrade. See MFT-11669.

In SP 6.0.2.0 (SP6020) GA Build 120 (December 2020):

  HIPER  - Update JRE 1.8 to SR6 FP15 (8.0.6.15) for security patches - See
           PSIRT ADV0026225 for more details.
  HIPER  - Address vulnerability in Eclipse Jetty toolkit. See ADV0028030.
  HIPER  - Address vulnerability in Apache ActiveMQ toolkit. See ADV0027000.

In SP 6.0.1.1 (SP6011) iFix 02 Plus Build 208 (November 2020):

  ACTION - If your site has customized the login.js scripts, you must re-apply
           your customizations after the upgrade. See MFT-11536 for specifics.

In SP 6.0.1.1 (SP6011) iFix 02 Build 193 (September 2020):

  HIPER  - Address vulnerability in Apache Commons Codec toolkit. See
           ADV0025470

In SP 6.0.1.1 (SP6011) iFix 01 Plus Build 188 (September 2020):

  HIPER  - Upgraded Maverick SSH toolkits to the 1.7.32 level for thread
           deadlock and OutOfMemory issues.  See MFT-11273 for details.
  ACTION - SFTP key sizes, both yours and your trading partners, MUST be 1024
           bits or higher. Ensure that key sizes are adequate before migrating
           to production.  See MFT-11273 for details.

In SP 6.0.1.1 (SP6011) iFix 01 Build 180 (August 2020):

  ACTION: The procedure to deploy IBM Secure Proxy using a Docker Container has
          changed. For more information see
          https://www.ibm.com/support/knowledgecenter/SS6PNW_6.0.1/com.ibm.help.ssp.overview.doc/ssp_whats_new.html.

In SP 6.0.1.1 (SP6011) GA Build 150 (June 2020):

  ACTION:  An Engine and any remote Perimeter Servers associated with its
  ACTION:  adapters must be upgraded to the 6011 level at the same time to
  ACTION   keep their PS code in sync. Otherwise the adapters will fail to
  ACTION:  start with "Unable to connect to remote perimeter server..."
  ACTION:  See SSP-3966 for details.

  HIPER  - Update JRE 1.8 to SR6 FP10 (8.0.6.10) for security patches - See
           PSIRTs ADV0021791 and ADV0023736 for more details.

  HIPER  - XML External Entity (XXE) vulnerability in SSP - See SSP-4323
           (PSIRT ADV0023731 for more details.

In SP 6.0.1.0 (SP6010) iFix 02 Build 134          (March 2020):

  HIPER  - Update JRE 1.8 to SR6 FP05 (8.0.6.5) for security patches - See
           PSIRT ADV0021787 for more details.

  HIPER  - Missing secure attribute in encrypted session (SSL) cookie - See
           SSP-3793 (PSIRT ADV0022033) for more details.

In SP 6.0.1.0 (SP6010) General Availability (January 2020):

  ACTION - For a detailed list of the new features in the 6010 release, see
           https://www.ibm.com/support/knowledgecenter/SS6PNW_6.0.1/com.ibm.help.ssp.overview.doc/ssp_whats_new.html

  ACTION - Installation issues with Docker containers - See SSP-4220

In SP6000 Fixpack 1 (SP6001) iFix 01 (October 2019):

  HIPER  - Update JRE 1.8 to SR5 FP40 (8.0.5.40) for security patches - See
           PSIRT17288 for more details.

  HIPER  - Possible vulnerability in Jetty server. See PSIRT16274, PSIRT16318

In SP6000 Fixpack 1 (SP6001) iFix 00 Plus (September 2019):

  ACTION - SSP can run out of threads if SEAS goes down and the SFTP adapter
           does not have failover coded.  See MFT-10402

In SP6000 FixPack 1 (SP6001) General Availability (August 2019):

  ACTION - For a detailed list of the new features in the 6001 FixPack, please
           see
           https://www.ibm.com/support/knowledgecenter/SS6PNW_6.0.0/com.ibm.help.ssp.overview.doc/ssp_whats_new.html

  ACTION - RESTAPI requires new X-Passphrase keyword for exporting, importing
           sensitive objects: sspCMConfigs, Netmaps, Keystores, sysSslInfo,
           globals.
           See https://www.ibm.com/support/knowledgecenter/SS6PNW_6.0.0/com.ibm.help.ssp.apis.doc/CommonFiles/rest_api_request_headers.html

In SSP6000 iFix 2 (June 2019):

  ACTION - JRE 1.8 SR5 FP35 (8.0.5.35) disables anon and null cipher suites and
           includes a new parm for distrusting CAs. For more information, see
           the writeup below for PSIRT15330.

  ACTION - New feature to restrict access to pages under the /Signon directory.
           If you have added additional files or directories as part of
           customizing the Login portal (/Signon directory), you must add
           whitelist entries for them similar to the existing entries in the
           new <SSP>/bin/portal/pages.properties file. See SSP-3542 for details.

In SSP60000 iFix 1 (March 2019):

  NONE  -

In SSP60000 GA (February 2019):

  ACTION - JRE 1.8 SR5 FP27 (8.0.5.27) introduced changes to disable SHA1
           certificates. See PSIRT12959 and PSIRT13809 for more details.

===============================================================================
II.  Summary of Fixes by iFix/APAR (Latest iFix / FixPack first)
     Fixes are marked as Engine and CM (Configuration Manager)
===============================================================================

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 09 Plus Build 326   November 2023
-------------------------------------------------------------------------------
  
  MFT-14706            (CM, Engine) - Password with Danish Character is not 
                                      working when use is logging into SSP's
 									  HTTP-SSO page
  
  MFT-14926            (Engine)     - Added USCF keyword to FM70.xsd

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 08 Plus Build 324   October 2023
-------------------------------------------------------------------------------

  MFT-14904/           (CM)         - SSP not sending the X-Forwarded-Host header 
                                      causing failure in PEM component.

  MFT-14885/IT44737    (Engine)     - SSP not encoding URLs correctly while 

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 08 Plus Build 320    October 2023
-------------------------------------------------------------------------------

  MFT-14916/IT44718    (CM)         - SSP CM is not enforcing HSTS header for 
                                      non 2XX response with curl

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 08 Plus Build 319    October 2023
-------------------------------------------------------------------------------

  MFT-14884/IT44648    (Engine)     - Some SFTP clients are reporting error on
                                     file uploads when ICAP is on
	  
-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 08 Build 312     Aug 2023
-------------------------------------------------------------------------------

  SSP-5880/ADV0083077 - Container - Silent install may log credentials 
  SSP-6224/ADV0078528 - Update Apache Commons FileUpload to 1.5 
  SSP-6351/ADV0083078 - Update Codehaus Jettison to 1.5.4
  SSP-6353/ADV0083297 - Update JDOM version to 2.0.6.1
  SSP-6405/ADV0084109 - Upgrade Eclipse Jetty to 9.4.51
  SSP-6407/ADV0084858 - Upgrade IBM MQ Client to 9.3.0.5
  SSP-6653/ADV0093561 - Java deserialization filters (JEP 290) ignored during
						IBM ORB deserialization
  SSP-6626/ADV0088146 - IBM Apr 2023 Java CPU - Upgrade JRE to 8.0.8.5
  
  MFT-14663/IT4442     (Engine)     - Some SFTP user sessions do not disconnect
                                      gracefully

Security Bulletin
  SSP-5880/ADV0083077 - Container - Silent install may log credentials 
  SSP-6224/ADV0078528 - Update Apache Commons FileUpload to 1.5 
  SSP-6351/ADV0083078 - Update Codehaus Jettison to 1.5.4
  SSP-6353/ADV0083297 - Update JDOM version to 2.0.6.1
  SSP-6405/ADV0084109 - Upgrade Eclipse Jetty to 9.4.51
  SSP-6407/ADV0084858 - Upgrade IBM MQ Client to 9.3.0.5
  SSP-6653/ADV0093561 - Java deserialization filters (JEP 290) ignored during
						IBM ORB deserialization
  SSP-6626/ADV0088146 - IBM Apr 2023 Java CPU - Upgrade JRE to 8.0.8.5	
						
	Resolution: Upgraded various toolkits to current levels to satisfy the CVEs
	in PSIRT advisories. See the Security Bulletin at
	https://www.ibm.com/support/pages/node/7029766.

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 07 Plus Build 300     Aug 2023
-------------------------------------------------------------------------------

  MFT-14726/IT44389    (CM)         - Rest API failing for POST Add KeyDef Entry
  
  
  SSP-6601/           (CM)          - Extra property values were being added  
                                     to the security properties file  during 
									 disable/enable bootstrap operation
	
-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 07 Plus Build 298     Aug 2023
-------------------------------------------------------------------------------

  MFT-14317/          (Engine)      - Common Name Check failure
  
  MFT-14388/          (CM)          - Updated maximumContentSize default value
  
  MFT-14564/IT44318 (Engine)        - disable client initiated SSL 
                           renegotiation 
									  
  SSP-6351/ADV0083078 (CM)          - Updated jettison version to 1.5.4
  
  SSP-6354/ADV0083298 (CM)          - Updated jersey jar
  
  SSP-6354/ADV0083298 (CM)          - Update jersey jar
  
  SSP-6407/ADV0084858 (CM)          - Updated IBM mq client version to 9.3.0.5
		
  SSP-6626/ADV0088146 (CM, Engine)  - IBM Apr 2023 Java CPU

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 07 Plus Build 289     Jun 2023
-------------------------------------------------------------------------------

  SSP-6394/         (Engine)   - Error found in startEngine.out in SSP 6030
       
  MFT-14090/        (CM)       - ICAP getting SFTP errors during multi-GB transfers
  
  MFT-14294/IT43664 (CM)       - ListCmCerts.sh ExpireDays was not listing expiring
                                certificate correctly
  				  
  MFT-14336/IT43709 (Engine)   - sshj SFTP client's sessions not getting clean disconnect 
                               after SSP upgrade
  					  
  MFT-14440/IT43993 (Engine)   - Files not being scanned when using myFileGateway 2.0 with
                               ICAP enabled on adapter
  
  MFT-14488/IT43986 (Engine)   - ICAP - How to Get Rid of ".unscanned" Extension
  
  SSP-6105 (Engine)            - Support for SSH Key Signature Verification.
  
  SSP-6224  (CM)               - Update Apache Commons FileUpload to version 1.5
  
  SSP-6343 (Engine)            - Upgrade Maverick version to 1.7.50
    
-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 07 Build 277            Apr 2023
-------------------------------------------------------------------------------

  MFT-14090/IT43587 (Engine)      - ICAP getting SFTP errors during multi-GB 
                                   transfers

  MFT-14233/IT43588 (Engine)      - SFTP clients fail when ICAP is enabled.

  MFT-14240/IT43590 (CM,Engine)   - ICAP response timeout updated to 1800 secs

  SSP-5458/         (CM)          - Warning on certificate expiration in CM

  SSP-5991/ADV0070229 (CM,Engine) - IBM Java CPU Oct2022 CVE-2022-21628 
                                  - CVSS 5.3
  SSP-6020/ADV0070230 (CM,Engine) - IBM Java OpenJ9 - CVE-2022-3676 - CVSS 6.5
  SSP-6256/ADV0077814 (CM,Engine) - IBM Java CPU Jan2023 CVE-2023-21830
                                  - CVSS 5.3
  SSP-6257/ADV0081465 (CM,Engine) - IBM Java XML vulnerability deferred from
                                    Oracle Apr 2022 CPU CVE-2022-21426 
                                  - CVSS 5.3

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 06 Plus Build 271       Mar 2023
-------------------------------------------------------------------------------

  MFT-14157/        (Engine)    - CD adapter getting CSP021I 0 Configuration
                                  parameter not set error msg

  MFT-14160/        (Engine)    - User lockout duration extends with each
                                  subsequent authentication failure

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 06 Plus Build 269       Mar 2023
-------------------------------------------------------------------------------

  SSP-5768/         (CM,Engine) - Max allowed ICAP request size less than shown

  SSP-5834/         (CM)        - Remove CM failover.log and sspengine.log

  SSP-6141/         (CM)        - Do not require trust store and Idp trust cert
                                  in SSP Internal Portal Authentication.

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 06 Plus Build 261       Mar 2023
-------------------------------------------------------------------------------

  SEAS-2942/        - Add support for installing on Windows 2019

  SSP-6116/         (CM,Engine) - Increase internal encryption key length to
                                  256 bits

  SSP-6217/         (CM,Engine) - Drop old duplcate jars from build process

  SSP-6221/         (CM,Engine) - Upgrade cipher used for encrypting the
                                  configuration files

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 06 Plus Build 248       Feb 2023
-------------------------------------------------------------------------------

  MFT-13463/        (Engine)    - Memory leak when sessions close and go stale

  MFT-14071/        (CM)        - Maximum file size in SSP ICAP configuration
                                  only allows 1GB

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 06 Build 246            Jan 2023
-------------------------------------------------------------------------------

  SSP-4128/         (Engine)    - Change error message at SFTP logoff time to
                                  warn

  SSP-4136/         (CM,Engine) - manageKeycert getting Unsupported password-
                                  based encryption algorithm

  SSP-5883/ADV0054861 (CM,Engine) - Container: Make CM Host header checking
                                    true by default

  SSP-5905/ADV0054854 (CM,Engine) - Generate unique vector during install to
                                    use for encryption

  SSP-5971/         (CM)        - Saving ICAP configuration fails if certain
                                  property not included

  SSP-6022/ADV0043524 (CM/Engine) - Upgrade Apache Xerces to xerces-2.12.0

  SSP-6024/ADV0069566 (CM/Engine) - Upgrade IBM Websphere MQ Client to 9.3.02

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 05 Plus Build 235       Dec 2022
-------------------------------------------------------------------------------

  MFT-13707/        (Engine)    - SFTP session count increasing after applying
                                  fix for MFT-13707 (see MFT-13512)

  MFT-13751/        (Engine)    - PEN-Test Security Findings

  MFT-13798/        (CM,Engine) - Arrange default ciphers in security order for
                                  TLSv1.2

  MFT-13804/        (Engine)    - ICAP config fails to add extension to
                                  unscanned files

  MFT-13897/        (Engine)    - Error during myFileGateway 2.0 logout when
                                  keycert from a non-default keystore

  SSP-5643/         (CM)        - Misleading error messages when bypassing host
                                  header verification.

  SSP-6003/         (CM)        - List of ciphers for TLSv1.2 different if
                                  engine installed before CM

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 05 Build 224            Nov 2022
-------------------------------------------------------------------------------

  MFT-13768/        (Engine)    - SFTP support for hmac-sha2-256 in FIPS mode

  SSP-5882/         (CM,Engine) - ADV0054062 – Insecure TLS/SSL in use

  SSP-5978/         (CM,Engine) - ADV0034524 - Oracle Deferred CVE from Java
                                  Apr 2021 CPU

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 04 Plus Build 221       Nov 2022
-------------------------------------------------------------------------------

  MFT-13463/        (Engine)    - Native memory leak in IBMJCEPlus provider

  MFT-13737/        (Engine)    - HSM manageCSR -update unable to add
                                  certificate from CA

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 04 Plus Build 220       Nov 2022
-------------------------------------------------------------------------------

  MFT-13193/IT42397 (Engine)    - SFTP session on one adapter emits some
                                  messages on other adapter

  MFT-13609/        (CM)        - SSPCM not initializing OSA interface
                                  consistently at startup

  MFT-13700/IT42199 (Engine)    - ICAP SFTP to reject upload when maximum
                                  allowed file/request size is exceeded

  SSP-5967/        (Engine,CM)  - Old uninstaller scripts not deleted during
                                  upgrade.

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 04 Plus Build 212       Oct 2022
-------------------------------------------------------------------------------

  MFT-13632/        (Engine)    - Unable to stop Engine with stopEngine.sh

  MFT-13707/IT42228 (Engine)    - PSFTP client receiving 11 return code after
                                  successful session

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 04 Plus Build 209       Sep 2022
-------------------------------------------------------------------------------

  MFT-13461/        (CM)        - Update copyright page pointed to by CM

  MFT-13497/        (Engine)    - SSP failover detection does not check status
                                  of inbound PS configured in adapter.

  MFT-13539/        (CM)        - Failure on SSL config export after CM upgrade

  MFT-13558/IT42097 (Engine)    - SFTP not presenting CTR ciphers in FIPS mode

  MFT-13690/IT42061 (Engine)    - Support for rsa-sha2 host key signatures

  SSP-5945          (CM,Engine) - Include iFix, Build, and Platform in SSP
                                  utility messages

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 04 Plus Build 205       Sep 2022
-------------------------------------------------------------------------------

  MFT-13216/IT41946 (CM)        - Upgrade jQuery, jqModal script packages

  MFT-13592/IT41928 (Engine)    - SFTP sessions disconnected for small files
                                  when using ICAP provider CAS (avscan)

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 04 Plus Build 201       Aug 2022
-------------------------------------------------------------------------------

  MFT-13174/        (Engine)    - Intermittent FASP file transfer startup
                                  failure for SSP CD adapter with CDz as SNODE
                                  and PNODE.

  MFT-13310/IT41758 (Engine)    - Active SFTP session count on Perimeter server
                                  is increasing when backend rejects connection

  MFT-13450/IT41740 (CM)        - RESTAPI can import truststore too large for
                                  CM to push to engine

  MFT-13512/IT41732 (Engine)    - SSP not reducing SFTP session count when a
                                  password change operation stalls

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 04 Build 198            Jul 2022
-------------------------------------------------------------------------------

  MFT-13461/        (CM)        - CM Help button pointing to 3.4.x documentation

  SSP-5756/ADV0040204 (Engine,PS) - Upgrade all Log4j 1.x to 2.x in Perimeter
                                  Server

  SSP-5886/ADV0049489 (Engine,CM) - Upgrade Eclipse Jetty to 9.4.48
  SSP-5944/ADV0059312

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 03 Plus Build 194       Jun 2022
-------------------------------------------------------------------------------

  MFT-13222/        (Engine)    - Add frame busting javascript

  MFT-13284/IT41286 (CM)        - Invalid POST in CM produces stack trace

  MFT-13393/IT41274 (CM)        - Empty SSH keystore causes RESTAPI import
                                  issue

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 03 Build 190            May 2022
-------------------------------------------------------------------------------

  SSP-5079/ADV0031889 (Engine,CM) - Hostname verification

  SSP-5765/ (Engine) - Support Implicit SSL for FTP

  SSP-5754/ADV0034524 - Oracle Java Jul 2021 CPU
  SSP-5757/ADV0038361 - Oracle Java Oct 2021 CPU
  SSP-5813/ADV0043610 - Oracle Java Jan 2022 CPU

  Informational: Updated the jar signing certificate with this iFix

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 02 Plus Build 188       May 2022
-------------------------------------------------------------------------------

  MFT-12972/        (Engine,CM) - Handshake failures with FIPS enabled and
                                  RSASSA-PSS, RSAPSS not disabled

  MFT-13050/        (Engine)    - Log the source IP from HTTP header in INFO.
                                  Part 2

  MFT-13191/        (Engine)    - SSP Adapters unresponsive after failover
                                  condition

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 02 Plus Build 184       Apr 2022
-------------------------------------------------------------------------------

  MFT-12672/IT40677 (Engine)    - "Exception in PooledScheduler thread" in
                                  perimeter logs

  MFT-12910/IT40666 (Engine)    - CD adapter gets NPE connecting to Mainframe
                                  Sysplex SNode

  MFT-13010/IT40667 (Engine)    - Failure to notify B2Bi when an AS2 Synch MDN
                                  is not delivered successfully.

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 02 Plus Build 177       Mar 2022
-------------------------------------------------------------------------------

  MFT-13118/        (Engine)    - GPF Connecting to SFTP server with DSA key

  SSP-5788/         (Engine,CM) - IBMJCEPlus, IBMJCEPlusFIPS not supported on
                                  Solaris or HP hybrid JREs

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 02 Plus Build 175       Mar 2022
-------------------------------------------------------------------------------

  MFT-12399/        (Engine)    - Put IBMJCEPlus provider in front for AES-NI
                                  performance

  MFT-12978/        (Engine)    - Security Scan POST to /Signon/login.html gets
                                  Internal Server Error

  MFT-12991/        (Engine)    - Put IBMJCEPlus provider in front to resolve 
                                  SFTP "Host key signature is invalid"

  MFT-13022/IT40285 (CM)        - Excessive CPU utilization when OSA is enabled

  MFT-13033/IT40317 (Engine)    - Adapter listeners go offline when alternate
                                  destinations coded

  MFT-13035/IT40224 (Engine)    - External IdP support - does not accept 
                                  IdpCert from non-default truststore

  SSP-5823/         (CM)        - OSA Heartbeat interval is not encoded properly

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 02 Plus Build 170       Mar 2022
-------------------------------------------------------------------------------

  MFT-13050/IT40314 (Engine)    - Log the source IP from HTTP header in INFO
                                  mode instead of DEBUG

  SSP-5777/SSP-5796 (Engine)    - Create Audit log event for successful HTTP 
                                  portal login

  SSP-5814/         (Engine)    - Pass on SSH channel error msg from B2Bi Sftp
                                  custom exit response

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 02 Plus Build 168       Feb 2022
-------------------------------------------------------------------------------

  MFT-12534/IT38589 (Engine)    - Produce SSE2656 at INFO mode if
                                  -Dsftp.sse2656.as.info=true

  MFT-12731/        (Engine)    - CD Adapter goes offline when session fails
                                  through SEAS

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 02 Build 167            Feb 2022
-------------------------------------------------------------------------------

  MFT-12495/IT39273 (CM/Engine) - New JRE breaks FIPS mode processing

  MFT-12826/IT39678 (Engine)    - External users get "502 Bad Gateway" error
                                  when re-directed to the mustchangepw.html

  MFT-12869/IT39786 (Engine)    - Step Injection does not work with B2Bi/CDSA

  MFT-12932/IT39864 (CM)        - SSPCM High CPU Utilization after 6030 Fix-01+

  SSP-3548/ADV0038393 (CM)      - Validate input size limits (Jetty)

  SSP-4983/         (CM)        - Allow RESTAPI command line utility to use
                                  TLSv1.2 and TLSv1.3

  SSP-5548/ADV0038394 (CM,Engine) - Resource leak on an exceptional path

  SSP-5770/         (Engine)    - NPE redirecting audit logs to syslogd

  SSP-5774/         (CM)        - Unable to update keycert using commonCert
                                  option of configureCmSsl utility

  SSP-5775/         (CM)        - RESTAPI import from SSP3432 getting
                                  "JettyConfigDef is locked"

  SSP-5779/         (Engine)    - New install fails to start with
                                  javax.crypto.IllegalBlockSizeException

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 01 Plus Build 142       Jan 2022
-------------------------------------------------------------------------------

  MFT-12597/        (CM/Engine) - Security findings on SSP HTTPS listener

  MFT-12601/        (Engine)    - OKTA external IdP-SSP for change password
                                  page not showing userid

  MFT-12637/        (Engine)    - SSP engine status shows stopped in SSP
                                  dashboard

  MFT-12752/        (CM)        - TLS_ONLY changed to TLSv1.2 during upgrade
                                  from 3432

  MFT-12820/        (CM)        - Nullpointer during RESTAPI Script Operation

  SSP-5742/ADV0040738 (CM,Engine) - Log4j CVE-2021-45105 JNDILookup issue - 
                                    Follow on

  SSP-5760/ADV0040950 (CM,Engine) - Log4j CVE-2021-44832 JNDILookup issue - 
                                    Follow on

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 01 Plus Build 135       Dec 2021
-------------------------------------------------------------------------------

  SSP-5743/ADV0040239 (CM/Engine) - Log4j CVE-2021-45046 JNDILookup
                                    issue

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) iFix 01 Build 134            Dec 2021
-------------------------------------------------------------------------------

  MFT-12423/IT39259 (Engine)    - Unknown SFTP user can log in to SSP in
                                  passthrough mode

  MFT-12446/IT39123 (Engine)    - Support for specifying engine client alias 
                                  during import and stopEngine.sh

  MFT-12618/        (Engine)    - Set Maxheap on Windows via LAX file
                                  lax.nl.java.option.additional parm

  MFT-12762/ADV0040089 (CM/Engine) - Log4j CVE-2021-44228 JNDILookup
                                     issue

  SSP-5698/         (CM, Engine) - SSL debug output not going to systemout.log

  SSP-5472/         (CM)        - RESTAPI validation for certificate names
                                  added to the keystore/truststore

  SSP-5484/         (CM)        - Ciphersuites specified in the OSA monitoring
                                  tab not being honored.

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.3.0 (SP6030) GA Build 120                 Oct 2021
-------------------------------------------------------------------------------

   o New with Secure Proxy 6.0.3.0:
     See https://www.ibm.com/docs/en/secure-proxy/6.0.3?topic=overview-new-features-enhancements
     - Enhancement to support ICAP virus scanning with the HTTP adapter for
       MyFG2.0 (See SSP-4326)
     - Enhancement to support the TLS 1.3 security protocol (See SSP-4959)
     - New host header checking for access to the SSPCM (See SSP-5088)
     - SSPCM GUI support for Open Server Architecture (OSA) for secure
       event/status publishing to IBM Control Center (See SSP-5130)

  SSP-4326/         (CM,Engine) - Enhancement: Http ICAP support

  SSP-5045/         (CM,Engine) - Various issues reported by internal code scans

  SSP-4841/         (CM)        - RESTAPI allowing simple SQL Injection

  SSP-4882/         (CM,Engine) - SCIRandom logging not sent to SSP log files

  SSP-4959/         (CM,Engine) - Support the TLSv1.3 security protocol

  SSP-4983/         (CM)        - Allow SSP CM RESTAPI to use TLSv1.2, TLSv1.3

  SSP-5043/         (CM)        - Require a password policy when creating a new
                                  user.

  SSP-5088/ADV0031920 (CM)      - Host header injection vulnerability

  SSP-5130/         (CM)        - Enhancement: SSPCM support for configuring OSA
                                  and multiple EPs

  SSP-5483/         (CM,Engine) - Add java.security.override file to allow 
                                  disabled TLSv1

  SSP-5565/         (CM,Engine) - Upgrade thirdparty jars for SSP 6.0.3.0

  SSP-5626/         (CM,Engine) - Support for IBM ISAM SAML2.0 IdP - ACS URL

  SSP-5698/         (CM,Engine) - SSL debug output not going to systemout.log

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.2.0 (SP6020) iFix 03 Plus Build 212       Oct 2021
-------------------------------------------------------------------------------

  MFT-12294/IT38557 (CM)        - RESTAPI UnrecoverableKeyException in
                                  concurrent processing

  MFT-12534/IT38589 (Engine)    - Produce SSE2656 at INFO mode if
                                  -Dsftp.sse2656.as.info=true

  MFT-12557/        (CM)        - RESTAPI import of older config fails on
                                  'templateName' xml key.

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.2.0 (SP6020) iFix 03 Plus Build 210       Sep 2021
-------------------------------------------------------------------------------

  MFT-12464/IT38350 (CM,Engine) - Previous Windows 6.x service not deleted
                                during install

  SSP-4956/ADV0028445 (CM,Engine) - IBM JRE 8.0.6.30 for Solaris and HP

  SSP-5478/         (Engine)  - Intermittent Unauthorized error when using SSP
                                login portal in high concurrency

  SSP-5479/         (CM)      - RESTAPI import fails on PESIT adapter with
                                Invalid content on 'icapPSName'

  SSP-5520/         (CM)      - CM GUI session from second tab gets
                                Unauthorized Error

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.2.0 (SP6020) iFix 03 Build 204            Aug 2021
-------------------------------------------------------------------------------

  MFT-12358/        (CM)      -  Allow Other provider under ICAP config

  SSP-4956/ADV0028445 (CM,Engine) - Oracle Java Oct 2020 CPU deferred CVE

  SSP-5012/ADV0031846 (CM,Engine) - Risky cryptographic algorithm vulnerability

  SSP-5016/ADV0031847 (CM,Engine) - Hard-coded secrets vulnerability

  SSP-5080/ADV0031848 (CM,Engine) - Weak hash vulnerability

  SSP-5089/ADV0032087 (CM,Engine) - Container environment compoments
                                  vulnerability

  SSP-5093/ADV0029859 (CM,Engine) - Oracle Java Jan 2021 CPU

  SSP-5116/IJ33416  (Engine)  - CD TLSv1 sessions fail with "SSLv2Hello is not
                                enabled" in new IBM JRE 8.0.6.25

  SSP-5124/          (CM)     - Nuisance msg in CM log: NoClassDefFoundError
                                javax.security.auth.message.AuthException

  SSP-5155/          (Engine) - MyFG2.0 does not show the SSP portal login page
                                when the SSOTOKEN expires

  SSP-5414/         (Engine)  - Keep the hash value for ssotokens consistent in
                                the debug logs

  SSP-5457/         (CM,Engine) - Merge Resource Leakage code to complete
                                SSP-5021

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.2.0 (SP6020) iFix 02 Plus Build 196       Jul 2021
-------------------------------------------------------------------------------

  MFT-12189/        (Engine)  - Add File name to HTTP URL in the ICAP request

  MFT-12271/IT37593 (Engine)  - Interface issues with external SAML IdP

  MFT-12310/IT37562 (Engine)  - SCP/SFTP rejecting transfers with "time" option

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.2.0 (SP6020) iFix 02 Build 192            Jun 2021
-------------------------------------------------------------------------------

  o New with SP 6.0.2.0 iFix 02:
    - Enhancement to support MyFG 2.0 (See SSP-4994)
    - Enhancement to support OSA for publishing audit events to ICC
      (See SSP-5110)
    - Ability to install and run on Windows 2019 Server
    - Ability to install and run on Linux PowerPC Little Endian
      (Use new Linux_PPC-LE install image)
    - Addressed various security advisories (see defects with ADV00* below)

  MFT-12113/IT37411 (Engine)  - Engine fails to start on Solaris

  MFT-12193/IT37112 (CM)      - RESTAPI fails to import HSM certs

  SSP-4714/         (CM)      - SSPCM Fresh install gets ERROR on Solaris

  SSP-4994/         (Engine)  - Enhancement to support MyFG 2.0

  SSP-5015/ADV0031895 (CM)    - Unrestricted document type definition
                                vulnerability found in scan

  SSP-5018/ADV0031845 (CM)    - Dubious method issue found in scan

  SSP-5021/ADV0031888 (CM)    - Resource leakage vulnerability found in scan

  SSP-5022/ADV0027664 (CM,Engine) - Upgrade httpcomponents-client to 4.5.13

  SSP-5067/ADV0031843 (CM,Engine) - Upgrade Apache ActiveMQ toolkit to 5.16.2

  SSP-5071/ADV0023803 (Engine)  - Upgrade Apache Santuario to 2.2.1

  SSP-5075/ADV0031824 (Engine)  - Upgrade Guava: Google Core Libraries for Java
                                to 30.1.1

  SSP-5077/ADV0031827 (CM,Engine) - Upgrade Eclipse Jetty to 9.4.41

  SSP-5096/         (CM)        -  Keystore and Truststore passwords dumped in 

  SSP-5110/         (CM,Engine) - Enhancement to support OSA for publishing
                                  audit events to Control Center (ICC)

  SSP-5141/         (CM)        - SSPcm upgrade fails after second restart with 
                                  IOException: Keystore type is not PKCS12 

  SSP-5212/         (CM,Engine) - Connection failures with multiple EPs support

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.2.0 (SP6020) iFix 01 Plus Build 166       Jun 2021
-------------------------------------------------------------------------------

  MFT-11724/IT36856 (Engine)  - ICAP integration with provider: BitDefender

  MFT-11940/IT37028 (CM)      - SSPCM User Auth with EA - Support SEAS
                                Alternate Server configuration 

  MFT-12099/IT36837 (Engine)  - SSP Change Password Portal login issue

  MFT-12193/IT37112 (CM)      - RESTAPI import of HSM keys gets "Invalid content
                                was found starting with element keyStoreProvider

  SSP-4986/         (CM)      - Unable to update webCiphers with
                                ConfigureCmSslTool

  SSP-5105/         (CM)      - NPE when switching CM User auth from EA to 
                                local store 

  SSP-5126/         (CM)      - RESTAPI import fails when ICAP scan option is
                                NONE for CD node

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.2.0 (SP6020) iFix 01 Build 158            May 2021
-------------------------------------------------------------------------------

  MFT-11853/IT36501 (Engine)  - Invalid Eyecatcher exception in logs

  MFT-11917/IT36577 (CM)      - Lock manager in GUI not behaving as expected

  MFT-11944/IT36706 (Engine)  - SSP SSO Myfilegateway login fails when resource
                                files missing after SSP upgrade

  MFT-12018/IT36711 (CM, Engine) - SFTP does not support DH Group18-sha512 key
                                   exchange

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.2.0 (SP6020) iFix 00 Plus Build 148       Apr 2021
-------------------------------------------------------------------------------

  MFT-11769/IT36186 (CM)      - Cannot sign in to SSPCM when going through
                                WebSeal proxy

  MFT-11902/IT36593 (Engine)  - SFTP SSE2654 "Session limit of 'n' has been
                                exceeded" message not posted in logs

  MFT-11937/IT36198 (Engine)  - Upgrade from pre-SSP6001 in FIPS mode causes
                                engine startup to fail

  MFT-11968/IT36578 (Engine)  - Max session limit on one SFTP adapter limits
                                sessions on other adapters with higher setting

  MFT-11965/IT36452 (Engine)  - Keycert passwords visible as clear text in
                                Engine audit logs when configuration pushed.

  MFT-11971/        (CM)      - Cannot Login to SSPCM after upgrade to 6.0.2.0
                                or 6.0.1.1 iFix 3 if Sessionid Cookie Domain
                                is misconfigured

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.2.0 (SP6020) iFix 00 Plus Build 143       Mar 2021
-------------------------------------------------------------------------------

  MFT-11762/IT36161 (Engine)  - After importing engine certificate,
                                dfltEngineKeyStore and dfltEngineTrustStore are
                                renamed to dfltCMKeyStore and dfltCMTrustStore

  MFT-11873/IT36145 (Engine)  - Remove TRACE from allowed methods in HTTP 
                                Adapter

  MFT-11875/IT36185 (CM,Engine) - Silent install ends with 255 code due to
                                failure reported in Import/generate certificate
                                step

  SSP-4965/         (CM,Engine) - Updated code signing certificate for signing
                                jarfiles
  
-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.2.0 (SP6020) iFix 00 Plus Build 135       Mar 2021
-------------------------------------------------------------------------------

  MFT-11770/        (Engine)  - Set HttpOnly, Secure for SspWebSessionId cookie

  MFT-11830/IT36115 (Engine)  - SFTP transfers stall with Maverick 1.7.32

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.2.0 (SP6020) iFix 00 Plus Build 132       Feb 2021
-------------------------------------------------------------------------------

  MFT-11467/IT34992 (Engine)  - Problem with HTML rewrite - connection close

  MFT-11666/IT35478 (Engine)  - SFTP adapters go offline when too many sessions
                                per user on SFG

  MFT-11669/        (Engine)  - Protect login form from CSRF

  MFT-11683/IT35628 (Engine)  - SFTP disconnects when >500 files in a mailbox

  MFT-11742/IT35559 (CM)      - Jetty failure at CM startup after upgrade
                                to iFix 03

  SSP-4873/         (CM,Engine) - Support SFTP adapter property to set front
                                end rekey count

  SSP-4908/         (Engine)  - PS for SSP on Windows shows 
                                SSP.INSTALLED.VERSION=6.0.3.2

  SSP-4950/         (CM)      - SSPCM adding duplicate cookies

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.2.0 (SP6020) GA Build 120                Dec 2020
-------------------------------------------------------------------------------

  New features see https://www.ibm.com/support/knowledgecenter/SS6PNW_6.0.2/com.ibm.help.ssp602.doc/com.ibm.help.ssp.overview.doc/ssp_whats_new.html

  o Support to proxy outbound Connect Direct connections through a SOCKS5 
    Proxy Server. 

  SSP-2963/         (CM)      - Remove option to update the security under
                                the CMSystemSettings

  SSP-3548/         (CM)      - Allow configuration of the maximum header
                                length and content size for the SSPCM.

  SSP-4518/         (Engine)  - ICAP Logging improvements

  SSP-4606/         (Engine)  -  Audit log messages for CD ICAP support 

  SSP-4614/SSP-4699 (CM,Engine) - Fix resource leak issues reported by internal
                                code scan

  SSP-4666/         (CM,Engine) - Log stacktraces when startup fails

  SSP-4694/4697/4698 (CM,Engine) - Support for SOCKS5 Proxy for outbound CD
                                connections

  SSP-4706/ADV0026225 (Engine,CM) - Upgrade IBM JRE to 8.0.6.15 level for
                                security patches

  SSP-4710/ADV0027000 (Engine) - Upgrade Apache ActiveMQ to 5.16 for security
                                patches

  SSP-4736/         (CM)      - Upgrade Jackson jars to latest

  SSP-4742/         (CM,Engine) - Data Collector for non-Windows CM & engine
                                leaves LongDirectoryOutput.txt empty

  SSP-4801/         (CM)      - Upgrade IBM MQ Client to latest

  SSP-4812/ADV0028030 (Engine,CM) - Update Jetty toolkit to 9.4.34 for security
                                patches

  SSP-4925/         (Engine)  - Remove license type prompt from Engine install

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.1.1 (SP6011) iFix 02 Plus Build 217       Nov 2020
-------------------------------------------------------------------------------

  MFT-11512/IT34993 (Engine)  - (HSM) HTTPs fails with HSM enabled

  MFT-11517/IT34628 (CM)      - RESTAPI validation of CD netmap node ip addr

  MFT-11519/IT34997 (Engine)  - SSP OutOfMemory (OOM) with 80% in
                                com.sterlingcommerce.cspssh.parameters.Parms

  MFT-11578/IT34989 (CM)      - SSPCM adding to user store fails with password
                                policy selected after upgrade

  SSP-4866/         (CM)      - Password policy fields not initialized properly
                                after upgrade from SSP3432

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.1.1 (SP6011) iFix 02 Plus Build 208       Nov 2020
-------------------------------------------------------------------------------

  MFT-11238/IT34624 (Engine)  - (SFTP) Negative message length SshException for
                                DATA packet from non-standard server

  MFT-11309/IT34732 (Engine)  - (SFTP) SSE2640 sshd channel closing when local
                                window size goes below 32k

  MFT-11517/IT34628 (CM)      - RESTAPI validation of CD netmap node ip addr

  MFT-11536/IT34761 (Engine)  - "testSSPCookie" fails Customer's Security scan

  MFT-11557/IT34792 (CM)      - RESTAPI SFTP Netmap import allows unreferenced 
                                remoteClientKeyStore

  SSP-4799/         (Engine,CM) - Allow configurable window and packet size
                                limits for SFTP.

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.1.1 (SP6011) iFix 02 Plus Build 203       Oct 2020
-------------------------------------------------------------------------------

  MFT-11511/IT34629 (CM,Engine) - Performance problems editing large netmaps

  SSP-4206/         (Engine)  - Logs show "SSP0040I Support for IBMPKCS11Impl
                                HSM is enabled" though HSM is not enabled

  SSP-4232/         (Engine)  - Wrong certificate store displayed for Engine

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.1.1 (SP6011) iFix 02 Plus Build 201       Oct 2020
-------------------------------------------------------------------------------

  MFT-11423/IT34330 (Engine)  - (HTTP) Empty cookie header sent to PEM

  MFT-11428/IT34518 (CM,Engine) - CM performance problems editing large netmaps

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.1.1 (SP6011) iFix 02 Plus Build 199       Oct 2020
-------------------------------------------------------------------------------

  MFT-11388/IT34365 (Engine)  - (FTPs) loopback transfers failing 75% of time

  MFT-11411/IT34415 (CM)      - RESTAPI Validation of Peer address range (IP
                                Subnet range) in Netmap Inbound Nodes

  MFT-11429/        (Engine)  - SSP adapters listening even after outbound node
                                becomes unreachable

  MFT-11451/IT34408 (CM)      - RESTAPI addNodes failed with "Content is not
                                allowed in prolog" through sspRestAPI utility

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.1.1 (SP6011) iFix 02 Build 193            Sep 2020
-------------------------------------------------------------------------------

  MFT-11423/IT34330 (Engine)  - MyFG 2.0 (B2Bi 6.1) REST API Authentication
                                fails when it goes through SSP

  SSP-4640/         (CM,Engine) - Vulnerability in Apache Commons Codec

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.1.1 (SP6011) iFix 01 Plus Build 188       Sep 2020
-------------------------------------------------------------------------------

  MFT-11273/IT33922 (Engine)  - JVM thread deadlocks in Maverick code;
                                OutOfMemory during large SFTP download

  SSP-3583/         (CM)      - unauthorized.jsp does not display IBM in header
                                title

  SSP-4138/         (CM)      - manageKeyCerts cannot copy non-HSM keycert

  SSP-4662/         (CM)      - RESTAPI missing validations of Password Policy

  SSP-4668/         (CM)      - RESTAPI allows empty eaAuthProfile and 
                                eaCertProfile tags to be imported

  SSP-4670/         (CM)      - RESTAPI services do not report exception

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.1.1 (SP6011) iFix 01 Build 180            Aug 2020
-------------------------------------------------------------------------------

  New Features in SP 6.0.1.1. iFix 01

    Docker Changes - The procedure to deploy IBM Secure Proxy using a Docker
    Container has changed. For more information, see Deploying IBM Sterling
    Secure Proxy using a Docker container at
    https://www.ibm.com/support/knowledgecenter/SS6PNW_6.0.1/com.ibm.help.ssp.overview.doc/ssp_whats_new.html.

    HELM Chart Support - This iFix allows the IBM Sterling Secure Proxy users
    to deploy their applications in a Kubernetes base containerized environment
    using Helm Chart. For more information see the above link.

  MFT-11130/IT33879 (Engine)  - Intermittent requests to SEAS timing out

  MFT-11139/IT33786 (Engine)  - During load testing, SEAS shows ERROR "AUTH037E
                                Authentication request missing password."

  SSP-4675/         (CM)      - NullPointerException adding trustedCert

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.1.1 (SP6011) iFix 00 Plus Build 166       Aug 2020
-------------------------------------------------------------------------------

  MFT-11287/IT33627 (CM)      - Allow comma and apostrophe in CM key passwords

  MFT-11293/IT33828 (Engine)  - 229 response for FTP EPSV causes problems with
                                some partners

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.1.1 (SP6011) iFix 00 Plus Build 163       Jul 2020
-------------------------------------------------------------------------------

  MFT-11269/IT33625 (PS)      - PS silent install gving bad port error

  SSP-3804/         (Engine, CM) - Passphrase validation in silent install

  SSP-4450/         (CM)      - Add checkboxes to Password Policy in SSP CM

  SSP-4480/         (CM)      - RESTAPI add missing validations

  SSP-4529/         (CM)      - Allow CM login page from root (/)

  SSP-4597/         (Engine,CM) - Install rejects password with $$

  SSP-4620/         (Engine,CM) - Set TLSv1.2 protocol for CM, Engine and Web
                                  Server (Jetty)

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.1.1 (SP6011) GA Build 151               Jun 2020
-------------------------------------------------------------------------------

  New features see https://www.ibm.com/support/knowledgecenter/SS6PNW_6.0.1/com.ibm.help.ssp.overview.doc/ssp_whats_new.html

  o Support to scan inbound CD data in transit via Secure Proxy for virus and
    malware scan - See SSP-4309
  o Apply password policy for system passphrase and admin password for new
    installs - See SSP-3701
  o Upgrade Perimeter Server code to same as B2Bi 6.0.3.2 - See SSP-3966

  MFT-11042/        (Engine,PS) - Getting IOException: Too many open files

  SSP-3582/         (Engine)  - Blacklisted events are logged as ERROR messages

  SSP-3701/         (Engine,CM) - Apply password policy for system passphrase
                                  and admin password for new installs

  SSP-3966/         (Engine,PS) - Upgrade Perimeter Server code to same as
                                  B2Bi 6.0.3.2

  SSP-4016/         (CM)      - RESTAPI import does not update Jetty Server
                                alias

  SSP-4190/         (Engine) - Getting IllegalBlockSizeException after upgrade

  SSP-4198/         (CM)     - configureCmSsl -s utility not showing all certs

  SSP-4308/         (Engine,CM) - Add password policy for command line
                                  changePassphrase utility

  SSP-4309/SSP-4322 (Engine,CM) - Support for ICAP Anti-Virus Scanning in C:D

  SSP-4310/SSP-4445 (Engine,CM,PS) - Update JRE 1.8 to SR6 FP10 (8.0.6.10)
                                for security patches.

  SSP-4510/         (Engine,CM) - (SFTP) Allow reject option when ICAP session
                                  limit is exceeded

  SSP-4590/         (Engine)  - Missing HTTP headers in response from MFG

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.1.0 (SP6010) iFix 02 Plus Build 147     Jun 2020
-------------------------------------------------------------------------------

  MFT-11200/IT33098 (Engine)  - NPE in Maverick logs

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.1.0 (SP6010) iFix 02 Plus Build 145     May 2020
-------------------------------------------------------------------------------

  MFT-11151/IT32957 (Engine)  - SSP6010 upgrade fails on Windows

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.1.0 (SP6010) iFix 02 Plus Build 143     May 2020
-------------------------------------------------------------------------------

  MFT-10874/        (Engine)  - Engine listCerts.sh not working in 6010

  MFT-10995/IT32374 (Engine)  - SFTP adapter hung in a stopping state

  MFT-11060/IT32769 (Engine)  - SFTP Getting SSE2654 Session limit exceeded on
                                wrong adapter(s)

  MFT-11075/IT32687 (CM)      - Change to SFTP Policy in 6.0.1.0 greyed out the
                                Pass-Through option for Password and Key

  MFT-11106/IT32810 (CM)      - Unable to delete default self signed certificate 
                                from SSPCM

  SSP-4215/         (CM)      - RESTAPI import error -  Invalid cipher suite
                                specified twofish256-cbc

  SSP-4323/SEAS-1233 (Engine) - XML External Entity (XXE) vulnerability in SSP

  SSP-4346/         (Engine)  - SFTP ICAP AntiVirus scanning getting spurious
                                RuntimeException: no messages in ICAP cache

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.1.0 (SP6010) iFix 02 Build 134          Mar 2020
-------------------------------------------------------------------------------

  MFT-10765/IT31672 (CM)      - 6.0.0.1F1 with Client Auth not working with SAN
                                certs, getting ERR_BAD_SSL_CLIENT_AUTH_CERT

  MFT-10779         (CM)      - RESTAPI import errors with backupDir and
                                urlMapEntry

  MFT-10853/IT31763 (CM)      - (GUI) SSPcm user binds to LDAP twice with SEAS
                                for single login

  MFT-10887/        (CM,Engine,PS,SEAS) - GPF in SSP engine

  MFT-10889/IT32078 (CM)      - (GUI) CM session timeout still allows partial
                                access of the GUI function

  MFT-10898/        (CM,Engine,PS) - (Container) Can not create APP_USER in the
                                yaml file with GID of 1001

  MFT-10903/IT32096 (CM,Engine) - configureCmSsl and configureEngineSsl not
                                adding certificate chain to cmtrustore or
                                truststore

  MFT-10904/        (CM,Engine,PS,SEAS) - GPF in SSP engine

  MFT-10959/IT32191 (CM)      - (GUI) Unable to update keystore with certain
                                PFX keys. PEM format works

  SSP-3771/         (CM)      - Updates to make CM logging more readable

  SSP-3793/         (CM)      - Missing secure attribute in encrypted session
                               (SSL) cookie

  SSP-4182/         (CM)      - ICAP configuration field validation issues

  SSP-4183/         (CM,Engine) - Files with temporary names not getting AV
                                scanned

  SSP-4195/         (CM)      - RESTAPI ICAP field validation errors for empty 
                                maxSessions file extensions

  SSP-4202/         (CM)      - SSPCM was allowing unsupported HTTP methods to
                                be processed

  SSP-4207/         (CM, Engine)  - New Engine install fails while importing 
                                keycert if engine port is in use

  SSP-4223/         (Engine)  - Excessive logging on idle SFTP adapter

  SSP-4236/PSIRT21787 (Engine,CM,PS) - Update JRE 1.8 to SR6 FP5 (8.0.6.5)
                                for security patches.

  SSP-4244/         (Engine,CM,PS) - Cannot start docker container after
                                stopping it

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.1.0 (SP6010) iFix 01 Build 121          Jan 2020
-------------------------------------------------------------------------------

  MFT-10779         (CM)      - RESTAPI import errors with backupDir and
                                urlMapEntry

  SSP-4186          (Engine,CM) - System passphrase not getting validated
                                during upgrade when bootstrap is disabled

  SSP-4200          (Engine,CM) - Installer needs to confirm key passwords

  SSP-4208          (Engine)  - HSM command line clients cannot connect to
                                engine

  SSP-4220          (Engine,CM) - Installation issues with Docker containers

-------------------------------------------------------------------------------
Summary of Fixes for SP 6.0.1.0 (SP6010) GA Build 116                 Jan 2020
-------------------------------------------------------------------------------

  New features see https://www.ibm.com/support/knowledgecenter/SS6PNW_6.0.1/com.ibm.help.ssp.overview.doc/ssp_whats_new.html

  o Deploying IBM Secure Proxy containers in Red Hat OpenShift platform;
    Red Hat container certification
  o Support to scan inbound data in transit via Secure Proxy for virus and
    malware scan - See SSP-3834.
  o Support to secure connection between Engine and Configuration Manager using
    self-signed certificates - See SSP-3543
  o Support to prevent storage of passphrase required at start up using a
    utility - see SSP-3854
  o Support to set administrator password at installation

  SSP-3540          (Engine)  - Do not log sessionids or sso tokens used for
                                authentication

  SSP-3543          (CM, Engine) - Generate keys at install time

  SSP-3612          (Engine,CM) - Make Security Headers active by default for
                                  the HTTP adapter

  SSP-3803          (Engine,CM) - Generate unique encryption key at install
                                  time

  SSP-3834          (Engine,CM) - Support for ICAP Anti-Virus Scanning in SFTP

  SSP-3854          (Engine,CM) - New disableBootstrap command-line utility

  SSP-4120          (CM)      - Update Apache Commons BeanUtils to 1.9.4

-------------------------------------------------------------------------------
Summary of Fixes for SP6000 FixPack 1 (SP6001) iFix 01 Plus Build 136  Jan 2020
-------------------------------------------------------------------------------

  MFT-10616/IT30591 (CM)      - REST API fails with "The processing instruction
                                target matching "[xX][mM][lL]" is not allowed"

  MFT-10656/IT30692 (CM)      - SSPCM “Enable SSP CM startup backup” field in
                                CM System settings has no effect

  MFT-10692/IT30823 (CM)      - (FTP) EPSV command giving wrong response

  MFT-10704/IT31049 (Engine)  - Engine audit logs contain hashed passwords

  MFT-10737/IT31341 (Engine)  - Unable to login to the CM after upgrade

  MFT-10749/IT31534 (CM)      - NPE during RESTAPI session cleanup.

  MFT-10762/IT31135 (Engine)  - (CD) SSP incorrectly logs stepname of run task
                                and run job C:D process steps

  MFT-10774/IT31439 (Engine)  - (CD) CSP032E 4 KQV keyword "RLS2" found in FM70,
                                 but not defined in XML schema definition

  MFT-10832/IT31500 (Engine)  - (HTTP) Duplicate Host Header attribute

  SEAS-1083/        (Engine)  - (HTTP) Password change on SSO portal clears all
                                policies on password policy display tab

-------------------------------------------------------------------------------
Summary of Fixes for SP6000 FixPack 1 (SP6001) iFix 01 Build 124  Oct 2019
-------------------------------------------------------------------------------

  MFT-10357/PSIRT16274,16318 (Engine,CM) - Security upgrade to Jetty 9.4.20

  MFT-10485/IT30344 (Engine)  - (SFTP) OutOfMemoryError "Java heap space" crash

  MFT-10578/PSIRT17288 (Engine,CM,PS) - Update JRE 1.8 to SR5 FP40 (8.0.5.40)
                                for security patches.

  MFT-10608/IT30643 (Engine)  - (SFTP) Added client ciphers as well as
                                negotiated ciphers in logging.

-------------------------------------------------------------------------------
Summary of Fixes for SP6000 FixPack 1 (SP6001) iFix 00 Plus Build 122  Oct 2019
-------------------------------------------------------------------------------

  MFT-10541/IT30346 (CM)      - (RESTAPI) userStore API update throwing
                                exception on CLI.

  MFT-10559/IT30200 (CM)      - Jetty Http server uses incorrect certificate
                                alias

  MFT-10564/IT30532 (Engine)  - Blacklist not displaying messages for SFTP 
                                protocol

-------------------------------------------------------------------------------
Summary of Fixes for SP6000 FixPack 1 (SP6001) iFix 00 Plus Build 119  Sep 2019
-------------------------------------------------------------------------------

  MFT-10402/IT30050 (Engine)  - *HIPER* (SFTP) OutOfMemory (out of threads) 
                                when SEAS goes down with no failover coded

  MFT-10483/IT30076 (CM)      - RESTAPI activity leads to OutOfMemory (OOM)
                                full of AuthenticationResource, JMS objects

  SSP-3530/         (CM)      - REST API issues when importing from older CM

  SSP-3810/         (CM)      - REST API xsd failure for ssoConfig and 
                                sysGlobals

  SSP-3833/         (CM)      - RESTAPI failure on userstore entry without
                                password policy.

-------------------------------------------------------------------------------
Summary of Fixes for SP6000 FixPack 1 (SP6001) GA Build 114           Aug 2019
-------------------------------------------------------------------------------

  New Features - see https://www.ibm.com/support/knowledgecenter/SS6PNW_6.0.0/com.ibm.help.ssp.overview.doc/ssp_whats_new.html

    o Support to include HTTP host header and client IP address in requests
      forwarded to backend HTTP servers. See SSP-3667 for more information
    o Additional configuration fields to support SSO and external SAML IdP
    o Support to export encrypted configuration data via RESTful APIs
      - ACTION: Requires new X-Passphrase keyword for exporting, importing
           sensitive objects: sspCMConfigs, Netmaps, Keystores, sysSslInfo,
           globals. See SSP-3539.
    o Require user to supply admin password at new installation. See SSP-3537
    o Rebrand the product name to IBM® Secure Proxy

  MFT-10355/      (Engine)    - Getting myFileGateway "Session expired" popup.

  MFT-10451/IT30080 (CM)      - CM GUI presents factory cert instead of common

  SSP-3536/        (CM,Engine) - Log authentication failures for command line
                                 utilities in audit log

  SSP-3537/         (CM)      - Require admin password to be set during new CM 
                                installation

  SSP-3539/         (CM)      - (RESTAPI) Require password when exporting and
                                importing sensitive configuration objects

  SSP-3599, SSP-3603/ (Engine) - Support for Web Session for HTTP SSO sessions

  SSP-3667/         (CM)      - Support for X-Forwarded* HTTP headers

  SSP-3763/       (Engine/CM) - Restrict permissions of the Unix bootstrap file

-------------------------------------------------------------------------------
Summary of Fixes for SSP6000 iFix 03 Build 203                        Aug 2019
-------------------------------------------------------------------------------

  SSP-3788/         (Engine)  - Installation JPEG picture contains wrong
                                product name

-------------------------------------------------------------------------------
Summary of Fixes for SSP6000 iFix 02 Plus Build 198                  July 2019
-------------------------------------------------------------------------------

  MFT-10422/IT29819 (Engine)  - (HSM) FTPS data channel hangs during SSL
                                handshake with HSM enabled

  MFT-10444/IT29840 (CM)      - RESTAPI script fails if the admin user is
                                defined to use external authentication

  MFT-10470/IT29827 (Engine)  - HTTP 500 message for /Signon/login.html after
                                upgrade to SSP6000 iFix 2+ B189.

  SSP-3771/                   - Add direction arrows ===> for readability in
                                FTP logs

-------------------------------------------------------------------------------
Summary of Fixes for SSP6000 iFix 02 Plus Build 189                  July 2019
-------------------------------------------------------------------------------

  MFT-10207/IT29589 (Engine)  - (HTTP) Getting myFileGateway "Session
                                expired" popup using passthrough authentication

-------------------------------------------------------------------------------
Summary of Fixes for SSP6000 iFix 02 Build 181                       June 2019
-------------------------------------------------------------------------------

  MFT-10242/PSIRT15330 (Engine,CM,PS) - Update JRE 1.8 to SR5 FP35 (8.0.5.35)
                                for security patches.

-------------------------------------------------------------------------------
Summary of Fixes for SSP6000 iFix 01 Plus Build 177                  June 2019
-------------------------------------------------------------------------------

  MFT-9915/IT29131  (Engine)  - Memory leak in logging area causes OutOfMemory

  MFT-10325/IT29109 (CM)      - RESTAPI Issues with importing keyDefEntries.

  MFT-10341/IT29130 (Engine)  - (HTTP) Directory traversal issue

  MFT-10368/IT29310 (Engine)  - SSP Nodes getting into deadlock state

  MFT-10374/IT29318 (CM)      - (RESTAPI) Unable to import keyDefEntries

  MFT-10382/IT29278 (PS)      - More Secure PS (MSPS) scripts on Windows have
                                wrong service name

  SSP-3542/         (Engine)  - Only allow selected whitelisted pages under
                                /Signon to be rendered by engine

  SSP-3561/         (Engine)  - HSM IBMPKCS11 sample config files

  SSP-3597/         (Engine,CM,PS) - InstallAnywhere 2018 upgrade

  SSP-3698/         (Engine)  - Adapter and netmap logs going to secureproxy.log
                                instead, missing log files

-------------------------------------------------------------------------------
Summary of Fixes for SSP6000 iFix 01 Plus Build 148                  May 2019
-------------------------------------------------------------------------------

  MFT-9906/IT28592 (Engine)   - (HSM,CD) Intermittent timeout during SSL
                                handshake

  MFT-9976/IT28591 (Engine)   - (HSM,CD) Unable to open HSM keystore during SSL
                                Handshake

  MFT-10129/IT27075 (Engine)  - (HTTP) Failures in HTTP adapters after upgrade
                                to SSP 3.4.3.2 iFix 3

  MFT-10206/IT28929 (CM)      - Problem with SSPcm certificate renewal process

  MFT-10218/IT28554 (Engine)  - SSP sending FTP STOR command multiple times,
                                leading to '451 - session in inconsistent state'

  MFT-10219/IT28683 (Engine)  - (SFTP) All SFTP clients timing out connecting
                                to back end SFTP adapters

  MFT-10241/IT28986 (CM)      - SSPRestAPI fails with SNI handshake from client

  MFT-10250/IT29018 (Engine)  - OutOfMemory during SFTP transfer after upgrade

  MFT-10257/IT28968 (Engine, CM) - Sporadic loss of data during bulk transfer
                                   of multiple files via Filezilla FTP client

  SSP-3023/RTC569596 (CM,Engine) - (SFTP) Upgrade Maverick to 1.7.20 for
                                additional ciphers

  SSP-3132/         (CM,Engine) - Make TLSv1.2 the default protocol for secure
                                connections

  SSP-3525/         (CM)      - SSO Configuration allowing invalid characters
  
  SSP-3531/         (CM)      - Correct legacy "TLS_ONLY" value to correct JSSE
                                equivalent

  SSP-3592/         (Engine)  - Prompt for HSM password in configureHsmPassword 
                                utility

  SSP-3660/         (Engine)  - Add limit to number of data buffers being
                                cached in FTP

-------------------------------------------------------------------------------
Summary of Fixes for SSP6000 iFix 01 Build 115                       Mar 2019
-------------------------------------------------------------------------------

  MFT-10020/IT27450 (CM)      - Peer Address Pattern now allows starting or
                                ending with *

  SSP-2968/No APAR  (CM)      - Allow HTTP response header overrides

  SSP-3109/SSP-3578 (CM)      - Better help in change password screen

  SSP-3444/No APAR  (CM)      - Internal AppScan - CSRF - Login SSPNonce

  SSP-3446/No APAR  (CM)      - (GUI) Adapters listed out of order in monitor

  SSP-3451/No APAR  (CM)      - (GUI) Ensure HTTP Header values only have ASCII
                                characters

  SSP-3458/No APAR  (CM)      - Internal AppScan - HTTP cookies

  SSP-3511/No APAR  (CM, Engine) - (PeSIT) Netmap not accepting wildcard entries

  SSP-3515/No APAR  (Engine)  - Improving messages for PeSIT user blacklisting

  SSP-3525/No APAR  (CM)      - SAML 2.0 related field validations

  SSP-3579/No APAR  (CM)      - SFTP netmap peer address pattern with multiple
                                "?" wildcards fails with PatternSyntaxException

  SSP-3584/SSP-3597 (CM,Engine,PS,SEAS) - Support for Windows 2016

  SSP-3606/No APAR  (CM)      - (REST API) Unable to import XML with
                                httpSecurityHeaders


===============================================================================
III. Detailed Description of Fixes (in Defect ascending order)
     Fixes are marked as Engine, CM (Configuration Manager), and PS (Perimeter)
===============================================================================

  PSIRT12959,  (Engine,CM,PS) - Update JRE 1.8 to SR5 FP27 (8.0.5.27) for
  PSIRT13809                    security patches.

    Resolution: Update the JRE 1.8 to bring it up to the Oracle October 2018
    level to satisfy the CVEs in PSIRT advisories 12959 and 13809.
    See http://www.ibm.com/support/docview.wss?uid=ibm10872758 for the
    Security Bulletin.
    ACTION - JRE 1.8 SR5 FP27 (8.0.5.27) introduced a change to disable SHA1
    certificates via the jdk.certpath.disabledAlgorithms parameter in the
    <SSP>/jre/lib/security/java.security file.  For more information, read the
    comments in the java.security file which relate to the added parm:
      jdk.certpath.disabledAlgorithms= * * *, SHA1 jdkCA & usage TLSServer,

  MFT-9906/IT28592 (Engine)   - (HSM,CD) Intermittent timeout during SSL
                                handshake

    When using an HSM device to store SSL private keys, the SSL handshake
    sometimes timed out because it took longer than 5 minutes to pull the
    key from the keystore. The PNode disconnected due to timeout. Symptom:
      CSP900E Logged Exception : java.net.SocketException: Underlying socket
      is not connected

    Resolution: Eliminated 2 redundant loads of the HSM keystore which were
    causing a delay. Also added some extra debug to help track the flow leading
    up to the handshake.

  MFT-9915/IT29131 (Engine)   - Memory leak in logging area causes OutOfMemory
  
    A slow memory leak in the log4j2 logging subsystem led to an OutOfMemory
    (OOM) exception crash of the SSP engine after several weeks. Analysis of 
    the heap dumps showed the following:
      The class "org.apache.logging.log4j.core.appender.AbstractManager"
      occupies 1,904,050,896 (89.23%) bytes. The memory is accumulated in one 
      instance of "java.util.HashMap$Node[]".
    For each new session in which logging was enabled, the logging system was
    adding a new appender to write to the log file, even though in most cases, 
    one already existed for that file.

    Resolution: Corrected the logic which decided whether a new logging 
    appender was required so that duplicate entries would not longer 
    accumulate and cause an OOM exception.

  MFT-9976/IT28591 (Engine)   - (HSM,CD) Unable to open HSM keystore during SSL
                                Handshake

    Customer running a Gemalto (Luna) HSM device was unable to open the device
    during an SSL handshake for a CD process. The HSM keystore passphrase
    supplied with the confgureHsmPassphrase.sh was not working.  Symptom:
      CSP900E Logged Exception : java.io.IOException - Vendor defined error
        (0x80000067)

    Resolution: Now correctly provide the HSM passphrase to the Luna device at
    SSP initialization time so it can be initialized.  Also added better stack
    traces to help show if the problem is in IBMPKCS11, JSSE, or HSM code.

  MFT-10020/IT27450 (CM)      - Peer Address Pattern now allows starting or 
                                ending with *

    On the Netmap Inbound Node Definition screens for CD, FTP, HTTP, and SFTP,
    the ability to have peer address patterns which started or ended with *,  
    ex: *.company.com  or  www.company.* was broken.
    Also known internally for SSP6000 branch as SSP-3562.  SSP-3357 provided
    REST API support to match the GUI changes.

    Resolution: Corrected the parser which was keeping these patterns from
    working.

  MFT-10129/IT27075 (Engine)  - (HTTP) Failures in HTTP adapters after upgrade
                                to SSP 3.4.3.2 iFix 3

    After Customer applied SSP3432 iFix 3, certain HTTP transactions were 
    failing with:
       SSP175E Invalid HTTP Request method. Client possibly attempting SSL/TLS 
         connection.
       SSP0231E Invalid data from client (Exception unmarshalling) -
         com.sterlingcommerce.csp.jetty.io.ValidationFailedException, null

    Resolution: Now wait till a full request line is received before calling
    validateMethod()

  MFT-10206/IT28929 (CM)      - Problem with SSPcm certificate renewal process

    When using the CM GUI to update a keycert which is also used for connecting
    to SEAS, the copy of the certificate in the <CM>/conf/system/cmkeystore is
    not updated.  If CM users are authenticated by SEAS, the connections to
    SEAS fail with an expired certificate.  During connections to SEAS from the
    CM, the truststore and keystore entries needed for the connection were
    being copied from the configuration to the cmtruststore and cmkeystore,
    respectively to assist in the connection. But if an entry already existed,
    it was not updated.

    Resolution: Updated the CM code which connects to SEAS to build the
    the temporary keystore and truststore in memory rather than updating the
    files in <CM>/conf/system.

  MFT-10207/IT29589 (Engine)  - (HTTP) Getting myFileGateway "Session
                                expired" popup using passthrough authentication

    Since the Jetty upgrade in 3.4.3.2 iFix 2 Plus Build 263, Customers were 
    getting several strange behaviors connecting to myFileGateway via HTTP doing
    passthrough. Customers who had the front end (inbound) connection secured
    and the back end (outbound) session non-secure were getting a "Session 
    expired due to inactivity" popup immediately from myFileGateway.  Other 
    Customers found that even if both sides of the session were secured, when 
    they logged off and back on, they got the "Session expired" message.
    
    Resolution: Corrected the code to send all cookies back and forth between 
    the two sessions and to correctly send cookies based on the Security 
    attribute.

  MFT-10218/IT28554 (Engine)  - SSP sending FTP STOR command multiple times,
                                leading to '451 - session in inconsistent state'
                                
    A client attempted to send a large number of files during a single FTP
    session through SSP to a B2Bi backend. The first few transfers succeeded, 
    but then SSP happened to send the STOR command to the server twice in a row
    causing the backend to respond with 
      451 Requested action aborted: session in inconsistent state.
    All subsequent uploads in the session then failed with the same error.
    
    Corrected this timing issue by always clearing the cached command queue 
    before returning to the 'CommandHandler' state.

  MFT-10219/IT28683 (Engine)  - (SFTP) All SFTP clients timing out connecting 
                                to back end SFTP adapters

    SFTP adapters were stalling when making connections to the backend SFTP 
    server because a getLocalHost operation was hanging.
    
    Resolution: Updated the SFTP backend session setup logic to no longer do
    the getLocalHost operation to find the local NIC for the connection to the
    back end.  This is already handled by the SSP local Perimeter Server code.
    Workaround: Supply the SFTP Adapter property 
      sftp.listenAddress = nnn.nn.nnn.nn to supply the local NIC address.

  MFT-10241/IT28986 (CM)      - SSPRestAPI fails with SNI handshake from client

    The Customer replaced their factory certificate with a self-signed keycert
    using a wildcard in the common name: CN=*.si.com. When submitting the
    sspRestAPI.sh script, the TLS ClientHello message included a server_name
    extension, which caused the connection to fail with 
      /sspcmrest/sspcm/rest/session org.eclipse.jetty.http.BadMessageException:
      400: Host does not match SNI
    The REST API client was not inserting HTTP header host name during
    connection to the SSP CM, and the Jetty on the CM server side was set to
    enforce SNI checking if the client indicated it.
    
    Resolution:  Corrected the client side of the RESTAPI to allow the HTTP
    header host name to be set in the sspRestAPI.properties so that it matches 
    the CN of Client's public key CN.  Also changed the behavior of the CM to 
    disable the SNI checking if the k=-Dssp.cm.jetty.sni.enable=false is set 
    in the startCM.sh script.

  MFT-10250/IT29018 (Engine)  - OutOfMemory during SFTP transfer after upgrade

    Customer applied SSP3432 iFix 4 Plus Build 291 and encountered OutOfMemory
    (OOM) crash when transferring files with SFTP.  The build included a new
    Maverick toolkit which changed the way it managed buffers during transfers.
    The heap dump contained tens of thousands of com/maverick/ssh/Packet
    objects.

    Resolution: Updated the API calls to use the new CreatePacket method in the
    Maverick toolkit, which is the preferred method of managing the memory.

  MFT-10257/IT28968 (Engine, CM) - Sporadic loss of data during bulk transfer
                                   of multiple files via Filezilla FTP client

    Customer attempting to upload 500 files with Filezilla was getting many
    files missing and missing data in the files which were transferred.
    The utility was sending data before SSP had signalled it was ready to
    receive.

    Resolution: Now maintain a temporary buffer to hold the data sent from the
    FTP client before SSP is ready to receive it.  See also SSP-3660.

  SSP-2968/No APAR  (CM)     - Allow HTTP response header overrides
  
    Resolution: Allow the user to be able to override the default values for 
    these response headers:
      X-Frame-Options, X-XSS-Protection, Content Security Policy, 
      X-Content-Type-Options and Strict-Transport-Security

  SSP-3023/RTC569596 (CM,Engine) - (SFTP) Upgrade Maverick to 1.7.20 for
                                additional ciphers

    The Maverick 1.6.x toolkit goes out of support at the end of 2019.  Also,
    there have been requests for additional ciphers which are provided in the
    1.7.20 toolkit.
    
    Resolution: Now utilize the Maverick J2SSH client and SSHD server toolkits,
    which also supply the following new ciphers
      New ciphers:  aes128-gcm@openssh.com, aes256-gcm@openssh.com
      New macs:     hmac-ripemd160, hmac-ripemd160-etm@openssh.com
                    hmac-sha2-256-etm@openssh.com, hmac-sha2-512-etm@openssh.com
      New groups:   ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521,
                    curve25519-sha256@libssh.org

  SSP-3109/SSP-3578 (CM)       - Better help in change password screen
  
    When the password policy is used for CM users, there should be better
    messages in the change password screen.
    
    Resolution: Added popup assistance messages such as, "Your password is 
    required to contain at least one of the following characters `#@$%^&* "
    And, "Confirm password must match New Password".

  SSP-3444/No APAR (CM)       - Internal AppScan - CSRF - Login SSPNonce
  
    An internal APPScan revealed that CM GUI sessions were using an 
    insufficient authentication method.
    
    Resolution: Now validate the value of the "Referer" header and use a 
    one-time nonce for each submitted form.

  SSP-3446/No APAR (CM)       - (GUI) Adapters listed out of order in monitor
                                tab

    In the CM monitor tab, the Engine status lines were in alphanumeric order
    but the adapter lines were not.

    Resolution: Corrected the monitor screen to display the adapters in
    alphanumeric order.

  SSP-3451/No APAR (CM)       - (GUI) Ensure HTTP Header values only have ASCII
                                characters

    Http headers need to be validated to make sure that values are in ascii
    format.

    Resolution: Now validate the HTTP headers for ASCII data.

  SSP-3458/No APAR (CM)       - Internal AppScan - HTTP cookies

    An internal APPScan recommended some updates for HTTP cookies used to
    access the GUI.

    Resolution: Now set the domain and path for HTTP cookies containing session
    identifiers to an appropriately restricted value for the site.

  SSP-3511/No APAR (CM, Engine) - (PeSIT) Netmap not accepting wildcard entries

    The PeSIT protocol netmap for inbound entries was not allowing wildcard
    patterns, such as "CX1*" or "CX2*", only a full wildcard "*" or full names.

    Resolution: Now allow the PeSIT netmap to accept peer address patterns.

  SSP-3515/No APAR (Engine)   - Improving messages for PeSIT user blacklisting

    When using the new blacklisting feature introduced in SSP 6.0, the IP
    address blacklisting works for PeSIT and indicates that the session was
    rejected because the address was blacklisted. But while the user 
    blacklisting locked the PeSIT user, the log did not say it was because of
    blacklisting.
    
    Resolution: Now put out SSP0511E message for locked userid which indicates
    the PeSIT account was locked due to blacklisting.

  SSP-3525/No APAR (CM)      - SAML 2.0 related field validations
  
    In the Advanced / SSO Configuration screen, the new SAML 2.0 fields 
    introduced in SSP 6.0 were not being validated fully.  

    Resolution: Now do URL validation for - Service Provider ID, External 
    Portal Login URL, and the External Portal Logout URL.  Also for Fully 
    Qualified Host Names, added a similar validation for the Primary 
    Destination Address field, which means the FQDN for SSO will not accept 
    any kind of IP pattern or peer address pattern. **

  SSP-3579/No APAR (CM)      - SFTP netmap peer address pattern with multiple
                               "?" wildcards fails with PatternSyntaxException

    SFTP netmap peer address pattern that contained two or more "?" characters
    was throwing exception
      *--*java.util.regex.PatternSyntaxException: Dangling meta character.
      
    Resolution: Now allow multiple ? characters in the SFTP netmap peer address
    pattern.

  SSP-3584/SSP-3597 (CM,Engine,PS,SEAS) - Support for Windows 2016
  
    Resolution: Add support for Windows 2016 - Upgraded all installers to use
    InstallAnywhere 2018 SP1.

  SSP-3606/No APAR (CM)      - (REST API) Unable to import XML with 
                               httpSecurityHeaders
    
    The new HTTP Security Header overrides introduced in SSP-2968 were not 
    being handled correctly by the RESTAPI import tool.

    Resolution: Modified the SSP 6.0 sysglobals.xsd to accept the 
    httpSecurityHeader & cookie domain fields.

  SSP-3660/         (Engine)  - Add limit to number of data buffers being
                                cached in FTP

    This is an extension of MFT-10257.

    Resolution: Added new FTP adapter property ftp.max.data.buffers.cache=50 
    to limit number of data buffers being cached in FTP to avoid an out of 
    memory issue. The value must be an integer > zero and <= 999.

  MFT-10325/IT29109 (CM)      - RESTAPI Issues with importing keyDefEntries. 
  
    Customer attempting to use the REST API to import a key certificate, but
    getting, "Create key operation failed. - Error parsing request: expected 
    root xml element to be elements but received keyStoreDef".  
    Workaround: Set N=-DvalidateThruXSD=false in the bin/startCM.sh. 

    Resolution: Updated the XSD syntax definition file to allow user to provide 
    input xml with <elements> tag as the root. Also made changes to the 
    createKeyDef, modifyKeyDefEntries and deleteKeyDefEntries apis to make them
    work correctly with the CLI. Now also removed the ability to add or delete
    certificates in the internal CM->System->Certificate Stores, since they
    do not allow updates from the GUI either.

  MFT-10341/IT29130 (Engine)  - (HTTP) Directory traversal issue
  
    Customer noticed that URLs including ..//..//, which is a common directory
    traversal hack, were being passed back to SI/SFG to be handled.
    
    Resolution: Added code to strip the intervening dots and slashes using 
    canonical methods, further protecting the backend server.

  MFT-10357/PSIRT16274,16318 (Engine,CM) - Security upgrade to Jetty 9.4.20

    Resolution: Update the Jetty server to satisfy the CVEs in PSIRT advisories
    16274 and 16318.
    See http://www.ibm.com/support/docview.wss?uid=ibm11095826 for the
    Security Bulletin.

  MFT-10368/IT29310  (Engine)  - SSP Nodes getting into deadlock state
  
    After applying SSP3432 iFix 4 Plus Build 295, the Customer found that 
    several nodes were hanging, caused by threads in a deadlocked state.
    
    Resolution:  Corrected a locking mechanism introduced by defect MFT-10257
    which caused threads to be deadlocked.

  MFT-10374/IT29318 (CM)      - (RESTAPI) Unable to import keyDefEntries

    Customer exported their CM configuration using the RESTAPI but could not 
    import it back in.  They were getting 
      "cvc-complex-type.2.4.a: Invalid content was found starting with element 
      'keyauthReqdBeforePwdauth'"
      
    Resolution: Updated the xsd definition file to allow the
    keyauthReqdBeforePwdauth keyword on import.

  MFT-10382/IT29278 (PS)      - More Secure PS (MSPS) scripts on Windows have 
                                wrong service name

    When installing a Perimeter Server on Windows as a More Secure PS, the
    startPSservice.cmd and stopPSservice.cmd scripts are generated without
    the engine hostname in the service name, so that they will not actually
    start or stop the service.
    
    Resolution: Updated the InstallAnywhere step for a More Secure Perimeter
    Server to add the Engine host to the Windows Service name:
      SSP_PerimeterServer_%EnginePort%_$EngineHost$

  SSP-3132/         (CM,Engine) - Make TLSv1.2 the default protocol for secure
                                connections

    SSP formerly installed with TLSv1 as the default TLS protocol.

    Resolution: For new installs, make TLSv1.2 the default protocol everywhere
    a TLS secure connection is made.

  SSP-3525/         (CM)      - SSO Configuration allowing invalid characters
  
    The CM->Advanced->SSO Configuration was allowing special characters other
    than "-", "_", "." and ":" in the "Fully Qualified Hostname" field.
    
    Resolution: Now ensure that the hosthame value only uses standard 
    characters.

  SSP-3531/         (CM)      - Correct legacy "TLS_ONLY" value to correct JSSE
                                equivalent

    An older configuration may contain the "TLS_ONLY" protocol value, which
    resulted in "java.security.NoSuchAlgorithmException: TLS_ONLY SSLContext
    not available"

    Resolution: Now automatically convert TSL_ONLY to the correct JSSE
    equivalent.

  SSP-3542/         (Engine)  - Only allow selected whitelisted pages under
                                /Signon to be rendered by engine

    Clients accessing the SSP HTTP proxy adapter login portal send requests 
    with a URL path starting with /Signon/. Currently SSP will render any html
    pages and resources under the login dir configured (<Install dir>/Signon/).

    Resolution: Updated the Http Proxy in SSP to white list the html pages and 
    other resources being rendered to the client. A new property file is 
    created at <SSP>/bin/portal/pages.properties. Secure proxy will render only 
    the files listed in this properties file.  If a page request is made to a 
    file not in the properties file, the following error is returned:
      Engine_host is currently unable to handle this request.
      
    ACTION: If you have added additional files or directories as part of
    customizing the Login portal (/Signon directory), you must add whitelist
    entries for them similar to the existing entries in the new 
    <SSP>/bin/portal/pages.properties file.

  SSP-3561/         (Engine)  - HSM IBMPKCS11 sample config files
  
    SSP was shipping the Luna 5.0 configuration file for Customers who use
    HSM boxes, even though that version is no longer supported.
    
    Resolution: Now ship the Lunx 6.0 configuration file in the <Engine>/conf
    directory and include all the supported IBMPKCS11 sample config files in a
    new file called <Engine>/conf/PKCS11ConfigFiles.zip.

  SSP-3592/         (Engine)  - Prompt for HSM password in configureHsmPassword 
                                utility
    The configureHsmPassword utility only allowed specifying the HSM password
    on the command line which exposes the password in the system log.
    
    Resolution: The configureHsmPassword utility now prompts for the HSM 
    password and does not echo the typing.

  SSP-3597/         (Engine,CM,PS) - InstallAnywhere 2018 upgrade
  
    Resolution: Upgraded to InstallAnywhere 2018, which provides support for 
    Windows 2016 Server.

  SSP-3698/        (Engine)   - Adapter and netmap logs going to secureproxy.log
                                instead, missing log files
                                
   The fix for MFT-9915 caused the adapter and netmap logs to no longer be
   created, with all logging going to the secureproxy.log.
   
   Resolution: Corrected the fix to not create a new appender for a new 
   session if the appender and logger already existed, but to use the 
   existing proven method when starting to log to a new file.

  MFT-10242/PSIRT15330 (Engine,CM,PS) - Update JRE 1.8 to SR5 FP35 (8.0.5.35)
                                for security patches.

    Resolution: Update the JRE 1.8 to bring it up to the Oracle April 2019
    level to satisfy the CVEs in PSIRT advisory 15330.
    See http://www.ibm.com/support/docview.wss?uid=ibm10885937 for the
    Security Bulletin.

    ACTION - JRE 1.8 SR5 FP35 (8.0.5.35) introduced a change to disable anon
    and null cipher suites via the jdk.tls.disabledAlgorithms parameter in the
    <SSP>/jre/lib/security/java.security file.  If your site uses these suites
    for testing, update your java.security file to remove the last 2 parms:
       jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, DH keySize < 1024, DESede, \
       EC keySize < 224, 3DES_EDE_CBC, anon, NULL
    ACTION - The java.security file includes a new parm for distrusting CAs:
       jdk.security.caDistrustPolicies=SYMANTEC_TLS
    For more information, see the writeup in the java.security file.

  MFT-10355/      (Engine)    - Getting myFileGateway "Session expired" popup.

    MFG was showing "Session expired popup" when logging in via SSP using
    passthrough. SSP was only sending one Set-Cookie to the client, even if
    there were multiple Set-Cookies from the backend. Also, the Secure
    attribute in Set-Cookie was not getting set according to the security
    setting of the inbound connection.

    Resolution: Now do Set-Cookies properly to prevent session expire popUps to
    be shown.

  MFT-10402/IT30050 (Engine)  - *HIPER* (SFTP) OutOfMemory (out of threads)
                                when SEAS goes down with no failover coded

    Customer defined an SFTP adapter which uses SEAS External Authentication 
    but did not have failover properties coded. When the SEAS became 
    unreachable for several hours, new connections and load balancer pings 
    continued to be directed to the SEAS for authentication until the JRE used
    up all available threads based on the numprocs alotted to the user. The
    adapter's max session value was ignored when in this state.

    Resolution: Firmed up the code in the following ways: 1) When at the
    adapter max session count, shut down any new session without calling SEAS.
    2) If a new session comes in and EA is detected down, shut down the session
    and report a system failure to the caller. 3) If EA authentication fails
    for any reason, since we do not have a token, bypass calling SEAS to 
    invalidate the token during session shutdown.
    
    Workaround/Best practice: Define failover properties in each SFTP adapter
    that uses SEAS to ensure that when SEAS or SI is detected to be down, the 
    adapter will turn off its listener to stop incoming traffic until SEAS and 
    SI are detected to be up again:
      failover.detection.enabled  true
      failover.detection.mode     continuous
      failover.poll.interval      15  (seconds)

  MFT-10422/IT29819 (Engine)  - (HSM) FTPS data channel hangs during SSL
                                handshake with HSM enabled

    The HSM keystore was taking a long time to load during the ssl handshake 
    which resulted in session timeouts.
    
    Resolution: Now load the HSM keystore during engine startup time and keep
    it in memory to speed up subsequent handshakes. Also, reload the HSM 
    keystore periodically based on the value of the RELOAD_HSM_KEYSTORE_TIME
    parm in the <Engine>/bin/security.property file, default 15 (minutes).

  MFT-10444/IT29840 (CM)      - RESTAPI script fails if the admin user is
                                defined to use external authentication
                                
    The RESTAPI was doing local authentication in addition to external auth
    when the admin user running the RESTAP was defined as using EA.
    
    Resolution: Now properly authenticate users defined as external auth when
    running the RESTAPI.

  MFT-10451/IT30080 (CM)      - CM GUI presents factory cert instead of common
  
    The Customer attempted to replace their SSP factory certificate with a new
    common certificate with the ./configureCmSsl.sh -u commonCert=<keycertfile>
    command.  The CM and Web certs showed to be using the new alias.  However,
    when connecting to the CM GUI, the SSL certificate displayed was the SSP
    factory certificate.

    Resolution: Now ensure that at the low level keystore operation, the 
    designated keycert alias is honored when the key is requested.
    Workaround:  After the new commonCert has been added, delete the "factory"
    alias using the ./configureCmSsl.sh -d alias=factory

  MFT-10470/IT29827 (Engine)  - HTTP 500 message for /Signon/login.html after
                                upgrade to SSP6000 iFix 2+ B189.
                                
    The new blacklist/whitelist feature in SSP6000 was interfering with the 
    portal pages (/Signon, etc) on a UNIX/Linux sytem.  The whitelist page list
    in <Engine>/bin/portal/pages.properties used backward slashes for all the
    page names, which was only compatible with Windows systems.
    
    Resolution: Changed all the white listed page names to use forward slashes 
    as the path separator. And now in the code, convert the path to forward 
    slash to compare no matter if it is UNIX or Windows.

  MFT-10483/IT30076 (CM)      - RESTAPI activity leads to OutOfMemory (OOM)
                                full of AuthenticationResource, JMS objects

    The Customer is making heavy use of the REST API to update their 
    configuration.  After many sessions, the CM gets an OOM exception because
    the memory is full of AuthenticationResource objects.  Also, at one point
    the Customer had JMS logging configured in the CM system tab without a JMS
    queue activated to receive the data which filled the memory with a
    JmsPublisherProxy object.

    Resolution: Now ensure that the AuthenticationResource session object is
    cleaned up at the end of each RESTAPI session.  Also, maintain a limit of
    JMS queue objects so that we don't overflow the memory when the JMS queue
    is not active.

  MFT-10485/IT30344 (Engine)  - (SFTP) OutOfMemoryError "Java heap space" crash

    The SFTP adapter was adding to a backendRegistrarMap object each time a
    session opened a corresponding session to the back end SI server. However,
    in some cases, the placeholder in the map was not getting cleaned out at 
    logoff time. The heap dump showed that 91% of the memory was consumed by one
    class "com.sterlingcommerce.cspssh.daemon.SftpAccessManager", and one object
    java.util.HashMap$Node[].
    
    Resolution: Now ensure that the session entry is cleaned out at logoff time
    from the backendRegistrarMap.

  SSP-3530/         (CM)      - REST API issues when importing from older CM

    Internal testing found several issues when importing a configuration with
    the REST API which was exported from an older version of SSP. The 
    <keyStoreDef> got syntax errors with the 'createdBy' and 'formatVer' 
    elements, the import rejected expired certificates and cipher suites
    which had been deprecated, and the factory certificate was not replaced.
    
    Resolution: Updated the RESTAPI import logic to recognize and include
    artifacts from older versions to make upgrades between versions more
    seamless.

  SSP-3771/                   - Add direction arrows ===> for readability in
                                FTP logs

    Resolution:  Added some directional arrows in the logging for FTP control
    channel traffic to make it easier to follow the flow of data between the
    client and SSP and between SSP and the back end server.  Examples:
      ===> RECV fr Client:
      SEND to Server ===>:
      RECV fr Server <===:
      <=== SEND to Client:

  SSP-3788/         (Engine)  - Installation JPEG picture contains wrong
                                product name
 
    Resolution: Updated the JPEG file to contain the correct product name.

  SSP-3810/         (CM)      - REST API xsd failure for ssoConfig and 
                                sysGlobals
                                
    XSD validation failures for ssoConfig and SysGlobals were preventing update
    and import operations.
    
    Resolution: Updated the xsd files to include all the correct elements.

  SSP-3833/         (CM)      - RESTAPI failure on userstore entry without
                                password policy.
      
    REST API import of SSP CM user was failing with invalid passwordPolicy
    when the user had no password policy assigned.

    Resolution: Now allow CM users having no password policy to be imported.

  MFT-10541/IT30346 (CM)      - (RESTAPI) userStore API update throwing
                                exception on CLI.

    After a userStore update operation using the RESTAPI Command Line Interface
    if the xml contained "<?xml version="1.0" encoding="UTF-8"?>" the operation
    reports success but then gets a message: org.xml.sax.SAXParseException: 
    The processing instruction target matching "[xX][mM][lL]" is not allowed.

    Resolution: Now remove the offending xml so the parse exception does not
    occur.

  MFT-10559/IT30200 (CM)      - Jetty Http server uses incorrect certificate 
                                alias

    Customer added a new keycert with a new alias to replace their expired 
    keycert.  However, when they attempted to logon to GUI, they were presented 
    with the expired certficate.
    
    Resolution.  Updated the HTTP server side code to ensure that we honor the
    keycert alias listed in the  configureCmSsl.sh -s  utility.

  MFT-10564/IT30532 (Engine)  - Blacklist not displaying messages for SFTP 
                                protocol
                                
    When an SFTP user was found on the blacklist, the session was terminated, 
    but the reason was not logged.
    
    Resolution: Now put out a new log message so show that the blacklisted user
    session has been terminated:
       SSE2900 : UserId test3 is Blacklisted.Terminating session. /10.20.30.40:1234

  MFT-10578/PSIRT17288 (Engine,CM,PS) - Update JRE 1.8 to SR5 FP40 (8.0.5.40)
                                for security patches.

    Resolution: Update the JRE 1.8 to bring it up to the Oracle July 2019
    level to satisfy the CVEs in PSIRT advisory 17288.
    See http://www.ibm.com/support/docview.wss?uid=ibm11089580 for the
    Security Bulletin.

  MFT-10608/IT30643 (Engine)  - (SFTP) Added client ciphers as well as
                                negotiated ciphers in logging.

    After installing SSP3432 iFix 5, Customer lost visibility in the logs of the
    SFTP clients available ciphers and hmacs.  The Customer needed this debug
    info for a project to ensure their clients would be able to run with
    stronger ciphers.

    Resolution: Added DEBUG message SSE2656,  "Key Exchange Init Details :",
    which contains the remote's IP and port, along with the key exchanges, 
    ciphers, macs, etc that the client is capable of.  Another DEBUG message,
    SSE2640 "Negotiated Ciphers Details :" shows the ones chosen for the 
    session. Message SSE2729 provides the negotiated values at INFO level.

  SSP-3536/        (CM,Engine) - Log authentication failures for command line
                                 utilities in audit log

    This defect is the result of internal proactive Threat Model testing.

    Resolution: Now log authentication failures for the following command line
    utilities (*.bat or *.sh):
      CM: changePassphrase, configureAccepter, configureCmSsl listCmCerts,
      manageCSRs, manageKeyCerts, startCM, stopCM.bat
      Engine: changePassphrase, configureAccepter, configureEngineSsl,
      configureHsmPassword, listCerts, startEngine, stopEngine

  SSP-3537/         (CM)      - Require admin password to be set during new CM 
                                installation

    This defect is the result of internal proactive Threat Model testing.

    Resolution: On new installs (not upgrades) of the SSP Configuration Manager,
    request and confirm a valid password for the admin id.  This is to keep all
    installations of SSP from having the same default admin password.

  SSP-3539/         (CM)      - (RESTAPI) Require password when exporting and
                                importing sensitive configuration objects

    This defect is the result of internal proactive Threat Model testing.

    Resolution/ACTION: Now require a new X-Passphrase keyword for exporting or
    importing sensitive configuration objects: sspCMConfigs, Netmaps, Keystores,
    sysSslInfo, globals.  The exported configuration data will be encrypted with
    the supplied passphrase and cannot be imported without supplying the same.

  SSP-3599, SSP-3603/ (Engine) - Support for Web Session for HTTP SSO sessions

    The HTTP adapter creates a TCP session id for every connection from a
    client/browser.  But SSO sessions may involve multiple connections tied
    with an authenticated web sessionid. This becomes more crucial when adding 
    more features related to support for SAML external IdP.
    
    Resolution: This new feature is only applicable when 'Application 
    Authentication' is selected for the HTTP policy and SSO is selected for the 
    HTTP Proxy Adapter. Now create a unique web session id after authentication
    and supply it via a websessionid cookie. At logout or timeout, invalidate 
    the web session id and clear the websessionid cookie.

  SSP-3667/         (CM)      - Support for X-Forwarded* HTTP headers

    Currently SSP HTTP proxy adapter modifies the host header received from the
    client to match the host specified in the outbound node before sending it
    back to the backend HTTP Server.

    Resolution: Add the capability to forward the IP details of the incoming
    HTTP connection to Sterling Integrator. This defect is in response to
    Customer enhancement requests SSP-I-77 and SSP-I-80.
    If the HTTP Proxy adapter property "passthru.client.host.header" is
    specified and set to true, the host header from the client/browser will be
    passed as is to the backend Server.  Otherwise keep the current behavior.

  SSP-3763/       (Engine/CM) - Restrict permissions of the Unix bootstrap file

    Resolution: During a new install, set the permissions for the password 
    bootstrap file to 600 (owner RW only).

  MFT-10616/IT30591 (CM)      - REST API fails with "The processing instruction
                                target matching "[xX][mM][lL]" is not allowed"

    After upgrading the SSPCM to 3.4.3.2 iFix 5, the RESTAPI call for SSH key
    modification fails with "The processing instruction target matching 
    "[xX][mM][lL]" is not allowed. line # 1 column # 40".
    The input xml contained '<?xml version="1.0" encoding="UTF-8"?>' at the
    beginning, but that was not a problem in previous builds.
    
    Resolution: Now remove xml headers which during validation are being
    inserted after the root tag.

  MFT-10656/IT30692 (CM)      - SSPCM “Enable SSP CM startup backup” field in
                                CM System settings has no effect
                                
    Attempted to configure CM to not backup at startup by unchecking “Enable 
    SSP CM startup backup”  (From SSP Dashboard, System -> System Settings 
    -> CM System Settings -> Globals).  After saving the page and coming back,
    the field is checked again.
    
    Resolution: Now handle the negative case when the CM Backup checkbox is not
    selected.

  MFT-10692/IT30823 (CM)      - (FTP) EPSV command giving wrong response

    The original MFT-9148 fix to support FTP's Extended PASV (EPSV) and 
    Extended PORT (EPRT) RFC returned responses should be based on whether
    SSP detected IPv6 addresses. If SSP is on a machine in IPv6 mode, the 
    response for the EPSV command was the PASV response.

    Now return the response to the PASV or EPSV command based on the command 
    entered rather than on whether we detect that IPv6 addressing is in play.
    For PASV, the response continues to be,
      227 Entering Passive Mode (127,0,0,1,153,178).
    For EPSV, the response is
      229 Entering Extended Passive Mode (|||58792|).
      
  MFT-10704/IT31049 (Engine)  - Engine audit logs contain hashed passwords

    The SSP engineAuditEvent entry for a configuration push contained Base64
    hashed password values for the admin id and some keycerts.
    
    Resolution: Now replace the hashed password values in the audit logs with
    asterisks (****).

  MFT-10749/IT31534 (CM)      - NPE during RESTAPI session cleanup.
  
    RESTAPI sessions are maintained in a map and get cleaned up after a set
    amount of inactivity by the RestAPI_SessionCleanup thread. If any problem
    happens during cleanup, the map entry is not cleared and the thread 
    attempts to logoff the same session every minute, getting a 
    NullPointerException (NPE) on each attempt. 
    
    Resolution: Now ensure each portion of the RESTAPI session cleanup gets a
    chance to run so the map is cleared.

  MFT-10762/IT31135 (Engine)  - (CD) SSP incorrectly logs stepname of run task
                                and run job C:D process steps

    SSP was logging a hardcoded stepname "SameStep" during a Connect:Direct run
    task or run job process step.

    Resolution: Now log the actual stepname in the RUN JOB, RUN TASK and SUBMIT
    processes.

  MFT-10737/IT31341 (Engine)  - Unable to login to the CM after upgrade

    After upgrading SSP Linux to 6.0.0.1 the Customer would login to CM but
    immediately get “Unauthorized Access Attempted" messages. The Customer's
    load-balancing setup was generating different IP addresses for each
    connection to the SSP CM Dashboard and the Content Manager.

    Resolution: Turned off checking for matching IP addresses between the
    SSPCM Dashboard and Content Manager webapp sessions.

  MFT-10774/IT31439 (Engine)  - (CD) CSP032E 4 KQV keyword "RLS2" found in FM70,
                                 but not defined in XML schema definition
                                 
    SSP uses xsd files to validate the CD FMH's going through. As the various 
    CD groups develop new features, we periodically must add new keywords (KQV) 
    they may have created.
    
    Resolution: Add support for the following KQV values
      FMH70: RLS2
      FMH71: DEXP,DEXR,DSFF,DSFS,DMXF,SDVF,SMXG,SDVE,DDVF,DDSY,DMXG,DDVE
      FMH7402: ZECR,ZIFR,ZIFS,NODA,SDTP,DDTP,SDVE,DDVE,SISM,DISM,SMXG,DMXG

  MFT-10832/IT31500 (Engine)  - (HTTP) Duplicate Host Header attribute
  
    The SSP HTTP adapter was adding duplicate "HOST: serverIp:serverPort" to 
    the requests going to the backend.
    
    Resolution: Added logic to make sure that duplicate HOST headers were not 
    sent to the backend.  Internally fixed as SSP-3820.

  SEAS-1083/        (Engine)  - (HTTP) Password change on SSO portal clears all
                                policies on password policy display tab

    When a user changed their password through the SSO portal, an unexpected
    method was being called to clear the cookies.
    
    Resolution: Removed the inadvertant method from being called to clear the
    cookies.

  SSP-3540         (Engine)   - Do not log sessionids or sso tokens used for
                                authentication
                                
    Internal scans flagged that no sessionids or sso tokens used for
    authentication should be logged. 
    
    Resolution: Now map the sessionid and sso tokens to an internal value and 
    log that value.

  SSP-3543         (CM, Engine) - Generate keys at install time

    Internal ThreatModel scanning indicated that we should no longer install an
    SSP Factory Certificate to be used by all Customers.  The factory
    certificate was used to secure communication between the CM and engine(s).
    
    Resolution: On new installs of the CM or Engine, generate a self-signed 
    certificate or allow Customers to import their own keycert during the
    install process. If a self-signed cert is generated, it is also securely
    exported so that it can be imported into the other component(s).

  SSP-3612         (Engine,CM) - Make Security Headers active by default for
                                 the HTTP adapter

    Resolution: Now set the Strict-Transport-Security, X-XSS-Protection,
    X-Content-Type-Options, Content-Security-Policy and X-Frame-Options to be
    on by default while leaving the ability to change them or turn them off.

  SSP-3803         (Engine,CM) - Generate unique encryption key at install
                                 time

    Internal ThreatModel scanning indicated a change in the way we encrypt
    the system passphrase which is used to encrypt the configuration files.

    Resolution: On new installs of the CM or Engine, generate a unique hex
    key and store it in a file with read/write permissions for the userid of
    the installer only. This key is used to encrypt the passphrase the
    installer supplies which encrypts the configuration files.

  SSP-3834         (Engine,CM) - Support for ICAP Anti-Virus Scanning in SFTP

    Enhancement to support in-flight anti-virus scanning of small to medium
    size files being uploaded through the SFTP adapter. See online documentation
    for SSP6010 for more details. Requires McAfee Web Gateway ICAP server.
    Other internal stories SSP-3912, SSP-3913, SSP-4018, SSP-4061

  SSP-3854         (Engine,CM) - New disableBootstrap command-line utility 
  
    Follow on to SSP-3803, which only applied to new installs.  Created a
    disableBootstrap utility, which in conjunction with the existing
    enableBootstrap utility will change the system generated hex key used in
    bootstrap support.

  SSP-4120         (CM)         - Update Apache Commons BeanUtils to 1.9.4

    Internal BlackDuck scan recommended upgrade of Apache Commons BeanUtils.

    Resolution: Upgraded Apache Commons BeanUtils jars from 1.9.3 to 1.9.4

  MFT-10779         (CM)      - RESTAPI import errors with backupDir and
                                urlMapEntry

    Using the RESTAPI to import a configuration from a late SSP3432 or SSP6001
    instance. Getting errors on the following in the cms.log and the import
    fails:
      cvc-complex-type.2.4.d: Invalid content was found starting with element
        'urlMapEntry'. No child element is expected at this point. line # 3671
        column # 14
    Also getting the same error for the element "backupDir"

    Resolution: Added the recent keywords urlMapEntry and backupDir to the valid
    list in the xsd so that the RESTAPI will recognize them.

  SSP-4186          (Engine,CM) - System passphrase not getting validated
                                during upgrade when bootstrap is disabled
                                
    When bootstrapping is disabled, the upgrade must request the passphrase 
    during the install in order to decrypt the configuration files. The
    passphrase was not getting validated when entered.
    
    Resolution: Now validate the system passphrase requested during an upgrade
    when bootstrapping is disabled.

  SSP-4200          (Engine,CM) - Installer needs to confirm key passwords
  
    During a new SSP install of the CM or Engine, when generating a self-signed
    keycert, we prompt for a password for the private key, and also for
    encrypting the key when exporting it to the other component. However, we
    do not confirm the password, so if a Customer mis-types it and it's not 
    what they think it is, it's lost.

    Resolution: Now prompt and confirm the password for the private key
    generated during a new install and also the password for the exported copy
    of the key.

  SSP-4208          (Engine)  - HSM command line clients cannot connect to
                                engine
  
    After the upgrade to SSP6010, the HSM command line utilities manageKeyCerts
    and manageCsrs no longer connected to the SSP Engine/HSM because of changes 
    made to support xml-based keystores. These clients were not updated with 
    the correct logic for establishing a secure connection between CM and the 
    Engine.

    Resolution: Updated the underlying logic to load configured xml-based 
    keystores and truststores and dynamically convert them to java-based 
    JKS keystores for the duration of the utility.

  SSP-4220          (Engine,CM) - Installation issues with Docker containers
  
    Resolved several issues found during beta testing of Docker containers
    - Removed root user password changing logic from Docker file
    - Added sudo package to allowing sudo command to non-root user
    - Added logic for passing user, pwd, uid and gid into ENV variables, to be
      the owner of host mounted path for host configuration data. Defaults:
	APP_USER=appuser, APP_USER_PWD=appuser,
        APP_USER_UID=3000, APP_USER_GID=3000
      Note: Do NOT use User names root, spuser, cmuser, psuser or, seas or
      UID/GID: 0 and 1000 because these are already used inside the container.
    - Combined PROD and NON_PROD license variables into LICENSE_TYPE variable
    - Mapped silent installation log file with Volume host path to assist in
      checking the log without logging in
    - Please refer to the deployment YAML files bundled with the Fix Central
      tar file for the latest rather than the samples in the online doc.

    - Following are the parameters needed to start the various containers using
      Docker:

      ********** Deploying the new SSPCM Container: *********************
      docker run -it -d \
      -v <Host Mapped Path>/SPcm:/spinstall/IBM/SPcm \
      -e APP_USER=test \
      -e APP_USER_PWD=test \
      -e APP_USER_UID=1004 \
      -e APP_USER_GID=1005 \
      -e LICENSE_ACCEPTED=true \
      -e PORT=62366 \
      -e JETTY_PORT=8443 \
      -e PASSPHRASE=password \
      -e USER_PASSWORD=password \
      -e KEY_CERT_EXPORT=true \
      -e KEY_CERT_FILE_NAME=defkeyCert.txt \
      -e KEY_CERT_ALIAS=keycert \
      -e KEY_CERT_STORE_PASSPHRASE=password \
      -e KEY_CERT_ENCRYPT_PASSPHRASE=password \
      -p 8443:8443 \
      --name SPcm \
      sp-cm-docker-image:V6.0.1.0.iFix01 /bin/bash

      ************ Upgrade the SSPCM deployment *****************
      docker run -it -d \
      -v <Host Mapped Path>/SPcm:/spinstall/IBM/SPcm \
      -e APP_USER=test \
      -e APP_USER_PWD=test \
      -e APP_USER_UID=1004 \
      -e APP_USER_GID=1005 \
      -e LICENSE_ACCEPTED=true \
      -p 8443:8443 \
      --name SPcm \
      sp-cm-docker-image:V6.0.1.0.iFix01 /bin/bash


      ************* Deploying the new SSP Engine Container ***************
      docker run -it -d \
      -v <Host Mapped Path>/SP:/spinstall/IBM/SP \
      -v <Host Mapped Path>/defkeyCert.txt:/spinstall/defkeyCert.txt \
      -e APP_USER=test \
      -e APP_USER_PWD=test \
      -e APP_USER_UID=1001 \
      -e APP_USER_GID=1002 \
      -e LICENSE_ACCEPTED=true \
      -e LICENSE_TYPE=1 \
      -e PORT=63366 \
      -e PASSPHRASE=password \
      -e KEY_CERT_EXPORT=false \
      -e KEY_CERT_ALIAS=keycert \
      -e KEY_CERT_FILE_NAME=defkeyCert.txt \
      -e KEY_CERT_ENCRYPT_PASSPHRASE=password \
      -p 63366:63366 \
      -p 30820:30820 \
      --name SPEngine \
      sp-engine-docker-image:V6.0.1.0.iFix01 /bin/bash

      ************** Upgrade the SSP Engine deployment ****************
      docker run -it -d \
      -v <Host Mapped Path>/SP:/spinstall/IBM/SP \
      -e APP_USER=test \
      -e APP_USER_PWD=test \
      -e APP_USER_UID=1001 \
      -e APP_USER_GID=1002 \
      -e LICENSE_ACCEPTED=true \
      -e LICENSE_TYPE=1 \
      -p 63366:63366 \
      -p 30820:30820 \
      --name SPEngine \
      sp-engine-docker-image:V6.0.1.0.iFix01 /bin/bash


      ************ Deploying the new Less Secure PS Container **************
      docker run -it -d \
      -v <Host Mapped Path>/PSLessSecure:/spinstall/IBM/PServer \
      -e APP_USER=test \
      -e APP_USER_PWD=test \
      -e APP_USER_UID=1004 \
      -e APP_USER_GID=1005 \
      -e NETWORK_ZONE_SECURE=false \
      -e PS_PORT=30810 \
      -e PS_SECURE_IF=* \
      -e PS_EXTERNAL_IF=* \
      -p 30810:30810 \
      -p 20010-20020:20010-20020 \
      --name PSLessSecure \
      sp-ps-docker-image:V6.0.1.0.iFix01 /bin/bash

      ************* Upgrade the Less Secure PS deployment *****************
      docker run -it -d \
      -v /home/durgesh/base/PSLessSecure:/spinstall/IBM/PServer \
      -e APP_USER=test \
      -e APP_USER_PWD=test \
      -e APP_USER_UID=1004 \
      -e APP_USER_GID=1005 \
      -e NETWORK_ZONE_SECURE=false \
      -p 30810:30810 \
      -p 20010-20020:20010-20020 \
      --name PSLessSecure \
      sp-ps-docker-image:V6.0.1.0.iFix01 /bin/bash


      ************ Deploying the new More Secure PS Container **************
      docker run -it -d \
      -v /home/durgesh/base/PSMoreSecure:/spinstall/IBM/PServer \
      -e APP_USER=test \
      -e APP_USER_PWD=test \
      -e APP_USER_UID=1004 \
      -e APP_USER_GID=1005 \
      -e NETWORK_ZONE_SECURE=true \
      -e PS_PORT=0 \
      -e PS_SECURE_IF=* \
      -e PS_EXTERNAL_IF=* \
      -e REMOTE_PORT=30820 \
      -e REMOTE_ADDRESS=172.20.185.196 \
      --name PSMoreSecure \
      sp-ps-docker-image:V6.0.1.0.iFix01 /bin/bash

     ************* Upgrade the More Secure PS deployment *****************
      docker run -it -d \
      -v /home/durgesh/base/PSMoreSecure:/spinstall/IBM/PServer \
      -e APP_USER=test \
      -e APP_USER_PWD=test \
      -e APP_USER_UID=1004 \
      -e APP_USER_GID=1005 \
      -e NETWORK_ZONE_SECURE=true \
      --name PSMoreSecure \
      sp-ps-docker-image:V6.0.1.0.iFix01 /bin/bash

  MFT-10765/IT31672 (CM)      - 6.0.0.1F1 with Client Auth not working with SAN
                                certs, getting ERR_BAD_SSL_CLIENT_AUTH_CERT

    Customer has client authentication turned on for browser connectivity to
    the SSPCM dashboard, as well as client certificates configured with Subject
    Alternate Name. SSL handshakes from browsers were failing with  "No subject
    alternative names matching IP address xx.xx.xx.xx found" in the CM log.

    Resolution: Allow the Customer to override the new behavior in the JRE by
    uncommenting -DsspcmDisableClientEndpointIdentification=true in the
    startCM.sh script. This tells the CM to ignore the hostname discrepancy in
    the SAN cert.

  MFT-10779         (CM)      - RESTAPI import errors with backupDir and
                                urlMapEntry

    Using the RESTAPI to import a configuration from a late SSP3432 or SSP6001
    instance. Getting errors on the following in the cms.log and the import
    fails:
      cvc-complex-type.2.4.d: Invalid content was found starting with element
        'urlMapEntry'. No child element is expected at this point. line # 3671
        column # 14
    Also getting the same error for the element "backupDir"

    Resolution: Added the recent keywords urlMapEntry and backupDir to the valid
    list in the xsd so that the RESTAPI will recognize them.

  MFT-10853/IT31763 (CM)      - (GUI) SSPcm user binds to LDAP twice with SEAS
                                for single login

    When SSPCM users are configured to authenticate through SEAS, they are
    authenticating twice to LDAP, once for the dashboard, and again under the
    covers for the configuration manager.
    
    Resolution: When authenticating CM users through SEAS, request an SSO token
    on the first authentication from the dashboard, and then pass the token to
    SEAS on the authentication from the configuration manager, avoiding the
    second call to LDAP.

  MFT-10887/        (CM,Engine,PS,SEAS) - GPF in SSP engine

    The SSP Engine terminated with a General Protection Fault (GPF) when the
    JVM tried to get an internal structure from a terminated thread.

    Resolution: Installed the IBM JRE 8.0.6.5 to resolve the GPF.

  MFT-10889/IT32078 (CM)      - (GUI) CM session timeout still allows partial
                                access of the GUI function

    Often when a CM GUI session times out (ie, after 30 minutes of inactivity),
    the user is allowed to complete a save operation, though they get a message
    that they must login again.

    Resolution: Now implement an HttpSessionListener for the SSPDashboard and
    Content web apps, which ensure that the GUI timeout is enforced before a
    save operation is allowed.

  MFT-10898/        (CM,Engine,PS) - (Container) Can not create APP_USER in the
                                yaml file with GID of 1001

    When trying to use a group ID (GID) of ‘1001’ in the yaml file the messages
      groupmod: GID '1001' already exists
      ERROR: Cannot set GID for <userid>
    appear in the APPStartup.log in the backup directory on the VM.

    Resolution: Now allow 1001 to be used as a group ID in a container.

  MFT-10903/IT32096 (CM,Engine) - configureCmSsl and configureEngineSsl not
                                adding certificate chain to cmtrustore or
                                truststore

    When adding a keycert to the keystore using the configureCmSsl or
    configureEngineSsl utilities, they were not adding the certificate chain
    to the cmtrustore or truststore.

    Resolution: Now add or update the certificate chain from the keycert into
    the appropriate truststore.

  MFT-10904/        (CM,Engine,PS,SEAS) - GPF in SSP engine

    The SSP Engine terminated with a General Protection Fault (GPF) in the
    IBMPKCS11 area.

    Resolution: Installed the IBM JRE 8.0.6.5 to resolve the GPF.

  SSP-3771/         (CM)      - Updates to make CM logging more readable

    Resolution: Shortened some thread names within the CM to make the log lines
    narrower. Also merged some redundant lines in the debug log to lower the
    output.

  SSP-3793/         (CM)      - Missing secure attribute in encrypted session
                               (SSL) cookie
                               
    SSP CM does not append "http-only" and "secure" security attributes for 
    cookies that are sent back to the browser client.  
    
    Resolution: Now add "http-only" and "secure" attributes to JSESSIONID
    cookies.  Also known as PSIRT ADV0022033. See
    https://www.ibm.com/support/pages/node/6249281 for the Security Bulletin.

  SSP-4182/         (CM)      - ICAP configuration field validation issues

    In the ICAP configuration panel, the Service Name and File Type fields were
    allowing binary non-printable characters and not displaying an error.

    Resolution: Now reject the bad field values and prompt the user for good
    ones.

  SSP-4183/         (CM,Engine) - Files with temporary names not getting AV
                                scanned

    The ICAP AV Scanning feature for SFTP has a feature to scan only files with
    extensions specified in the ICAP Configuration. However, some clients (e.g.
    WinScp) append “filepart” as a temporary extension for large file uploads.
    Workaround: add "filepart" to the extensions list in the ICAP
    configuration. For example, if exe is an extension chosen, add exe.filepart
    along with exe in the ICAP configuration.

    Resolution: Added support for an adapter property
    “sftp.client.temp.ext.names=ext1,ext2,..,extn” in the ICAP Configuration.
    SSP will append these client specific extensions to each extension chosen
    for scanning when determining the extension match for ICAP AV scanning.

  SSP-4195/         (CM)      - RESTAPI ICAP field validation errors for empty 
                                maxSessions file extensions
                                
    RESTAPI import of ICAP configuration data allowed empty file extensions to 
    be added and an empty maxSessions field got an error message related to 
    numeric conversion rather than about the empty field.

    Resolution: Now do proper validations for empty file extensions and  
    maxSessions fields.

  SSP-4202/         (CM)      - SSPCM was allowing unsupported HTTP methods to
                                be processed

    The SSPCM was allowing unsupported HTTP methods, such as PUT ot BOGUS, to
    be processed.

    Resolution: Now return a 403 Forbidden when an unsupported HTTP method is
    encountered.

  SSP-4207/         (CM, Engine)  - New Engine install fails while importing 
                                keycert if engine port is in use
  
    During a new Engine install, the install fails while importing the keycert
    generated by the CM if the engine port is in use. The install log shows
      FATAL ERROR - class com.sterlingcommerce.csp.install.IA_ImportOrGenerateEngDfltCert
      FatalInstallException: Import Operation Failure
    even though there is nothing wrong with the certificate import.
  
    Resolution: Now check if a port number selected during an engine or CM
    install is already active at the time of selection and give the user a 
    chance to change it or ignore the alert.

  SSP-4223/         (Engine)  - Excessive logging on idle SFTP adapter

    During internal testing, found that the SFTP adapter could sometimes emit
    a couple of messages excessively in DEBUG mode, even when idle.
      SSE2621 sw is before setting interest ops
      SSE2621 sw is after setting interest ops

    Resolution: Changed the message number to SSE2998, which only gets emitted
    when the log level is DEBUG and the property log.debug.detail = 2 is set
    in the adapter properties tab.

  SSP-4236/PSIRT21787 (Engine,CM,PS) - Update JRE 1.8 to SR6 FP5 (8.0.6.5)
                                for security patches.

    Resolution: Update the JRE 1.8 to bring it up to the Oracle January 2020
    level to satisfy the CVEs in PSIRT advisories 20470 and 21787. See
    https://www.ibm.com/support/pages/node/6116926 and
    https://www.ibm.com/support/pages/node/6116962 for the Security Bulletins.
    Also tracked internally as SSP-4235.

  SSP-4244/         (Engine,CM,PS) - Cannot start docker container after 
                                stopping it

    After running "docker stop <container name/id>" on the Engine, CM or PS, it
    fails to start with a "docker start <container name/id>".  Logs show 
    message 'cannot create user "test"'
    
    Resolution: Corrected the user conflict causing the container not to start.

  MFT-10874/        (Engine)  - Engine listCerts.sh not working in 6010

    The Engine listCerts.sh command did not work in 6.0.1.0 GA, giving a message
    "No certificates match the specified criteria."   When SSP was converted to 
    store configured key certificates and public keys, this utility was not 
    modified to recognize the current formats for storing key certificates and 
    public keys. 
    
    Resolution:  Modified the ListCerts utility to recognize the current key 
    certificate and public key storage format.

  MFT-10959/IT32191 (CM)      - (GUI) Unable to update keystore with certain
                                PFX keys. PEM format works

    The SSP CM is unable to handle a PFX keycert format when there is a missing
    or unspecified label for either the private key or the associated public
    key.

    Resolution: Corrected SSP CM to be able to import PFX keycert format even
    when there is missing or unspecified label for the keycert or public key.

  MFT-10995/IT32374 (Engine)  - SFTP adapter hung in a stopping state

    2 pairs of synchronized methods in the SFTP failover code were causing a 
    deadlock condition. One failover thread was trying to start an outbound
    route while another was stopping a listener after a failed connection and a 
    deadlock occurred. The Engine had to be restared to clear the condition.

    Resolution: Replaced the method synchronization on 2 pairs of stop/start 
    methods with synchronization on a local object instead.

  MFT-11060/IT32769 (Engine)  - SFTP Getting SSE2654 Session limit exceeded on 
                                wrong adapter(s)
                                
    The first SFTP adapter to come up was getting any "SSE2654 Session limit of
    xx has been exceeded" irrespective of the source adapter of the event.
    
    Resolution: Corrected the way the loggers are assigned to adapters at 
    startup.

  MFT-11075/IT32687 (CM)      - Change to SFTP Policy in 6.0.1.0 greyed out the
                                Pass-Through option for Password and Key
  
    The SFTP Policy screen was changed in 6.0.1.0 to grey out the Pass-Through 
    option when "Password and Key" is specified. While it is not possible to do
    Pass-Through when specifying "Key" or "Password or Key", we are guaranteed
    to have a password to pass through to the back with "Password and Key".

    Resolution: Allow Pass-through (again) on the SFTP policy screen when 
    "Password and Key" is specified.

  MFT-11106/IT32810 (CM)      - Unable to delete default self signed certificate 
                                from SSPCM
  
    Customers trying to delete a previous keycert using the configureCmSsl tool
    could get "***Cannot delete certificate with alias "xxxx". The certificate
    is currently selected for use."  Using the configureCmSsl tool with the -s
    option did not show the certificate in use anywhere.
    
    Resolution: Incorporated portion of SSP-4335 fix which ensures that the 
    configureCmSsl.sh update commonCert operation updates all 4 locations for
    the client and server certificate for the SSLInfo and JettyConfig 
    defintions. Also provide more information about where the certs are in use 
    when trying to delete them.

  SSP-4215/         (CM)      - RESTAPI import error -  Invalid cipher suite
                                specified twofish256-cbc

    Some SFTP ciphers have been deprecated, and when trying to import from an
    older RESTAPI export, were causing the import to fail in the latest CM with
    "Invalid cipher suite specified twofish256-cbc".

    Resolution: Now allow the import to continue but remove deprecated SFTP
    ciphers with a warning message. If all ciphers are removed, substitute our
    default SFTP ciphers instead.

  SSP-4323/SEAS-1233 (Engine) - XML External Entity (XXE) vulnerability in SSP

    During internal security scanning, SSP was found to be vulnerable to an
    XML External Entity Injection (XXE) attack when processing XML data. It is
    further described in PSIRT advisory ADV0023731.

    Resolution: Added parser processing commands to disallow the illegal
    commands that caused the XXE attack.  Fixed in code as SEAS-1233. See
    https://www.ibm.com/support/pages/node/6249331 for the Security Bulletin.

  SSP-4346/         (Engine)  - SFTP ICAP AntiVirus scanning getting spurious
                                RuntimeException: no messages in ICAP cache

    When using the SFTP ICAP AntiVirus scanning, as the file is uploaded to the
    backend server, it generates the following spurious error at the end of the
    transfer which does not affect the file upload function.
      java.lang.RuntimeException: System error - no messages in ICAP cache
      
    Resolution: Removed an extra call to SSH_FXP_CLOSE which was causing the 
    nuisance error. 

  MFT-11151/IT32957 (Engine)  - SSP6010 upgrade fails on Windows
  
    When upgrading to SSP6010 on Windows, the install was failing with,
      "IBM Sterling Secure Proxy Engine services running. The installation 
      cannot proceed while the services are running."
    This happened on the engine or CM even though all SSP services were 
    stopped.
    
    Resolution: Corrected a test in the install process which was erroneously
    detecting that the SP-V6.0.1.0-engine or SP-V6.0.1.0-cm services were 
    running.

  MFT-11200/IT33098 (Engine)  - NPE in Maverick logs
  
    SFTP connections were failing intermittently, and the maverick.log contained
    many instances of 
      com.maverick.ssh.ExecutorOperationSupport - Caught exception in operation 
      remainingTasks=1 java.lang.NullPointerException: null
      
    Resolution: Corrected the NullPointerException in the SftpSubSys local_init
    method when a connection comes in.

  MFT-11042/        (Engine,PS) - Getting IOException: Too many open files
  
    SSP adapters were reporting "Too many open files" errors which used up all
    resources and blocked other partners from connecting to the Customer. They
    increased their kernel nofiles setting from 4096 to 8192, which helped to
    delay the outages.  The local SSP Perimeter Server code was intermittently
    not cleaning up sockets at session end, which allowed file descriptors to
    accumulate.

    Resolution: Updated the old PS4060602 Perimeter Server jar files to the
    PS6000302 level.  See SSP-3966 for description and important ACTION.

  SSP-3582/         (Engine)  - Blacklisted events are logged as ERROR messages

    When sessions from blacklisted IPs or using blackisted userids were rejected
    the messages were coming out in the logs as ERROR, which made it difficult
    to separate out other ERROR messages in the logs.

    Resolution: Now log the blacklisted messages as WARN instead of ERROR

  SSP-3701/         (Engine,CM) - Apply password policy for system passphrase
                                  and admin password for new installs

    Resolution: New installs of SSP will impose a password policy during the
    install process requiring the system passphrase and admin password to be
    6 to 28 characters in length with at least one upper case letter, one
    lower case, one digit, and one special character (“!@#$%^&”) with not more
    than 2 consecutive characters repeated.

  SSP-3966/         (Engine,PS) - Upgrade Perimeter Server code to same as
                                  B2Bi 6.0.3.2

    The SSP Perimeter Server code is obtained from the B2Bi team at Precisely/
    Syncsort.  It had not been refreshed in several releases, causing issues
    such as MFT-11042 above.

    Resolution: Updated the SSP local and remote Perimeter Server code to use
    the PS6000302 code level as is shipped with B2Bi 6.0.3.2.  This is an
    upgrade from the PS4060602 code we were shipping with. This defect also
    tracked internally as SSP-4233.

    ACTION: An Engine and any remote Perimeter Servers associated with its
    ACTION: adapters must be upgraded to the 6011 level at the same time to
    ACTION  keep their PS code in sync. Otherwise the adapters will fail to
    ACTION: start with "Unable to connect to remote perimeter server..."

  SSP-4016/         (CM)      - RESTAPI import does not update Jetty Server 
                                alias

    For a RESTAPI full CM export, the Jetty SSL configuration definition
    information was not being included. So a RESTAPI import was not updating
    the Jetty SSL configuration for the WebStart GUI.
    
    Resolution: Now export the Jetty config def information during a full 
    RESTAPI CM export, so it can be used during a subsequent import.

  SSP-4190/         (Engine) - Getting IllegalBlockSizeException after upgrade

    After replacing the common CM and Engine certificate and upgrading to 
    SSP6010, the engine would not start, with, "Startup did not succeed. 
      Terminating: java.io.IOException: javax.crypto.IllegalBlockSizeException:
      Input length (with padding) not multiple of 16 bytes"

    Resolution: Added a flag in the internal engine configuration file to
    indicate whether the keystore and truststore xml files are encrypted.

  SSP-4198/         (CM)     - configureCmSsl -s utility not showing all certs
  
    With SSP6010, the configureCmSsl -s utility di not show all the keycerts
    and certs in the keystore and truststore in  the defSslInfo.xml file.
    When the keystore type was switched from java-keystore (jks) to 
    an xml-based keystore, the display/show functionality stopped working.

    Resolution: Added logic to restore the display/show functionality in the 
    configureCmSsl script.

  SSP-4308/         (Engine,CM) - Add password policy for command line 
                                  changePassphrase utility

    Resolution: Now use the same password policy which was added in SSP-3701
    to the changePassphrase utility in the Engine and CM. New passwords will
    need to be 6 to 28 characters in length with at least one upper case 
    letter, one lower case, one digit, and one special character (“!@#$%^&”) 
    with not more than 2 consecutive characters repeated.

  SSP-4309/SSP-4322 (Engine,CM) - Support for ICAP Anti-Virus Scanning in C:D

    Enhancement to support in-flight anti-virus scanning of small to medium
    size files being uploaded through the C:D adapter. Since C:D is a forward
    or reverse proxy, it can also be used for pulling files into the secure 
    zone. See online documentation for SSP6011 for more details. Simlar to 
    SSP-3834 for SFTP, it requires the McAfee Web Gateway ICAP server.
    Other internal stories: SSP-4358, SSP-4374, SSP-4485.

  SSP-4310/SSP-4445 (Engine,CM,PS) - Update JRE 1.8 to SR6 FP10 (8.0.6.10)
                                for security patches.

    Resolution: Update the JRE 1.8 to bring it up to the Oracle April 2020
    level to satisfy the CVEs in security PSIRT advisories ADV0021791 and 
    ADV0023736.
    https://www.ibm.com/support/pages/node/6249355 and
    https://www.ibm.com/support/pages/node/6249371 for the Security Bulletins.

  SSP-4510/         (Engine,CM) - (SFTP) Allow reject option when ICAP session 
                                  limit is exceeded

    Resolution: Adding a second option in the ICAP GUI Advanced tab to reject a
    file upload or send the file as "unscanned" for the following situations:
    - IO error or connection error with ICAP Server (already done)
    - ICAP server Max session limit is exceeded (new)

  SSP-4590/         (Engine)  - Missing HTTP headers in response from MFG
  
    Internal OWASP testing showed that when logging in to MFG, the HTTP headers
    Cache-control and X-Content-Type-Options were not being returned.
    
    Resolution: Now supply the missing headers when front-ending the MFG
    application.

  MFT-11269/IT33625 (PS)      - PS silent install gving bad port error

    During a silent install, if the port value is incorrect, the install gets
    into an infinite loop resulting in a stackOverflow error.

    Resolution: Added custom Java code to handle the error condition and
    exit the install with a message to in install log

  SSP-3804/         (Engine, CM) - Passphrase validation in silent install

    During a silent install, there were no rules for validating and confirming
    the passphrases and passwords supplied.

    Resolution: On a new install in Silent Install mode, verify the length of
    the passphrase / password (6 to 28), and ensure it contains an upper case,
    lower case, digit, and a special character (!@#$%^&).

  SSP-4450/         (CM)      - Add checkboxes to Password Policy in SSP CM

    Resolution: Add checkboxes in SSPcm -> Advanced -> Password Policy to
    allow the administrator to turn off the requirement for Capital characters,
    Small charcaters, and/ or digits.

  SSP-4480/         (CM)      - RESTAPI add missing validations
  
    As changes have been made to the SSPCM GUI, some validations have not kept
    up in the RESTAPI.
    
    Resolution: Updated the RESTAPI policy validators for SFTP, FTP, CD, and 
    HTTP.

  SSP-4529/         (CM)      - Allow CM login page from root (/)
  
    Resolution: Now allow the CM login page to be accessible from root "/" as 
    well as the "/SSPDashboard" context path.

  SSP-4597/         (Engine,CM) - Install rejects password with $$
  
    A new install of SSP would not accept passwords with multiple dollar ($) 
    symbols, such as Pa$$w0rd or Pa$wor$d123.
    
    Resolution: Now correctly handle passwords with multiple dollar ($) 
    symbols.

  SSP-4620/         (Engine,CM) - Set TLSv1.2 protocol for CM, Engine and Web
                                  Server (Jetty)

    On a new install, the default protocol for communication between the CM
    and Engine and the Web GUI was IBM's SSL_TLSv2. This allowed connections to
    protocols SSLv3 (disallowed), TLS, TLSv1.1, or TLSv1.2.

    Resolution: To improve security, brand new installs will set the secure 
    protocol to TLSv1.2 across the board.

  MFT-11287/IT33627 (CM)      - Allow comma and apostrophe in CM key passwords

    SSP CM does not support comma and apostrophe character in key certificate
    passwords.
    
    Resolution: Now allow commas and apostrophes as valid characters for key 
    certificate passwords.

  MFT-11293/IT33828 (Engine)  - 229 response for FTP EPSV causes problems with
                                some partners

    Fix RTC556199 in SSP3430 enabled IPV6 in SSP,  but the responses to the FTP
    Extended PASV (EPSV) and Extended PORT (EPRT) commands were wrongly tied to
    whether the machine that SSP was running on was IPv6 enabled.  If it was
    not, it returned a 227 response for the EPSV instead of the correct 229
    response.  This behavior was corrected in the fix for MFT-10692.  However,
    some partners got used to the wrong behavior and depended on a 227 PASV
    response being returned for an EPSV command. When the Customer upgraded to 
    an iFix which contained MFT-10692, partner the scripts stopped working.

    Resolution: Added support for a new FTP adapter property, 
    "ftp.return.pasv.response.for.epsv", which if set to "true" causes that
    adapter to return the 227 PASV response to a EPSV command.  Also fixed a 
    problem where the 227 response on an IPv6 enabled machine displayed the 
    IP address in IPv6 format "0:0:0:0:0:0:0:1" instead of comma separated 
    IPv4 format "127,0,0,1" as the RFC requires.

  MFT-11130/IT33879 (Engine)  - Intermittent requests to SEAS timing out
  
    Occasionally, when several requests came in on the CD adapter at the same 
    time requesting SEAS certificate validation, the last request sent timed 
    out 3 minutes later when the socket was closed. The low level write of the 
    bytes to the SEAS socket was not doing a flush of the data to make sure 
    that it was properly presented to SEAS.

    Resolution: Now ensure that each SEAS request written on the socket has a 
    proper ending of the data so that it is immediately recognized by SEAS.

  MFT-11139/IT33786 (Engine)  - During load testing, SEAS shows ERROR "AUTH037E
                                Authentication request missing password."

    If SFTP adapter session limit exceed the max limit during load test, it
    was still trying to connect with SEAS resulting in missing password error
    in the Customer load test environment.

    Resolution: Moved session limit check earlier in sftp adapter so that it
    does not make an unnecessary connection to SEAS.

  SSP-4675/         (CM)      - NullPointerException adding trustedCert

    Getting a NullPointerException while adding a trusted certificate for the
    Jetty webserver using the cmConfigureSsl utiity.

    Resolution: Now use the proper method for adding trusted certificates for
    XML-based keystores.

  MFT-11273/IT33922 (Engine)  - JVM thread deadlocks in Maverick code;
                                OutOfMemory during large SFTP download

    The Customer's monitoring software noticed that there were several pairs of
    SFTP threads deadlocked on each other.  This deadlock was fixed in the
    Maverick 1.7.22 release, while we were running 1.7.20.
    A second issue with an OutOfMemory (OOM) exception was tracked with 
    MFT-11539 but no APAR was needed. A client was downloading a multi-GB file
    and requesting data packets faster than it was receiving them causing them
    to back up in memory.  Heap dumps showed memory accumulated in  
    java/util/LinkedList$Node and com/maverick/sshd/Channel$QueuedData.

    Resolution:  Upgraded the Maverick toolkits to the 1.7.32 level to correct
    the deadlock and windowing issues.

    ACTION: SFTP key sizes, both yours and your trading partners, MUST be 1024
    bits or higher. Ensure that key sizes are adequate before migrating to
    production.
    From the Maverick toolkit vendor: This release restricts the use of RSA
    keys in authentication to 1024 bits or higher. If you attempt to
    authenticate with a key with < 1024 bits, the API will automatically reject
    the authentication request.
    The API also restricts key generation of RSA and DSA keys to 1024 bits or
    higher. These changes match the key size restrictions used by OpenSSH.
    Please note that the recommended size of an RSA key should be at least 2048
    bits, preferably 3072 bits, which is now the OpenSSH default for RSA keys.

  SSP-3583/         (CM)      - unauthorized.jsp does not display IBM in header
                                title
                                
    When the unauthorized.jsp page was displayed, it said Secure Proxy, not
    IBM Secure Proxy as it should.
    
    Resolution: Updated the unauthorized.jsp page to display IBM Secure Proxy.

  SSP-4670/         (CM)      - RESTAPI services do not report exception
                                stacktrace in CM log file

    SSP CM Rest API services are not logging exception stacktraces thereby
    making problem resolution more time consuming.

    Resolution: Added logic to extract the full exception stacktrace when an
    error occurs and write it into the SSP CM log files

  SSP-4138/         (CM)      - manageKeyCerts cannot copy non-HSM keycert

    The manageKeyCerts utility was getting a Nullpointer exception when
    trying to copy a non-hsm certificate.

    Resolution: Now correctly copy all types of keycerts.

  SSP-4662/         (CM)      - RESTAPI missing validations of Password Policy

    The RESTAPI was not properly validating new tags in the password policy
    definition.
    
    Resolution: Now correctly validate the following tags during RESTAPI import
    when presented, but do not require them from older exports: <daysValid>,
    <mustContainOneCapitalCharacters>, <mustContainOneDigit>, 
    <mustContainOneSmallCharacters>, <keptInHistory> and <getMaxLength>.

  SSP-4668/         (CM)      - RESTAPI allows empty eaAuthProfile and 
                                eaCertProfile tags to be imported

    During a RESTAPI import, the CM does not throw any exception if 
    <eaCertProfile>, <eaAuthProfile> or <eaKeyAuthProfile> is an empty value.

    Resolution: Now fail the import if the <eaCertProfile>, <eaAuthProfile> or 
    <eaKeyAuthProfile> is present but contains an empty value.

  MFT-11423/IT34330 (Engine)  - MyFG 2.0 (B2Bi 6.1) REST API Authentication
                                fails when it goes through SSP

    MFG 2.0 uses HTTP Authorization header with scheme of "bearer". SSP only
    supported "basic". SSP rejected the header and did not pass it to the back
    end MFG 2.0, which caused it to fail.

    Resolution: Now support the "bearer" Http Authorization header and pass it
    to the back end server. Also tracked internally as SSP-4702.

  SSP-4640/         (CM,Engine) - Vulnerability in Apache Commons Codec 

    HIPER: Updated the Apache Commons Codec toolkit to v1.15 to address
    PSIRT advisory ADV0025470 - CVEID: 177835 (CVSS: 7.5). See
    https://www.ibm.com/support/pages/node/6339801 for security bulletin.

  MFT-11388/IT34365 (Engine)  - (FTPs) loopback transfers failing 75% of time

    FTPS sessions (data connections) were failing when large number (~800) of
    trusted certificates are involved in the handshake with client. The SSL
    handshake for the data channel was being delayed, causing intermittent
    failures.

    Resolution: Corrected a problem interacting with the local perimster server
    code when setting up the handshake with the client on the data channel in
    passive mode.

  MFT-11411/IT34415 (CM)      - RESTAPI Validation of Peer address range (IP 
                                Subnet range) in Netmap Inbound Nodes
                                
    There was no support in the RESTAPI for validating the CIDR (IP subnet) 
    peer address ranges on inbound SFTP, FTP and HTTP nodes. 
    Examples: 10.20.30.40/32,  10.20.30.0/24, etc.

    Resolution: Now validate the inbound netmap node peer address patterns
    durig RESTAPI imports for proper specification of the CIDR patterns,
    namely, the value of significant bits to mask for IP address checking (the
    number after the /) must be between 0 and 32. Also, the address pattern
    must specify zeroes for the trailing bits in the pattern which are to be
    "wildcarded". Example 10.20.30.40/24 - wrong, 10.20.30.0/24 - correct.

  MFT-11429/        (Engine)  - SSP adapters listening even after outbound node
                                becomes unreachable
                                
   With the adapter properties failover.detection.enabled=true and 
   failover.detection.mode=continuous, the adapter was not taking the inbound
   listener down when it detected that there was a problem connecting to the
   back end SI adapter.  This caused the load balancer to continue to send 
   sessions to the SSP adapter even though it was not working.
   
   Resolution: Now correctly monitor the "stopListenCalled" flag so that when
   the outound adapter is inaccessible, the SSP adapter will stop listening.

  MFT-11451/IT34408 (CM)      - RESTAPI addNodes failed with "Content is not 
                                allowed in prolog" through sspRestAPI utility

    When calling the API through the sspRestAPI utility, SSP was not parsing
    the input xml correctly. It was working fine for HTTTP based REST clients,
    such as Postman, etc.

    Resolution: Now parse the xml correctly no matter the source.

  MFT-11423/IT34330 (Engine)  - (HTTP) Empty cookie header sent to PEM

    After upgrading to Jetty 9.4.x, the cookie header going back to PEM was
    sometimes empty or blank.

    Resolution: Now validate the cookie header to make sure it is not empty
    or blank before forwarding it via SSP.

  MFT-11428/IT34518 (CM,Engine) - CM performance problems editing large netmaps

    Customer with large netmaps (thousands of nodes with unique IP addresses)
    found that editing and saving the netmap could take minutes and result in
    a timeout.  SSP was writing an audit log record of the change with a 
    "before" and "after" copy of the netmap configuration xml, each copy of
    which could be several MB.  The string functions to sanitize the audit 
    records to mask passwords, etc, were not streamlined for performance.

    Resolution: Updated the string functions used to sanitize the configuration
    audit records to make CM edit/save operations perform better. Also
    for SFTP, now show the Netmap and Node that an inbound session matched.

  MFT-11511/IT34629 (CM,Engine) - Performance problems editing large netmaps

    This is a follow on to MFT-11428 to resolve performance problems related
    to editing and saving large netmaps through the SSPCM GUI. The process of
    logging configuration changes to the audit log was doing inefficient 
    processing when trying to mask password data being written.

    Resolution: Improved the method of masking sensitive information when 
    logging configuration changes for netmap nodes. Limit the inbound node
    checking to CD and PeSIT netmaps, as other protocols do not have sensitive
    information.

  SSP-4206/         (Engine)  - Logs show "SSP0040I Support for IBMPKCS11Impl
                                HSM is enabled" though HSM is not enabled

    Resolution: Skip sending the message when HSM is not enabled.

  SSP-4232/         (Engine)  - Wrong certificate store displayed for Engine

    After installation, a ConfigureEngineSsl -s utility was showing the key
    store name as dfltCMKeyStore and the trust store name as dfltCMTrustStore.
    
    Resolution: Corrected the installer to set the names as dfltEngineKeyStore 
    and dfltEngineTrustStore, respectively. 

  MFT-11238/IT34624 (Engine)  - (SFTP) Negative message length SshException for
                                DATA packet from non-standard server

    Customer using a non-standard server on the back end and trying to pull a
    file.  The SSP local TCP window size was small which caused the server to
    split a data packet incorrectly. SSP detected it as a negative message
    length.

    Resolution: Now set the initial TCP local window size for the back end SFTP
    session to 4MB to ensure that the server does not need to split data
    packets.  The value can be overridden with the following new SFTP adapter
    properties (See also SSP-4799):
      sftp.backend.max.packet.size = 4194304 (4M initial backend window size)
      sftp.backend.max.window.size = 4194304 (4M max backend packet size)

  MFT-11309/IT34732 (Engine)  - (SFTP) SSE2640 sshd channel closing when local
                                window size goes below 32k

    A trading partner was uploading a several hundred MB file using the
    Globalscape ETF SFTP client and randomly getting an abrupt channel close
    which terminated the connection.  When the local TCP window size went
    below 32k on SSP and the client sent a 32k data packet, SSP shut down the
    connection.

    Resolution: Now set the minimum and maximum local window size for the SFTP
    adapter and allow them to be configured in the adapter property tab (See
    also SSP-4799):
      sftp.inbound.max.window.size = 2097152 (2M maximum inbound window size)
      sftp.inbound.min.window.size = 131072  (128k minimum inbound window size)

  MFT-11517/IT34628 (CM)      - RESTAPI validation of CD netmap node ip addr

    Various problems in RESTAPI validation of CD nodes allowed netmaps to be
    imported which could not be saved in the CMU GUI and/or could not be pushed
    to the engine.
    1) Accepting "0" or unspecified for CD Netmap "port number" in the location
       corresponding to GUI [CD Netmap > Edit a Node > Advanced tab > Port num]
    2) Accepting "/32" for "Connect direct server address" correspoding to
       GUI [CD Netmap > Edit a Node > Basic Tab > Server address] 

    Resolution: Now validate the address and port values during a RESTAPI
    import of CD netmaps.  Fail the import with meaningful error messages to
    help isolate any import problems.

  MFT-11536/IT34761 (Engine)  - "testSSPCookie" fails Customer's Security scan

    The test cookie used by the SSP login page javascript for detecting if
    the browser allows cookies was being flagged by the Customer's security
    scans because it does not have the security attributes HttpOnly and Secure.
    Adding the HttpOnly attribute would not work, as it would prevent the
    javascipt from accessing the cookie.

    Resolution: Removed the use of the testSSPCookie and used a javascript
    variable (navigator.cookieEnabled ) designed for this purpose.

    ACTION: If your site has customized the login.js scripts, you must re-apply
    your customizations after the upgrade in  <Signon dir>/resources/login.js
    and <Signon dir>/extportal/resources/login.js.

  MFT-11557/IT34792 (CM)      - RESTAPI SFTP Netmap import allows unreferenced 
                                remoteClientKeyStore
                                
    The RESTAPI import of an SFTP netmap outbound node was allowing a 
    <remoteClientKeyStore> tag to be imported with the name of a non-existent 
    Local User Keystore. The resulting configuration could not be pushed to the 
    engine, resulting in a message:
      "CONF003E Exception processing configurator request. Name <engine>,
      Request: sspConfigPush, Exception: ConfigDefMissingException: Referenced
      definition not found in registry: string (dataType=KeyStoreDef)"

    Resolution: Updated the RESTAPI validation of an SFTP netmap to ensure
    that if a remoteClientKeyStore is referenced, it actually exists.

  SSP-4799/        (Engine,CM) - Allow configurable window and packet size
                                 limits for SFTP.

    Resolution: This internal defect was done to add support for the SFTP
    adapter properties needed by MFT-11238 and MFT-11309:
      sftp.inbound.max.window.size = 2097152 (2M maximum inbound window size)
      sftp.inbound.min.window.size = 131072  (128k minimum inbound window size)
      sftp.backend.max.packet.size = 4194304 (4M initial backend window size)
      sftp.backend.max.window.size = 4194304 (4M max backend packet size)

  MFT-11512/IT34993 (Engine)  - (HSM) HTTPs fails with HSM enabled

    SSP was seeding the SecureRandom function when the safeNet/LUNA Hardware
    Security Module (HSM) was enabled, which the HSM rejected. This caused an
    exception that prevented the TLS Handshake from completing.

    Resolution: Now turn off seeding SecureRandom when IBMPKCS11 is the
    provider for generating pseudo random numbers.

  MFT-11517/IT34628 (CM)      - RESTAPI validation of CD netmap node ip addr

    Problem 1) Unable to add an IP in "IP Checks section" (CD Netmap >
    Edit a Node > IP checks.
    2) RESTAPI still allows a "/32" subnet range for Alternative Destinations.

    Resolution: Cleaned up these stray problems.

  MFT-11519/IT34997 (Engine)  - SSP OutOfMemory (OOM) with 80% in
                                com.sterlingcommerce.cspssh.parameters.Parms

    SSP failed with an OutOfMemory. The heapdump analyzer showed that the top
    3 main leak suspects were com.sterlingcommerce.cspssh.parameters.Parms
    adding up to about 80% of the available memory. The <sessionId>.policy
    value was not being removed from Parms map for false authentication cases
    and gradually filled it and caused the OOM condition. Also when a user
    could not connect to the backend, the channel id was not getting removed
    from the map.

    Resolution: Now handle the false authentication case and remove the
    <sessionId>.policy entry from the Parms map. Also ensure the channel id is
    removed from the map for backed registration failure scenarios.

  MFT-11578/IT34989 (CM)      - SSPCM adding to user store fails with password 
                                policy selected after upgrade

    After upgrading from a previous build of SSP, and trying to add a user to
    the user store with the password policy in place, the CM would get a System
    Error popup and force the user to exit. There was a NullPointerException in
    com.sterlingcommerce.csp.gui.web.utils.SSPFieldValidator.validatePassword()
    because the validation code was missing a check for null when looking for a
    capital letter.  Workaround is to turn off the password policy when adding
    the user.
    
    Resolution: Now when the system is upgraded and some password policy fields
    are uninitialized, check for null before using them. This was fixed 
    internally as SSP-4795.

  SSP-4866/         (CM)      - Password policy fields not initialized properly
                                after upgrade from SSP3432
                                
    When upgrading from SSP3432, the new password policy fields for requiring 
    upper case, lower case, and digits were checked.
    
    Resolution: Now when upgrading, set these new fields to false (unchecked) 
    by default.

  SSP-4926/         (CM)      - ICAP RESTAPI not validating properties

    The RESTAPI was not validating ICAP properties for numeric/alpha fields.
    
    Resolution: Added validations for the ICAP properties in the RESTAPI.

  SSP-2963/         (CM)      - Remove option to update the security under
                                the CMSystemSettings

    Customers who used the CM GUI System -> CMSystemSettings -> Security tab to
    change their TLS protocol information found that they could no longer use
    the GUI once it restarted, since the web configuration also needed to be 
    changed.

    Resolution: Changed the security tab under CMSystemSettings to be view 
    only, with a note that to change settings, they must run the configureCmSsl 
    tool.

  SSP-3548/         (CM)      - Allow configuration of the maximum header
                                length and content size for the SSPCM.
                                
    The SSPCM could get overrun with data if a large HTTP header or page 
    content is received.
    
    Resolution: Now set a default header size (8192) and content size (200,000) 
    to protect the CM from an overrun. These are configurable in the Globals 
    tab of the System -> System Settings tab.

  SSP-4518/         (Engine)  - ICAP Logging improvements

    Some log messages in ICAP processing were in DEBUG mode when they should
    have been logged in INFO or ERROR mode.

    Resolution:  Added the following INFO and ERROR messages to the ICAP flow:
      CSP085I  No malware reported during ICAP AV scanning of file - {0}
      CSP086E  Secure Proxy Internal Error occured during ICAP AV Scanning of
               file - {0}
      CSP087E  Copy terminated for file ({0}) due to internal error with ICAP
               Server
      CSP088E  File ({0}) will be transferred without Anti Virus scan, due to
               internal error with ICAP Server
      CSP089E  ICAP AV Scanning failed, malware detected file: {0}, ICAP
               response : {1}, Virus name: {2}, Reputation: {3},
               Geo Location: {4}
      CSP090I  Data Compression (Standard/Extended) is enabled, File ICAP AV
               Scanning skipped, file - {0}
      CSP091I  File extension not in selected list, ICAP AV Scanning skipped
               for file - {0}
      CSP092I  FASP is enabled at PNODE & SNODE, ICAP AV Scanning skipped for
               file - {0}

  SSP-4606/         (Engine)  -  Audit log messages for CD ICAP support 

    Resolution: Added audit log messages for the new CD ICAP functionality
      AUD3004E=Copy terminated for file ({0}) due to internal error with ICAP
               Server
      AUD3005E=File ({0}) will be transferred without Anti Virus scan, due to
               internal error with ICAP Server
      AUD3006I=No malware reported during ICAP AV scanning of file - {0}
      AUD3007E=ICAP AV Scanning failed, malware detected file: {0}, ICAP
               response : {1}, Virus name: {2}, Reputation: {3},
               Geo Location: {4}
      AUD3008I=Data Compression (Standard/Extended) is enabled, File ICAP AV
               Scanning skipped, file - {0}
      AUD3009I=File extension not in selected list, ICAP AV Scanning skipped
               for file - {0}
      AUD3010I=FASP is enabled at PNODE & SNODE, ICAP AV Scanning skipped for
               file - {0}

  SSP-4614/SSP-4699 (CM,Engine) - Fix resource leak issues reported by internal
                                code scan

    Resolution: Corrected various coding issues detected by our internal code
    scan tool. Removed dead code, avoid NullPointerExceptions, use IOException
    instead of Exception when closing resources.

  SSP-4666/         (CM,Engine) - Log stacktraces when startup fails

    The SSP startup process does not log encountered exceptions properly to
    enable prompt resolution of Customers' startup failures.

    Resolution: Now ensure that fatal exceptions log their stacktrace into
    the SSP log file.

  SSP-4694/4697/4698 (CM,Engine) - Support for SOCKS5 Proxy for outbound CD
                                connections

    Enhancement: Engine, CM GUI and RESTAPI changes for SOCKS5 Proxy support 
    for outbound CD connections. Also worked as defects SSP-4697 and SSP-4698.

  SSP-4736/         (CM)      - Upgrade Jackson jars to latest

    Resolution: Updated the Jackson jars to the latest (1.9.14) to facilitate
    parsing JSON requests.

  SSP-4742/         (CM,Engine) - Data Collector for non-Windows CM & engine
                                leaves LongDirectoryOutput.txt empty

    The runCMDataCollector and runEngineDataCollector scripts in the bin
    directory dump out a number of text files with information about the
    environment for passing to Support. The longDirectoryOutput.txt file, a
    recursive dir listing of the installation directory, works on Windows, but
    is empty on non-Windows.

    Resolution: Corrected the utilities to correctly output the recursive
    listing of the installation directory for diagnostic purposes.

  SSP-4801/         (CM)      - Upgrade IBM MQ Client to latest

    Resolution: Updated the IBM MQ Client jars to the latest (9.2.0.1).

  SSP-4925/         (Engine)  - Remove license type prompt from Engine install

    Resolution: Remove the prompt for the license type (Production or
    non-Production) from a new SSP Engine install.

  SSP-2963/         (CM)      - Remove option to update the security under
                                the CMSystemSettings

    Customers who used the CM GUI System -> CMSystemSettings -> Security tab to
    change their TLS protocol information found that they could no longer use
    the GUI once it restarted, since the web configuration also needed to be 
    changed.

    Resolution: Changed the security tab under CMSystemSettings to be view 
    only, with a note that to change settings, they must run the configureCmSsl 
    tool.

  SSP-3548/         (CM)      - Allow configuration of the maximum header
                                length and content size for the SSPCM.
                                
    The SSPCM could get overrun with data if a large HTTP header or page 
    content is received.
    
    Resolution: Now set a default header size (8192) and content size (200,000) 
    to protect the CM from an overrun. These are configurable in the Globals 
    tab of the System -> System Settings tab.

  SSP-4518/         (Engine)  - ICAP Logging improvements

    Some log messages in ICAP processing were in DEBUG mode when they should
    have been logged in INFO or ERROR mode.

    Resolution:  Added the following INFO and ERROR messages to the ICAP flow:
      CSP085I  No malware reported during ICAP AV scanning of file - {0}
      CSP086E  Secure Proxy Internal Error occured during ICAP AV Scanning of
               file - {0}
      CSP087E  Copy terminated for file ({0}) due to internal error with ICAP
               Server
      CSP088E  File ({0}) will be transferred without Anti Virus scan, due to
               internal error with ICAP Server
      CSP089E  ICAP AV Scanning failed, malware detected file: {0}, ICAP
               response : {1}, Virus name: {2}, Reputation: {3},
               Geo Location: {4}
      CSP090I  Data Compression (Standard/Extended) is enabled, File ICAP AV
               Scanning skipped, file - {0}
      CSP091I  File extension not in selected list, ICAP AV Scanning skipped
               for file - {0}
      CSP092I  FASP is enabled at PNODE & SNODE, ICAP AV Scanning skipped for
               file - {0}

  SSP-4606/         (Engine)  -  Audit log messages for CD ICAP support 

    Resolution: Added audit log messages for the new CD ICAP functionality
      AUD3004E=Copy terminated for file ({0}) due to internal error with ICAP
               Server
      AUD3005E=File ({0}) will be transferred without Anti Virus scan, due to
               internal error with ICAP Server
      AUD3006I=No malware reported during ICAP AV scanning of file - {0}
      AUD3007E=ICAP AV Scanning failed, malware detected file: {0}, ICAP
               response : {1}, Virus name: {2}, Reputation: {3},
               Geo Location: {4}
      AUD3008I=Data Compression (Standard/Extended) is enabled, File ICAP AV
               Scanning skipped, file - {0}
      AUD3009I=File extension not in selected list, ICAP AV Scanning skipped
               for file - {0}
      AUD3010I=FASP is enabled at PNODE & SNODE, ICAP AV Scanning skipped for
               file - {0}

  SSP-4614/SSP-4699 (CM,Engine) - Fix resource leak issues reported by internal
                                code scan

    Resolution: Corrected various coding issues detected by our internal code
    scan tool. Removed dead code, avoid NullPointerExceptions, use IOException
    instead of Exception when closing resources.

  SSP-4666/         (CM,Engine) - Log stacktraces when startup fails

    The SSP startup process does not log encountered exceptions properly to
    enable prompt resolution of Customers' startup failures.

    Resolution: Now ensure that fatal exceptions log their stacktrace into
    the SSP log file.

  SSP-4694/4697/4698 (CM,Engine) - Support for SOCKS5 Proxy for outbound CD
                                connections

    Enhancement: Engine, CM GUI and RESTAPI changes for SOCKS5 Proxy support 
    for outbound CD connections. Also worked as defects SSP-4697 and SSP-4698.

  SSP-4736/         (CM)      - Upgrade Jackson jars to latest

    Resolution: Updated the Jackson jars to the latest (1.9.14) to facilitate
    parsing JSON requests.

  SSP-4742/         (CM,Engine) - Data Collector for non-Windows CM & engine
                                leaves LongDirectoryOutput.txt empty

    The runCMDataCollector and runEngineDataCollector scripts in the bin
    directory dump out a number of text files with information about the
    environment for passing to Support. The longDirectoryOutput.txt file, a
    recursive dir listing of the installation directory, works on Windows, but
    is empty on non-Windows.

    Resolution: Corrected the utilities to correctly output the recursive
    listing of the installation directory for diagnostic purposes.

  SSP-4706/ADV0026225 - Upgrade IBM JRE to 8.0.6.15 level for security patches

    Resolution: Update the IBM JRE to satisfy the CVEs in the Oracle July 2020 
    CPU, PSIRT advisory 26225.
    See https://www.ibm.com/support/pages/node/6398774 for the Security
    Bulletin.

  SSP-4710/ADV0027000 (Engine) - Upgrade Apache ActiveMQ to 5.16 for security
                                patches

    Resolution: Updated the Apache ActiveMQ libraries to v5.16.0 to mitigate
    CVE-2020-13920, a man-in-the-middle attack. This is PSIRT advisory 27000.
    See https://www.ibm.com/support/pages/node/6398750 for the Security
    Bulletin.

  SSP-4801/         (CM)      - Upgrade IBM MQ Client to latest

    Resolution: Updated the IBM MQ Client jars to the latest (9.2.0.1).

  SSP-4812/ADV0028030 (Engine,CM) - Update Jetty toolkit to 9.4.34 for security
                                patches

    Resolution: Updated the Eclipse Jetty toolkit to 9.4.34 to mitigate
    CVE-2020-27216, dealing with elevated privileges. This is PSIRT advisory
    28030.
    See https://www.ibm.com/support/pages/node/6398772 for the Security
    Bulletin.

  SSP-4925/         (Engine)  - Remove license type prompt from Engine install

    Resolution: Remove the prompt for the license type (Production or
    non-Production) from a new SSP Engine install.

  MFT-11467/IT34992 (Engine)  - Problem with HTML rewrite - connection close

    When 'HTML Rewrite' is selected in SSP, if the backend HTTP Server sends a 
    response with a 'Connection: close' header and does not include content 
    length or chunked transfer encoding headers, the browser does not get the 
    full response body.

    Resolution: Made changes to correctly handle the Connection: close header.

  MFT-11666/IT35478 (Engine)  - SFTP adapters go offline when too many sessions
                                per user on SFG

    Customer had failover enabled for the SFTP adapter and the B2Bi max sessions
    per user set. When the user session count exceeded the limit on B2Bi, it
    threw an exception back to SSP, which called failover to take the listener
    down. When the failover code detected that the B2Bi adapter was not down, it
    brought the listener back up, resulting in a yo-yo effect on the listener.

    Resolution: Now check if the session startup exception from B2Bi is due to
    "too many connections for user" and don't take listener down.

  MFT-11669/        (Engine)  - Protect login form from CSRF

    Resolution: Set a CSRF token in a hidden field in the login and 
    changePassword pages and when the user logs in, validate the token from
    the form. This fix also known internally as SSP-4591.
    ACTION - If your site has rebranded the HTTP Signon/login.html, 
      changepw.html, or login.js script, you must re-apply your customizations 
      after the upgrade.

  MFT-11683/IT35628 (Engine)  - SFTP disconnects when >500 files in a mailbox

    SFTP sessions were failing when connecting to an SFG mailbox with 500 files
    in it. MFT-11238 introduced a 4M default value for the SFTP adapter property
    sftp.backend.max.packet.size which sets the sessionMaxPacketSize in the
    Maverick toolkit for the backend session to B2B1. The large packet size
    caused the Maverick toolkit on B2Bi to throw an exception when trying to
    return a directory listing for an SFG mailbox with over 500 files.

    Resolution: Make the default of the sftp.backend.max.packet.size adapter
    property to 34000 (33.2 KB) and enforce a maximum value of 56320 (55 KB).

  MFT-11742/IT35559 (CM)      - Jetty failure at CM startup after upgrade
                                to iFix 03

    Customers installing the new SSPCM or SEAS for iFix 03 could not bring up
    the SSPCM or SEAS. The error message was
      KeyStores with multiple certificates are not supported on the base class
      org.eclipse.jetty.util.ssl.SslContextFactory. (Use
      org.eclipse.jetty.util.ssl.SslContextFactory$Server or
      org.eclipse.jetty.util.ssl.SslContextFactory$Client instead)
    The new Jetty for PSIRT ADV0028030 introduced a requirement of having only
    one CA-signed keycert in the keystore unless using a server
    form of the SslContextFactory class. The problem could also occur with one
    Subject Alternative Name (SAN) keycert which has multiple hosts.

    Resolution: Updated our Jetty instance to use the SslContextFactory$Server
    class as required when SAN certificates or multiple signed certificates are
    present in the keystore.

  SSP-4873/         (CM,Engine) - Support SFTP adapter property to set front
                                end rekey count

    Resolution: Support a new SFTP adapter property, sftp.rekeycount, with a
    default value of 60000 which sets the number of packets to receive on the
    front end before requesting an SSH rekey.

  SSP-4908/         (Engine)  - PS for SSP on Windows shows 
                                SSP.INSTALLED.VERSION=6.0.3.2

    The SSP Perimeter Server on Windows was using SSP.INSTALLED.VERSION=6.0.3.2
    in the property file instead of the correct SSP version, iFix number and
    build.  The value is for reference only to show which SSP build the PS 
    install was done from.  The "6.0.3.2" is the version of the B2Bi that the
    PS code was built from. UNIX/Linux versions display the values correctly.
    
    Resolution: Updated the InstallAnywhere deck for the Windows install to 
    correctly supply the SSP version, iFix and build number.

  SSP-4950/         (CM)      - SSPCM adding duplicate cookies

    The SSPCM was adding duplicate cookies in the HTTP response header to the
    browser, causing Jetty to fumble the real sessionid when the browser sent 
    subsequent requests to the CM.
    
    Resolution: Removed the logic enabling the duplicate set-cookie command on
    the http response to the browser. Also added logic to enable the Cookie 
    Domain on the set-cookie HTTP header line.

  MFT-11770/        (Engine)  - Set HttpOnly, Secure for SspWebSessionId cookie

    The HttpOnly and Secure attributes were being sent when the SspWebSessionId
    cookie was being sent for the first time but not on a resend.

    Resolution: Turned off the unnecessary resend of the cookie at the place 
    where the attributes were not being sent. Also, added the missing domain 
    attribute for this cookie.

  MFT-11830/IT36115 (Engine)  - SFTP transfers stall with Maverick 1.7.32
  
    After putting on SSP6011 iFix 1 Build 188 or higher, several Customers 
    experienced SFTP transfers hanging, stalling, or failing on uploads or
    downloads.  That build introduced a newer Maverick toolkit which caused
    the instability.  This issue also tracked internally with MFT-11982.
    
    Resolution: Through much testing with small, medium and large files, it was 
    determined that the 1.7.20 toolkit which we had on prior to 1.7.32 was much 
    more stable, so we are reverting to that toolkit while working with the 
    Maverick vendor on the transfer issues.  
    Note: This also temporarily lifts the restriction introduced in the
    Maverick 1.7.31 toolkit that all keys presented to SSP must have a key size 
    of 1024 or greater.  We still recommend that all trading partners update
    any keys which are deficient so that they will not fail in a future build.

  MFT-11762/IT36161 (Engine)  - After importing engine certificate,
                                dfltEngineKeyStore and dfltEngineTrustStore are
                                renamed to dfltCMKeyStore and dfltCMTrustStore

    After exporting the certificates from the CM and using the engineSslConfig
    tool to import them into the engine, the dfltEngineKeyStore and
    dfltEngineTrustStore were renamed to dfltCMKeyStore and dfltCMTrustStore.
    There were no other side effects.

    Resolution: Corrected the utility to not change the names of the key and
    trust stores during an import operation.

  MFT-11873/IT36145 (Engine)  - Remove TRACE from allowed methods in HTTP 
                                Adapter
  
    Resolution: Removed TRACE from the default allowed methods in the HTTP
    adapter.  Also tracked internally as SSP-4989.

  MFT-11875/IT36185 (CM,Engine) - Silent install ends with 255 code due to
                                failure reported in Import/generate certificate
                                step

    When recording a silent install response file, the variable generated for
    the response to the generate keycert question was different than the one
    that the installer used during playback. (USER_INPUT_CONSOLE_RESULTS vs.
    GEN_KEY_CERT). The mismatch caused a failure and a 255 return code.

    Resolution: Corrected the installer to use either variable format to answer
    the generate keycert question.

  SSP-4965/         (CM,Engine) - Updated code signing certificate for signing
                                jarfiles
  
    The code signing certificate for signing jar files expires March 14, 2021.
    Internal testing with dates beyond the expiration date showed no side 
    effects on starting and running SSP or the SSPCM.

    Resolution: Now sign all jars with an IBM signing certificate which
    expires in 2031.

  MFT-11769/IT36186 (CM)      - Cannot sign in to SSPCM when going through
                                WebSeal proxy

    Customer with an IBM Webseal proxy in front of the SSPCM was getting
    "session is null or invalid" when trying to sign in from the login page.
    The referrer in the HTTP header was not being validated properly.

    Resolution: Now strip off the port from the host value in the HTTP request
    header to correctly validate the referrer.

  MFT-11902/IT36593 (Engine)  - SFTP SSE2654 "Session limit of 'n' has been
                                exceeded" message not posted in logs

    The SSE2654 message was inconsistently being emitted for an SFTP adapter
    which reached its session limit, or showing up in the wrong adapter log.

    Resolution: Corrected the logger instance for SSE2654, ensuring that each
    adapter's session limit messages are logged properly and that each adapter
    enforces its own session limits.

  MFT-11937/IT36198 (Engine)  - Upgrade from pre-SSP6001 in FIPS mode causes
                                engine startup to fail

    Customer running on SSP6000 in FIPS mode upgraded to SSP6011 and could not
    start the engine.  The following messages were shown in the startup logs:
      ERROR AccepterConfigManager - Issue encountered while retrieving
        configuration file from [null]
      ERROR ServiceManagerImpl - java.lang.RuntimeException: Unable to
        configure/start accepter: Secure
    The FIPS compatibility checks were being done before the keystores were
    converted to the post-6001 format.

    Resolution: Now handle an upgrade in FIPS mode from a pre-SSP6001 system.
    Workaround: Prior to the upgrade, set  FIPS_MODE=false in the
    bin/security.properties file.  Set it back to true after the upgrade.

  MFT-11968/IT36578 (Engine)  - Max session limit on one SFTP adapter limits
                                sessions on other adapters with higher setting

    The Customer found that an SFTP adapter with a limit of 1000 sessions was
    limited by the setting on another adapter which was set to 400 sessions.

    Resolution: This was fixed by the same fix as MFT-11902, ensuring that
    each adapter's session limit messages are logged properly and that each
    adapter enforces its own session limits.

  MFT-11965/IT36452 (Engine)  - Keycert passwords visible as clear text in
                                Engine audit logs when configuration pushed.

    When adding a keycert to the CM system store and using it in an SSL based
    protocol on the Engine, the keyPassphrase and keyStorePassword fields are
    shown in plain text in the <Engine>/logs/audit/auditlog.xml files when the
    configuration is pushed to the engine. The fields are masked on the CM 
    side.
    
    Resolution: Now mask the keyPassphrase and keyStorePassword fields in the 
    engine audit logs, as we do for other sensitive fields.
    HIPER/ACTION: Search and clean any references to the keyPassphrase and
    keyStorePassword fields in the <Engine>/logs/audit/auditlog*.xml files.

  MFT-11971/        (CM)      - Cannot Login to SSPCM after upgrade to 6.0.2.0
                                or 6.0.1.1 iFix 3 if Sessionid Cookie Domain
                                is misconfigured
                                
    If the CM->System->CMSystemSettings->HTTP Security Sessionid Cookie Domain
    field is non-blank and not set to the fully qualified domain name (FQDN) of
    the SSPCM, the SSPCM will reject logins after the upgrade to 6011 iFix 3 or
    6020.  "Session Error Invalid session, please sign in again." is seen.
    
    Resolution: Now allow the Sessionid Cookie Domain field in the GUI to be 
    set to blank to ignore it. Also add a warning message when the Cookie 
    Domain is saved that the CM user may be unable to login if it is incorrect.
    And added support for a -Dsspcm.disable.cookie.domain parm in the startCM 
    script as a "back door" to disable the Cookie Domain check during the 
    login.
    HIPER: Before upgrading to SSP6011 or SSP6020, the admin should check the
    Sessionid Cookie Domain field in the GUI to make sure that it is either
    blank or it is the fully qualified domain name of the SSPCM.
    Workaround: Without this fix, the admin must restore the previous version
    of the SSPCM and set the Sessionid Cookie Domain to the correct FQDN before
    upgrading.

  MFT-11853/IT36501 (Engine)  - Invalid Eyecatcher exception in logs

    SSP logs were showing Invalid Eyecatcher exceptions when interacting with
    SEAS. There is built in logic to make sure that every header received by
    SEAS and returned from SEAS has a 4 character eyecatcher as a validation.

    Resolution: Now dump the eyecatcher when the error happens so that the 
    underlying issue with the send/receive on the SEAS socket can be diagnosed.

  MFT-11917/IT36577 (CM)      - Lock manager in GUI not behaving as expected

    Customer has multiple SSP admin users who may be editing something and have
    a lock placed on it. If called away while editing a node in the netmap it
    remains locked until it times out. The CM->System->Lock Manager screen only
    showed the user with the lock for a tenth of a second before vanishing.

    Resolution: Corrected the Lock Manager to show the locked objects and allow
    them to be unlocked from the GUI screen.

  MFT-11944/IT36706 (Engine)  - SSP SSO Myfilegateway login fails when resource
                                files missing after SSP upgrade

    After the Customer upgraded to SSP6011 iFix 3+ Build 241, their logins to
    myFilegateway were failing with an UNAUTHORIZED response. The Customer had
    customized their login.html, but 2 of the gif files referenced were 
    missing, causing a redirect back to the login.html file and a new web 
    sessionid and a new CSRF token. Since the CSRF token does not match the 
    one in the browser, the redirect results in an UNAUTHORIZED response.

    Resolution: Changed so SSP does not redirect to the login.html if a 
    resource is not found. It simply sends 404 NOT FOUND for that resource and 
    continues.

  MFT-12018/IT36711 (CM, Engine) - SFTP does not support DH Group18-sha512 key
                                   exchange
                                   
    2 HMACs and 5 key exchanges were determined to be unsupported by the IBM
    JSSE component of the JRE, and so were not being used by the SFTP adapter.
    
    Resolution: Removed the following unsupported HMACs and key exchanges from
    the CM SFTP adapter GUI.
    HMACs:  hmac-ripemd160 and hmac-ripemd160-etm@openssh.com
    Key exchanges: RSA2048_SHA256
      diffie-hellman-group15-sha512  diffie-hellman-group16-sha512
      diffie-hellman-group17-sha512  diffie-hellman-group18-sha512

  MFT-11724/IT36856 (Engine)  - ICAP integration with provider: BitDefender

    Customer using the BitDefender ICAP provider for in-flight virus scanning,
    which was not on our original supported list. The product claimed to adhere
    to the ICAP RFC 3507, so we worked with the Customer to test and refine our
    ICAP solution to work with BitDefender.

    Resolution: Updated the code to handle ICAP service names other than
    wwreqmod (for McAfee), and better eof detection when sending a stream to
    the ICAP server.  ICAP solution now works for McAfee and BitDefender.

  MFT-11940/IT37028 (CM)      - SSPCM User Auth with EA - Support SEAS
                                Alternate Server configuration 
                                
    When defining SSPCM users in LDAP to authenticate with SEAS, there was
    no failover if the SEAS defined for the user went down.
    
    Resolution: Enhancement to have the SSPCM try the alternate server in the
    SEAS definition if the primary SEAS goes down.

  MFT-12099/IT36837 (Engine)  - SSP Change Password Portal login issue
  
    In some situations the SSP Change Password or MustChange Password portals
    are not saving the userid in the websesion causing it to be missing from 
    the webpage.

    Resolution: Now always save the userid in the web session.  Also added
    additional strategic logging.

  MFT-12193/IT37112 (CM)      - RESTAPI import of HSM keys gets "Invalid content
                                was found starting with element keyStoreProvider

    During a RESTAPI import of a full configuration containing HSM keys, the
    Customer got "<validationErrorsList>cvc-complex-type.2.4.a: Invalid content
    was found starting with element 'keyStoreProvider'".

    Added support in the RESTAPI xsd for the tag <keyStoreProvider>, which
    comes into play with HSM certificates.

  SSP-4986/         (CM)      - Unable to update webCiphers with
                                ConfigureCmSslTool

    Using the ConfigureCmSslTool utility to update the Jetty Cipher Suites,
    none of the selected cipher suites will pass validation.

    Resolution: Corrected the validation method for the webCiphers.

  SSP-5105/         (CM)      - NPE when switching CM User auth from EA to 
                                local store 
                                
    Found while testing MFT-11940; reassigning a CM User back from EA
    authentication to the local user store got a NullPointerException in the 
    log. 
    
    Resolution: Now handle the authentication reassignment correctly.

  SSP-5126/         (CM)      - RESTAPI import fails when ICAP scan option is
                                NONE for CD node

    Discovered in internal testing that exporting a CD node with icapScanOption
    NONE caused a failure on import. It complained that the only valid values 
    were BOTH, PNODE, or SNODE.

    Resolution: Added "NONE" as a valid value for a CD node icapScanOption 
    during a RESTAPI import.

  MFT-12113/IT37411 (Engine)  - Engine fails to start on Solaris
  
    After the new certificate signing process was implemented, the SSP engine
    would not start on Solaris, getting
       java.lang.SecurityException: Untrusted manifest entry: org/jdom/input.
    Solaris did not like the Digest Algorithm SHA256.
    
    Resolution: Updated the SHA256 digest algorithm to SHA-256 to correct the 
    startup on Solaris and HP.

  MFT-12193/IT37112 (CM)      - RESTAPI fails to import HSM certs

    The RESTAPI was getting an XSD validation error when importing an HSM
    certificate. The HSM certificates were not getting decrypted properly at
    import time.

    Resolution: Corrected the decrypt operation at RESTAPI Import time for HSM
    certificates.

  SSP-4714/         (CM)      - SSPCM Fresh install gets ERROR on Solaris
  
    The install log for a new install of the CM on Solaris showed an ERROR 
    message, even when the installation was successful.
      Unable to locate /jre/bin/ikeyman
      
    Resolution: Removed a stray character in a variable name within the
    InstallAnywhere deck so that IA could find the ikeyman pointer file on a
    Solaris install.

  SSP-4994/         (Engine)  - Enhancement to support MyFG 2.0
  
    B2Bi has developed the next version of myFileGateway known as MyFG 2.0 as a
    Single Page Application. There is only one javascript or page request from
    the MyFG2.0 port.

    Resolution: Now provide support for MyFG2.0 within the SSP HTTP adapter. 
    Add the following properties to the HTTP adapter which points to MyFG2.0:
      - myfg.url.path=/myfg
      - no.cookie.sso=true

  SSP-5015/ADV0031895 (CM)    - Unrestricted document type definition
                                vulnerability found in scan

    Internal security scans revealed an Unrestricted document type definition
    (DTD) vulnerability, for which we opened PSIRT advisory 31895.

    Resolution: Disabled the DTD feature on the DocumentBuilder factory. See
    https://www.ibm.com/support/pages/node/6471623 for the Security Bulletin.

  SSP-5018/ADV0031845 (CM)    - Dubious method issue found in scan

    Internal scans revealed a System.exit(0) was being used in the
    runCMDataCollector tool.

    Resolution: Updated the class to remove the exit(0) call. 
    This has been re-evaluated and determined to not be a vulnerability.
    The call was found in a utility which does not affect the running CM.

  SSP-5021/ADV0031888 (CM)    - Resource leakage vulnerability found in scan

    An internal security scan revealed that resources were not being closed
    properly in all circumstances, resulting in memory leakage.
    
    Resolution: Now close the resources properly to avoid the memory issues. See
    https://www.ibm.com/support/pages/node/6471577 for the Security Bulletin.

  SSP-5022/ADV0027664 (CM,Engine) - Upgrade httpcomponents-client to 4.5.13
   
    An internal scan suggested a newer version of the httpcomponents-client
    toolkit.

    Upgraded to the 4.5.13 version of the httpcomponents-client toolkit. This
    also fixes several serialization and URL processing issues. See
    https://www.ibm.com/support/pages/node/6471577 for the Security Bulletin.

  SSP-5067/ADV0031843 (CM,Engine) - Upgrade Apache ActiveMQ toolkit to 5.16.2

    An internal scan suggested a newer version of the Apache ActiveMQ toolkit.

    Resolution: Upgraded the toolkit to the Apache ActiveMQ 5.16.2 level.
    This has been re-evaluated and determined to not be a vulnerability.

  SSP-5071/ADV0023803 (Engine)  - Upgrade Apache Santuario to 2.2.1

    An internal scan suggested a newer version of Apache Santuario (XML
    Security for Java).

    Resolution: Upgraded the toolkit to Apache Santuario 2.2.1
    This has been re-evaluated and determined to not be a vulnerability.

  SSP-5075/ADV0031824 (Engine)  - Upgrade Guava: Google Core Libraries for Java
                                to 30.1.1

    An internal scan suggested a newer version of Guava: Google Core Libraries
    for Java. 
    This has been re-evaluated and determined to not be a vulnerability.

    Resolution: Upgraded the Guava toolkit to the 30.1.1 level.

  SSP-5077/ADV0031827 (CM,Engine) - Upgrade Eclipse Jetty to 9.4.41

    An internal scan suggested a newer version of the Jetty toolkit.

    Resolution: Upgraded the Jetty toolkit to the 9.4.41 level to address
    several vulnerabilities. See
    https://www.ibm.com/support/pages/node/6471577 for the Security Bulletin.

  SSP-5096/         (CM)        -  Keystore and Truststore passwords dumped in 
                                   CM Debug log

    When logging level is enabled to DEBUG in the SSPCM GUI, the keystore and 
    truststore passwords are displayed in the clear.
    
    Resolution: Now ensure that the password values are not displayed.

  SSP-5110/         (CM,Engine) - Enhancement to support OSA for publishing
                                  audit events to Control Center (ICC)

    There is a requirement to provide an alternative to JMS queue publishing
    for writing audit events to IBM Control Center (ICC), since the JMS queue
    server connection is not secured.

    Resolution: Now support event/status publishing using Open Server 
    Architecture (OSA). Initially, to turn on OSA support, the CM startup must 
    be updated with some Java overrides. These will be replaced with GUI 
    support in a later release.
      -Dssp.osa.enable=true
      -Dssp.osa.ep.host=host1:port1;host2:port2
      -Dssp.osa.service.url=/sccwebclient/events
      -Dssp.osa.user.admin=AdminId:password
      -Dssp.osa.ep.secure=true

  SSP-5141/         (CM)        - SSPcm upgrade fails after second restart with 
                                  IOException: Keystore type is not PKCS12 

    The fix for MFT-11937 associated an extra public key to the private key
    being converted during the upgrade.  On the second restart, the above
    message was seen.

    Resolution: Corrected the upgrade logic to no longer add the extra public
    keys.

  SSP-5212/         (CM,Engine) - Connection failures with multiple EPs support

    Multiple EPs support for OSA monitoring was causing connection failures.
    
    Resolution: Now reset the connectionCount to the default value when the
    full count is reached.

  MFT-12189/        (Engine)  - Add File name to HTTP URL in the ICAP request
  
    Enhancement to pass the destination file path within the HTTP URL POST when
    making the connection to the ICAP server.  Then when the virus scanning is
    done, the file path can show up in the ICAP server audit logs.

  MFT-12271/IT37593 (Engine)  - Interface issues with external SAML IdP

    Customer using the HTTP adapter for myfilegateway and an SSO configuration
    with an external SAML IdP was having some integration issues.
    - The SAML2.0 AuthnResponse post was greater than 1024, failing the session
    - A session initiated at the IdP might not supply a websessionid.
    - The IdP might not send a session index in the AuthnResponse's 
      AuthStatement

    Resolution: - Increased the default AuthnResponse data length to 64k.
    - Changed to not check for websessionid when using SAML external IdP.
    - Allow a missing session Index, but log it.

  MFT-12310/IT37562 (Engine)  - SCP/SFTP rejecting transfers with "time" option
  
    The SCP/SFTP -p option to preserve the timestamp on a transfer was being 
    rejected by SSP, causing the file transfer to fail.
    
    Resolution: Now allow the "time" option to be passed through to the back
    end B2Bi server, so that it can choose to honor or ignore it.

  MFT-12358/        (CM)      -  Allow Other provider under ICAP config

    The ICAP configuration advanced tab in the SSP CM allowed only one option,
    MacAfee, for the server provider for virus scanning. Other providers which
    follow the ICAP RFC are also supported.

    Resolution: Updated the SSP GUI to specify Other as an alternative to
    MacAfee under the ICAP config screen.

  SSP-4956/ADV0028445 (CM,Engine) - Oracle Java Oct 2020 CPU deferred CVE

    Resolution: Upgraded the IBM JRE to the 8.0.6.30 level to satisfy the CVEs
    in the Oracle October 2020 CPU, PSIRT advisory 28445.
    See the Security Bulletin at https://www.ibm.com/support/pages/node/6484671

  SSP-5012/ADV0031846 (CM,Engine) - Risky cryptographic algorithm vulnerability

    This vulnerability was fixed as part of SSP-5080/ADV0031848.  See that
    defect for more information.

  SSP-5016/ADV0031847 (CM,Engine) - Hard-coded secrets vulnerability

    An internal security scan revealed the use of a hard-coded password in some
    SSP files.

    Resolution: 1) Now read the truststore password from defTrustStore.xml when
    loading the truststore for SAML-IDP signature validation. 2) Generate a
    random string for a password to load a keystore in memory when using the
    HSM manageKeycert utility.
    See the Security Bulletin at https://www.ibm.com/support/pages/node/6484681

  SSP-5080/ADV0031848 (CM,Engine) - Weak hash vulnerability

    An internal security scan revealed the use of hash values which were not
    computationally intensive enough. Also tracked internally as SSP-5012.

    Resolution: Now use a strong salt and a PDKSF2 hashing technique.
    See the Security Bulletin at https://www.ibm.com/support/pages/node/6484681

  SSP-5089/ADV0032087 (CM,Engine) - Container environment compoments
                                  vulnerability

    An internal security scan found that the SSP containers allowed privileged
    escalations and lacked a network policy.

    Resolution: Added support for a network policy, supplemental group and
    removed some capabilities.
    Security Bulletin pending review: https://www.ibm.com/support/pages/node/6487461
    For downloading the latest Certified Container Software, please visit the
    following links:
    SSP: https://www.ibm.com/docs/en/secure-proxy/6.0.2?topic=tasks-downloading-certified-container-software
    SEAS: https://www.ibm.com/docs/en/external-auth-server/6.0.2?topic=tasks-downloading-certified-container-software
    CASE Bundles: 1.0.2
    Helm Chart:   1.0.3
    Docker Image: 6.0.2.0.03

  SSP-5093/ADV0029859 (CM,Engine) - Oracle Java Jan 2021 CPU

    Resolution: Upgraded the IBM JRE to the 8.0.6.30 level to satisfy the CVEs
    in the Oracle January 2021 CPU, PSIRT advisory 29859.
    See the Security Bulletin at https://www.ibm.com/support/pages/node/6484671

  SSP-5116/IJ33416  (Engine)  - CD TLSv1 sessions fail with "SSLv2Hello is not
                                enabled" in new IBM JRE 8.0.6.25

    When attempting to use the IBM JRE 8.0.6.25, Connect:Direct UNIX and
    Windows sessions using TLSv1 were failing to connect to SSP, which gave an
    error, "SSLv2Hello is not enabled". The CD sessions were using a legacy
    SSLv2Hello to start the TLS exchange, which negotiates up to TLSv1.
    If configured for TLSv1.2, the session worked correctly.

    Resolution: The IBM Java team added support back in for receiving a client
    SSLv2Hello in JRE 8.0.6.30, after taking it out in 8.0.6.25.
    Workaround: The best long term solution is for all CD sessions to be
    configured for TLSv1.2 going forward. Support for TLSv1 and TLSv1.1 is
    going away in the next JRE from IBM.

  SSP-5124/          (CM)     - Nuisance msg in CM log: NoClassDefFoundError
                                javax.security.auth.message.AuthException

    The Jetty 9.4.34 upgrade introduced the jetty-jaspi-9.4.34.v20201102.jar
    file, which caused this nuisance message in the CM logs.

    Resolution: Stop shipping the jar file, which was not being used anyway.

  SSP-5155/          (Engine) - MyFG2.0 does not show the SSP portal login page
                                when the SSOTOKEN expires

    When the SSOTOKEN expires on a token validation, currently SSP deletes any
    cookies and sends a redirect response (302) to the SSP login page to the
    client/Browser. Unlike the myfilegateway application, the MyFG2.0 client
    script is angular based and does not get the 302 redirect. The browser
    hangs, showing an hourglass instead of the login page.

    Resolution: Now send a 401 response instead of a 302 to the client/browser,
    so the client side angular script can handle this. We still keep the
    location header.

  SSP-5414/         (Engine)  - Keep the hash value for ssotokens consistent in
                                 the debug logs
                                 
    While doing work on hash values in SSP-5012 and SSP-5080, it was noticed 
    that SSO tokens were not being logged consistently, which made it hard to
    keep track of session flows.
    
    Resolution: Created a separate hash function without the salt used for 
    logging the SSO tokens.

  SSP-5457/         (CM,Engine) - Merge Resource Leakage code to complete
                                SSP-5021

    Found one module which did not make the original SSP-5021 code change.

    Resolution: Updated the module to complete the SSP-5021 fix.

  MFT-12464/IT38350 (CM,Engine) - Previous Windows 6.x service not deleted 
                                during install

    Doing an upgrade in place of SSP6011 to SSP6020 on Windows, the old Windows 
    service name was not deleted. The InstallAnywhere logic was using a 
    combersome process to remove old services which had not been maintained 
    since 6.0.0.0.
    
    Resolution: Updated the InstallAnywhere process to remove old Windows
    services from 3.4.2.0 to 6.0.1.1 if the install directory matches the 
    executable path in the service. Did the same for Engine, CM and SEAS.

  SSP-5478/         (Engine)  - Intermittent Unauthorized error when using SSP
                                login portal in high concurrency

    During internal testing with 100 concurrent logins through the SSP login
    portal, 15% of the sessions failed with a 401 Unauthorized error. There was
    a mismatch between the websessionid associated with the TCP session and the
    one from the cookie, causing the CSRF check to fail.
    
    Resolution: Now always use the websessionid from the cookie instead of the
    one stored with the TCP session.

  SSP-5479/         (CM)      - RESTAPI import fails on PESIT adapter with
                                Invalid content on 'icapPSName'
                                
    When creating a PESIT adapter throug the GUI, the icapPSName tag was being
    added, even though ICAP is not supported for the PESIT protocol. ICAP is
    supported for CD, and the CD and PESIT protocols share the same GUI jsp.
    
    Resolution: Updated the JSP to only add the icapPSName tag for a CD adapter
    if it is called for.

  SSP-5520/         (CM)      - CM GUI session from second tab gets 
                                Unauthorized Error 
                                
    A CM GUI user attempting to open a second session in another tab gets 
    Unauthorized Error because a websessionid cookie is already present.  Found
    while testing SSP-5478.
    
    Resolution: Updated the login process to use the webSessionId from the
    cookie instead of the one stored with the TCP session.

  MFT-12294/IT38557 (CM)        - RESTAPI UnrecoverableKeyException in
                                  concurrent processing

    Running multple copies of the RESTAPI, the keystore password can get 
    corrupted by multiple threads using the same static keystore build method.

    Resolution: Now use the keystore password from the properties before trying 
    the system value.

  MFT-12557/        (CM)        - RESTAPI import of older config fails on
                                  'templateName' xml key.

    A Customer importing a RESTAPI configuration from a 343x version of SSP
    gets Invalid content was found starting with element 'templateName'.
    
    Resolution: Added the templateName tag back into the keystoredef.xsd file.

  SSP-4326/         (CM,Engine) - Enhancement: Http ICAP support

    Enhancement to support in-flight anti-virus scanning of small to medium
    size files being uploaded through the HTTP adapter. See online documentation
    for SSP6030 for more details.

  SSP-5045/         (CM,Engine) - Various issues reported by internal code scans

    Internal code scans revealed potential issues in several areas:
    synchronized Lock/Wait, Resource leakage, indefinite wait, infinite loop,
    unlogged security exception, weak password hashing, insecure TLSv1
    connection.

    Resolution: Corrected the issues to use best practices and reran the scans
    to ensure compliance.
    Also tracked internally with defects SSP-4838, SSP-5002, SSP-5009,
    SSP-5010, SSP-5014, SSP-5546

  SSP-4841/         (CM)        - RESTAPI allowing simple SQL Injection

    Internal RESTAPI testing found that the SOCKS Proxy Config validator was
    allowing a simple SQL injections.

    Resolution: Hardened the RESTAPI to detect and reject simple SQL
    constructs.

  SSP-4882/         (CM,Engine) - SCIRandom logging not sent to SSP log files

    Output from the SCIRandom function was not getting to the SSP log files.

    Resolution: Implemented a log4j logger for SCIRandom output.

  SSP-4959/         (CM,Engine) - Support the TLSv1.3 security protocol

    Resolution: Updated SSPCM and Engine code to support the TLSv1.3 security
    protocol.  Communication between the SSPCM, Engine and SEAS can be
    configured to run with it, as well as inbound traffic on the HTTP, FTP, CD
    and PESIT adapters. As B2Bi does not yet support it, it cannot be used for
    backend connections to B2Bi adapters.
    Note: Because of a timing issue in the TLSv1.3 handshake when acting as a
    client, it cannot be used in the forward proxy outbound connection of the
    CD or PESIT adapters.  The TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384,
    and TLS_CHACHA20_POLY1305_SHA256 ciphers are supported.

  SSP-4983/         (CM)        - Allow SSP CM RESTAPI to use TLSv1.2, TLSv1.3

    The RESTAPI command line utility was hardcoded to use the TLSv1 protocol.

    Updated the utility and the sample sspRestAPI.properties file to support
    the new "TLS_PROTOCOL=TLSv1.2" property. Also supports TLSv1 and TLSv1.3.

  SSP-5043/         (CM)        - Require a password policy when creating a new
                                 user.

    Resolution: When creating a new user via the SSPCM GUI, require a password
    policy be assigned, instead of allowing the None option.

  SSP-5088/ADV0031920  (CM)     - Host header injection vulnerability

    Internal scans showed that the SSPCM is not validating the Host Header
    passed from the client in the HTTP requests it gets and uses it when
    sending a redirect to client/browser.

    Resolution: Now enforce a list of acceptable hostnames which the client
    may pass in their host headers, to ensure that the session is not getting
    spoofed.
    ACTION: After applying 6.0.3.0, SSPCM web sessions may be rejected if the
            hostname in the URL https://<hostname>:<port>/SSPDashboard does not
            match the hostnames in the new <SSPCM>/conf/cmconfig.properties
            file. To correct this, the admin should update the file to add the
            list of hostnames that the SSPCM machine may be known by. Change
            the following line in the file from:
                #cm.alternate.hosts=
            to: cm.alternate.hosts=hostname1,hostname2.mycompany.com,localhost,10.20.30.40
            Or SSPCM hostname checking can be turned off altogether by changing
            the following line in that file from:
                #cm.bypass.host.header.check=false
            to: cm.bypass.host.header.check=true

  SSP-5130/         (CM)        - Enhancement: SSPCM support for configuring OSA
                                 and multiple EPs

    Support for Open Server Architecture (OSA) to allow secure event/status
    publishing to IBM Control Center was introduced in SSP 6.0.2 iFix 02 using
    startup options in the CM startup script. This release 6.0.3 enhancement
    provides support within the SSPCM GUI in the System->CM System Settings->
    ICC OSA Monitoring tab. Multiple Event Processor (EP) host/ports may be
    defined as well as the ability to secure the connections.

  SSP-5483/         (CM,Engine) - Add java.security.override file to allow
                                  disabled TLSv1

    The jre/lib/security/java.security file which ships with the IBM JRE now
    disables the TLSv1 and TLSv1.1 security protocols by default. Customers
    are encouraged to use the TLSv1.2 protocol.

    Resolution: Now ship a conf/java.security.override file which allows the
    Customer to enable the TLSv1 and TLSv1.1 protocols.

    ACTION: With 6.0.3.0, TLSv1 and TLSv1.1 security protocols are disabled by
            default.  If your shop is not ready to disable them, remove the "#"
            from the following line in the conf/java.security.override file to
            take TLSv1 and TLSv1.1 off the disabled algorithms list:
                #jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, ...
            Applies to the CM and Engine.

  SSP-5565/         (CM,Engine) - Upgrade thirdparty jars for SSP 6.0.3.0

    Resolution: Updated the following third party jars:
      commons-io-2.11.0.jar
      cryptacular-1.2.4.jar
      jdom-1.1.3.jar
      log4j-*-2.14.1.jar
      xmlsec-2.2.3.jar
    Also tracked internally with SSP-5070.

  SSP-5626/         (CM,Engine) - Support for IBM ISAM SAML2.0 IdP - ACS URL

    When testing myFilegateway thru SSP using IBM ISAM SAML IdP, the Idp was
    throwing errors. SSP did not support IBM ISAM SAML2.0 IdP before. Passing
    the Assertion Consumer Service (ACS) URL parameter in the AuthnRequest
    works. The java.util.Base64 decoder also reported an issue with the
    AuthnResponse, whereas the OpenSAML library Base64 worked.


    Resolution: Made changes to pass ACS url if an SSO property
    "saml2.assertion.consumer.svc.url" value is specified, otherwise it passes
    the ACS index specified in the SSO configuration GUI. Also now use the
    OpenSAML Base64 decoder for debug logging of the AuthnResponse from IdP.

  SSP-5698/         (CM,Engine) - SSL debug output not going to systemout.log

    The Systemout logger required buffers with a newline string
    ("\r\n" or "\n") to output a buffered string. The SSL debug output did not
    always cooperate. Without the newline, the output gets buffered and never
    flushed into the log, unless one comes from another source.

    Resolution: Now buffer up to 4096 bytes and log it even if there is no
    newline at the end.

  MFT-12423/IT39259 (Engine)    - Unknown SFTP user can log in to SSP in
                                  passthrough mode

    For SFTP passthrough, logs were printing auth=true and logged on even 
    before actual authentication is done by B2Bi. Unknown users, such as admin
    and root could log in to SSP (not B2Bi) and attempt to issue local commands
    (which were rejected). We recommend Single Signon (SSO) authentication 
    through SEAS rather than passthrough for production.  Also Customers should
    use SSP blocklisting to reject obvious unwanted users (e.g. admin, root).
    
    Resolution: For SSP passthrough, no longer say a user is password
    authenticated when they are not. Also when we reject a local SSH command, 
    specifically log that SSP does not support local SSH commands.

  MFT-12446/IT39123 (Engine)    - Support for specifying engine client alias 
                                  during import and stopEngine.sh
                                  
    A Customer's security team required strict client-only and server-only
    keycerts, but the SSP stopEngine command failed when the certificates for
    the CM and Engine did not have both the server and client extended usage.

    Resolution: Added support for a engClientAlias=<client key alias> on the
    stopEngine command line.  Also, allow the engClientCertAlias parm on an
    import from the CM.
    configureEngineSsl.sh -i file=cmConfig.exp engCertAlias=serverAlias
      engClientCertAlias=clientAlias

  MFT-12618/        (Engine)    - Set Maxheap on Windows via LAX file
                                  lax.nl.java.option.additional parm

    Java Max Heapsize for Windows services was not honoring the 
    lax.nl.java.option.java.heap.size.max in the $LAX file.

    Resolution: Updated comments in the bin\SSPengine$.lax file to override the
    Max heap via the lax.nl.java.option.additional property. 

  SSP-5698/         (CM, Engine) - SSL debug output not going to systemout.log
  
    The Systemout logger required buffers with a newline string
    ("\r\n" or "\n") to output a buffered string. The SSL debug output did not 
    always cooperate. Without the newline, the output gets buffered and never 
    flushed into the log, unless one comes from another source.

    Resolution: Now buffer up to 4096 bytes and log it even if there is no 
    newline at the end.

  SSP-5472/         (CM)        - RESTAPI validation for certificate names 
                                  added to the keystore/truststore
                                  
    The SSP RESTAPI was doing no validation on certificate names being added to
    the keystore/truststore.
    
    Resolution: Added name validation for keycerts and certs being added through
    the RESTAPI.

  SSP-5484/         (CM)        - Ciphersuites specified in the OSA monitoring
                                  tab not being honored.
                                  
    Ciphersuites in the OSA monitoring tab were not being used by OSA.
    
    Resolution: Now build the TLS context correctly so that the ciphers are 
    used.

  MFT-12762/ADV0040089 (CM/Engine) - Log4j CVE-2021-44228 JNDILookup
                                     issue
  
    HIPER: Apache Log4j2 <=2.14.1 JNDI features used in configuration, log 
    messages, and parameters do not protect against attacker controlled LDAP 
    and other JNDI related endpoints. An attacker who can control log messages 
    or log message parameters can execute arbitrary code loaded from LDAP
    servers when message lookup substitution is enabled. 

    Resolution: Now supply log4j 2.15.0, where this behavior has been disabled
    by default.

  SSP-5743/ADV0040239 (CM/Engine) - Log4j CVE-2021-45046 JNDILookup
                                    issue

    Apache Log4j is vulnerable to a denial of service, caused by an incomplete 
    fix of CVE-2021-44228 in certain non-default configurations. A remote 
    attacker with control over Thread Context Map (MDC) input data or a Thread 
    Context Map pattern to exploit this vulnerability to craft malicious input 
    data using a JNDI Lookup pattern and cause a denial of service.

    Resolution: Now supply log4j 2.16.0, where this behavior has been disabled
    by default.

  MFT-12597/        (CM/Engine) - Security findings on SSP HTTPS listener

    An internal scan revealed a 500 Internal Server Error and the need to
    implement the SameSite cookie attribute.

    Resolution: Added code to support the SameSite cookie attribute. By default
    the "Strict" SameSite attribute will be used. The Customer can override
    this by specifying the SSO property "sso.cookie.same.site.attr". Valid
    values are "Strict", "Lax", or 'None". "Strict" is recommended and "None"
    should not be used.  Also increased the count of form fields for Login post
    and change password post from 2 or 4 to 9.

  MFT-12601/        (Engine)    - OKTA external IdP-SSP for change password
                                  page not showing userid

    Customer wants to use the change password page in SSP to change the
    password in LDAP thru SSP/SEAS/LDAP, even though they have an external OKTA
    IdP. The change password page does not show the userid when it is used with
    the internal portal configuration.

    Resolution: Now call the ChangePwdPageHandler class when the change
    password page is requested even when external portal option is selected.

  MFT-12637/        (Engine)    - SSP engine status shows stopped in SSP
                                  dashboard

    A thread doing a stop adapter process caused 4 other threads doing a
    getStatus operation to hang. Since these threads did not respond to the CM
    in time, the CM marked the Engine as offline.

    Resolution: Removed most of the method level synchronization in the EAProxy
    area to lessen the chance for hangs and slowdowns in the getStatus
    processing. Should also improve EA monitoring.

  MFT-12752/        (CM)        - TLS_ONLY changed to TLSv1.2 during upgrade
                                  from 3432

    A fix put in place to resolve SSP-3531 resulted in the TLS_ONLY protocol
    not being available for SSP adapters.

    Resolution:  Updated the fix for SSP-3531 to only be applicable for the
    Jetty CM.

  MFT-12820/        (CM)        - Nullpointer during RESTAPI Script Operation

    When the system passphrase is prompted for instead of being placed in the
    sspRestApi.properties file, the RESTAPI script gets a NullPointerException
    (NPE).

    Resolution: Now correctly set the system Passphrase read from the console
    into the parameter object.

  SSP-5742/ADV0040738 (CM,Engine) - Log4j CVE-2021-45105 JNDILookup issue -
                                    Follow on

    Apache Log4j is vulnerable to a denial of service, caused by the failure to 
    protect from uncontrolled recursion from self-referential lookups. A remote 
    attacker with control over Thread Context Map (MDC) input data could craft 
    malicious input data that contains a recursive lookup to cause a 
    StackOverflowError that will terminate the process.

    Resolution: Now supply log4j 2.17.0, which corrects this behavior.
    See the Security Bulletin at https://www.ibm.com/support/pages/node/6538102

  SSP-5760/ADV0040950 (CM,Engine) - Log4j CVE-2021-44832 JNDILookup issue - 
                                    Follow on

    Description: Apache Log4j could allow a remote attacker with permission to 
    modify the logging configuration file to execute arbitrary code on the 
    system. By constructing a malicious configuration using a JDBC Appender 
    with a data source referencing a JNDI URI , an attacker could exploit this 
    vulnerability to execute remote code.

    Resolution: Now supply log4j 2.17.1, which corrects this behavior. The
    2.17.1 level addresses CVE-2021-44228, CVE-2021-45046, CVE-2021-45105 and
    CVE-2021-44832.
    See the Security Bulletin at https://www.ibm.com/support/pages/node/6538674

  MFT-12495/IT39273 (CM/Engine) - New JRE breaks FIPS mode processing

    The upgrade to IBM JRE 8.0.6.30 introduced the new IBMJCEPlusFIPS provider 
    which was not understood by SSP when FIPS is enabled. SSP was using the 
    IBMJCEFIPS provider.

    Resolution: Converted SSP to use the new IBMJCEPlusFIPS security provider 
    when SSP is started in FIPS mode. 

  MFT-12826/IT39678 (Engine)    - External users get "502 Bad Gateway" error
                                  when re-directed to the mustchangepw.html

    SSP was using a dummy query parameter for userid "1=1@1". This was getting
    flagged as an SQL injection by the Customer's security scans.

    Resolution: Changed the dummy query parameter for userid to "{u}".

  MFT-12869/IT39786 (Engine)    - Step Injection does not work with B2Bi/CDSA

    Customer attempted to use step injection to submit a runtask Business
    Process (BP) to a Pnode running B2Bi CD Server Adapter (CDSA). SSP was
    misinterpreting CDSA as a CD Windows and used a PGM value of 'Windows'.

    Resolution: Now correctly pass the parms for step injection on a CDSA SNode.
      PGM value = Business Process Name
      sysopts =   Any value after the BP name separated by commas or space.

  MFT-12932/IT39864  (CM)       - SSPCM High CPU Utilization after 6030 Fix-01+
  
    After applying SSP6030 iFix 1+, some Customers noticed that a CM thread was
    consuming almost 100% of one CPU. Taking a javacore showed that the thread
    was called "Thread-12" and was supposedly sleeping in a class/method 
    called ConfiguratorServiceImpl$PushJMSThread.run.  Some faulty logic in
    the new OSA monitoring feature allowed a sleep time of 0 between wakeup
    calls.
    
    Resolution: Corrected the monitoring code to ensure that there is always
    a non-zero wait time and that no pushes are done if neither OSA nor JMS are
    enabled.

  SSP-3548/ADV0038393 (CM)      - Validate input size limits (Jetty)

    The Jetty web server in SSP CM was not enforcing a maximum form content and
    the maximum HTTP header length was hard-coded to 3548. A malicious internal
    user could craft a large payload to disrupt service.

    Resolution: Added the maximum form content size and maximum HTTP header
    length into the Globals Tab of the SystemSetting screen of the SSP CM GUI.
    See the Security Bulletin at https://www.ibm.com/support/pages/node/6558796

  SSP-4983/          (CM)       - Allow RESTAPI command line utility to use
                                   TLSv1.2 and TLSv1.3

    The sspRestAPI command line utility was hardcoded to use the TLS1.0
    protocol.

    Updated the utility and the sample sspRestAPI.properties file to support
    the new "TLS_PROTOCOL=TLSv1.2" property. Also supports TLSv1.3.

  SSP-5548/ADV0038394 (CM,Engine) - Resource leak on an exceptional path

    An internal code scan found that resources were left unclosed when
    exceptions occurred executinga particular methods.

    Resolution: Added the proper try-catch-finally blocks around the affected
    code to close the resources in exception conditions.  Also tracked 
    internally with SSP-5734.
    See the Security Bulletin at https://www.ibm.com/support/pages/node/6558796

  SSP-5770/         (Engine)    - NPE redirecting audit logs to syslogd

    NullPointerException (NPE) in AuditLogLayout.toByteArray() when trying to
    redirect audit logs so syslogd. Also tracked internally as SSP-5685.
    
    Resolution: Now check for null bytes before attempting to format a message.

  SSP-5774/           (CM)      - Unable to update keycert using commonCert
                                  option of configureCmSsl utility
                                  
    When adding a new keycert using the configureCmSsl utility, a failure 
       ***Error occurde while validating certificate aliases
       Key Certificate alias [aliasname] is not found in the keystore.
    The utility was erroneously reporting the alias was not in the keystore 
    even though it was currently being added. This affects the commonCert,
    cmCert, engCert, cmClientCert, or cmServerCert parameters.

    Resolution: Now wait until the utility is complete before checking to make
    sure that the keycert alias has been added.

  SSP-5775/           (CM)       - RESTAPI import from SSP3432 getting
                                   "JettyConfigDef is locked" 
                                   
    Using the RESTAPI to import a configuration from SSP3432 results in
      *validationErrorsList : [jettyConfigDef JettyConfigDef is locked and 
      cannot be updated.*]

    Resolution: Now use a case-insensitive check for the definition object name
    to avoid the lock/unlock problems.

  SSP-5779/           (Engine)   - New install fails to start with 
                                   javax.crypto.IllegalBlockSizeException 
                                  
    During internal testing of a new install (not an upgrade), the support 
    calls done for encrypting the configuration during the InstallAnywhere 
    phase were failing because the classpath was pointing to the wrong location 
    for a couple of jar files. On startup, the configuration files could not be
    decrypted, resulting in the error message.
    
    Resolution: Corrected the classpath issues in the InstallAnywhere deck to
    ensure that all internal utilities have the correct classpath.

  MFT-12534/IT38589 (Engine)    - Produce SSE2656 at INFO mode if 
                                  -Dsftp.sse2656.as.info=true
  
    The SSE2656 message is put out at session initialization time in DEBUG
    mode and lists the ciphers, macs and kex algorithms that the remote client
    is capable of. One Customer needed this information in INFO mode for an
    internal security audit, because if they run in DEBUG mode, their SFTP
    transfers are negatively impacted.

    Resolution: Added support for a new Java startup option 
    -Dsftp.sse2656.as.info=true. If added to the java invocation lines in 
    startEngine.sh, it will put out the SSE2656 message in INFO mode.

  MFT-12731/        (Engine)    - CD Adapter goes offline when session fails
                                  through SEAS

    A Connect:Direct session configured for SEAS authentication was causing the
    CD adapter to erroneously take itself offline because it thought that it
    could not make a back end connection. This also left the adapter in a bad
    state in which the local perimeter server would not pass new sessions to 
    it.
    
    Resolution: Correctly determine if a connection is failing because of an
    authentication failure or a problem with the back end connectivity before
    taking the listener down on a CD adapter.

  SSP-5777/SSP-5796 (Engine)    - Create Audit log event for successful HTTP 
                                  portal login

    Currently HTTP authentication audit records are only created for failed
    authentications.

    Resolution: Small enhancement to log successful HTTP authentications in the
    audit log.

  SSP-5814/         (Engine)    - Pass on SSH channel error msg from B2Bi Sftp 
                                  custom exit response

    Small enhancement to pass back the B2Bi SFTP custom exit response back to
    the SFTP client.

  MFT-12399/        (Engine)    - Put IBMJCEPlus provider in front for AES-NI
                                  performance

    Customer was getting poor performance with AES-GCM ciphers transferring
    large files through Connect:Direct.  The IBM Java team indicated that the
    new IBMJCEPlus provider should go in front of the IBMJCE provider in the
    java.security file.  This sped up the transfers.
    
    Resolution: Updated the jre/lib/security/java.security file to specify this
    order in the provider list:
      security.provider.2=com.ibm.crypto.plus.provider.IBMJCEPlus
      security.provider.3=com.ibm.crypto.provider.IBMJCE

    Caution: Although this has improved several issues, internal testing with
    the IBM 8.0.6.30 JRE has uncovered a General Protection Fault (GPF)
    exception when connecting to an SFTP server using a DSA private key. 
    Workaround is to swap the providers back.

  MFT-12978/        (Engine)    - Security Scan POST to /Signon/login.html gets
                                  Internal Server Error
                                  
     An internal scan found that when a form was POSTed for the url
     /Signon/Login.html, SSP responded with 500 Internal Server Error. This is 
     a bad request and should have resulted in a '400 Bad Request' response.

     Resolution: Now send the proper 400 Bad Request response for the invalid
     POST. Also tracked internally as SSP-5650.

  MFT-12991/        (Engine)    - Put IBMJCEPlus provider in front to resolve 
                                  SFTP "Host key signature is invalid"

    Customer upgraded to SSP6030 which shipped with the IBM 8.0.6.30 JRE. SFTP
    sessions to a certain server were getting "Host key signature is invalid".
    
    Resolution: Updated the jre/lib/security/java.security file to put the
    IBMJCEPlus provider in front of the IBMJCE provider in the provider list.
    See MFT-12399 for more information and a caution.

  MFT-13022/IT40285 (CM)        - Excessive CPU utilization when OSA is enabled

    Excessive CPU usage is observed when OSA is enabled.  The monitoring thread
    was constantly checking for work to do rather than waiting for work to 
    arrive.
    
    Resolution: Changed the task queue operation to correct the fast loop.

  MFT-13033/IT40317 (Engine)    - Adapter listeners go offline when alternate
                                  destinations coded

    When alternate IP address/ports are coded for outbound nodes in a netmap
    and the primary node goes down, The failover manager does not always check
    each alternate to see if it is up before taking the listener down.

    Resolution: Now test all the alternate routes in the outbound node during
    failover checking and do not simply stop after finding one which is up.
    This new behavior is controlled by a java system property which defaults to
    true.  To turn it off, add -Dfailover.mgr.test.all.connections=false to
    startEngine.sh.

  MFT-13035/IT40224 (Engine)    - External IdP support - does not accept 
                                  IdpCert from non-default truststore

    When SSP is configured to work with an external SAML2.0 IdP, the  
    SAMLAuthnResponse signature verification fails if the trusted chain is not
    in the default truststore.

    Resolution: Now recognize IdP trusted certs from non-default truststores.

  MFT-13050/IT40314 (Engine)    - Log the source IP from HTTP header in INFO
                                  mode instead of DEBUG

    The Customer's load balancer shows that client sessions come from its own 
    address rather than passing on the client's source IP address.  The source
    IP address for HTTP sessions is included in the "X-Forwarded-For" header.

    Resolution: Now log the client IP from the HTTP "X-Forwarded-For" header if
    the HTTP adapter property "use.client.ip.from.forwarded.header" is set to
    true.  In this case, the updated IP address is also logged in INFO mode 
    instead of DEBUG in the HTTP inbound log. Also tracked internally as
    SSP-5776/SSP-5797.

  SSP-5823/         (CM)        - OSA Heartbeat interval is not encoded properly

    The SSP CM HeartBeat Interval value was being sent to IBM Control Center in
    text format instead of numeric. This was flooding the ICC logs with 
    warnings:
      WARN  NodeServiceTableAdapter - Invalid value received for heartbeat 
      interval | 120000 | Error is java.lang.String incompatible with
      java.lang.Number

    Resolution: Corrected the format for the OSA hearbeat interval.

  MFT-13118/        (Engine)    - GPF Connecting to SFTP server with DSA key

    When Customers put on a build of SSP which includes the IBM 8.0.6.30 JRE 
    and they put the IBMJCEPlus provider in front of IBMJCE in the 
    java.security file (as recommended), a General Protection Fault (GPF) can 
    occur during SSH handshaking when connecting to a back end server with a 
    DSA host key instead of an RSA host key.
    HIPER: This is a severe problem which takes the SSP server down.

    Resolution: Now ship with the IBM JRE 8.0.7.5, which resolves the GPF 
    issue.

  SSP-5788/         (Engine,CM) - IBMJCEPlus, IBMJCEPlusFIPS not supported on 
                                  Solaris or HP hybrid JREs

    The 8.0.6.30 JRE introduced the IBMJCEPlus and IBMJCEPlusFIPS providers,
    but they do not exist on the Hybrid JREs, such as for HP and Solaris.

    Resolution: Reworked the code done for FIPS processing in MFT-12495
    which assumed the existence of these new providers for all platforms. 

  MFT-12672/IT40677 (Engine)    - "Exception in PooledScheduler thread" in
                                  perimeter logs

    A message "Exception in PooledScheduler thread" started showing up in the
    perimeter.log file. Determined that it was because of a previous fix which
    attempted to handle connection closes during an HTTP operation. It was 
    getting a NullPointerException and not handling it.
    
    Resolution: Now correctly handle the connection close during an HTTP 
    session so that the exception does not occur.

  MFT-12910/IT40666 (Engine)    - CD adapter gets NPE connecting to Mainframe
                                  Sysplex SNode

    The SSP CD adapter was getting a NullPointerException when connecting to a
    mainframe sysplex SNode, because it incorrectly parsed the redirect host
    and port returned in the FMH70.

    Resolution: Now correctly handle the host and port tokens which are 
    returned from a mainframe sysplex node during the setup of a CD outbound
    session. Use them to redirect the session to the designated node.

  MFT-13010/IT40667 (Engine)    - Failure to notify B2Bi when an AS2 Synch MDN
                                  is not delivered successfully.

    When an SSP HTTP Adapter is used for B2Bi AS2 processing and returning a
    synchronous MDN, a failure on the client side may not be reported to B2Bi.
    If the client closes the connection before the MDN response is sent to it 
    by SSP, B2BI will mark the MDN status as successfully received.

    Resolution: Now look for the new as2.sync.mdn = true property in the SSP 
    HTTP Adapter. If set, detect the failure to deliver the MDN and send a 
    Close with CONNECTION_RESET back to the B2Bi Server. Also log an ERROR 
    message (SSP0560E) and an audit log message (AUD0338E).

  MFT-12972/        (Engine,CM) - Handshake failures with FIPS enabled and
                                  RSASSA-PSS, RSAPSS not disabled
                                  
    Customers with FIPS enabled may get handshake failures when verifying
    key signatures. 

    Resolution: Add an example line in the conf/java.security.override file
    to disable the RSASSA-PSS, RSAPSS algorithms causing the FIPS errors.
    Customers may uncomment the line to disable these algorithms.

  MFT-13191/        (Engine)    - SSP Adapters unresponsive after failover
                                  condition

    With failover properties coded in the adapters, and a back end LDAP failure
    happens, the adapters were not attempting to reconnect with the back end 
    PS, SEAS, and adapters.  The back end monitor stopped checking the outbound 
    nodes when and interruption happened when making a connection.

    Resolution: Catch the InterruptedException when making a connection to the
    outbound node and continue monitoring.

  SSP-5079/ADV0031889 (Engine,CM) - Hostname verification

    Internal scans indicated that SSP should do host name verifications during
    SSL/TLS connections to ensure that the certificate matches the hostname.

    Resolution: By changing the host.name.verification.enabled=false parameter
    to true in the bin/security.properties file, the CM and/or engine will
    do additional hostname checking on the certificate to make sure that it
    matches the hostname of the system it is coming from.
    See the Security Bulletin at https://www.ibm.com/support/pages/node/6586754

  SSP-5765/ (Engine) - Support Implicit SSL for FTP

    Currently SSP FTP supports only explicit SSL. This means clients have to
    send the "AUTH TLS" command before the connection is secured with SSL/TLS.

    Resolution: Now support a new property on the FTP adapter which will
    change that adapter to implicit SSL mode. In the properties tab in the
    FTP adapter, code ftp.implicit.ssl = true, to require FTP clients on that
    adapter to immediately start the TLS handshake with a TLS ClientHello, 
    rather than the "AUTH SSL" or "AUTH TLS" command. The default for the 
    property is false, which continues to do explicit mode.
    Note: Also tracked internally as SSP-5839.

  SSP-5754/ADV0034524 - Oracle Java Jul 2021 CPU
  SSP-5757/ADV0038361 - Oracle Java Oct 2021 CPU
  SSP-5813/ADV0043610 - Oracle Java Jan 2022 CPU

    Resolution: Upgraded the IBM JRE to the 8.0.7.5 level to satisfy the CVEs
    in the quarterly Oracle July 2021, October 2021 and January 2022 CPUs. 
    These are addressed in PSIRT advisories 34524, 38361, and 43610.
    See the Security Bulletin at https://www.ibm.com/support/pages/node/6586758

  MFT-13222/        (Engine)    - Add frame busting javascript

    Resolution: As a further safety measure to our Cross-Frame Scripting and
    X-Frame options, added a frame busting javascript to the
    ./Signon/login.html.

  MFT-13284/IT41286 (CM)        - Invalid POST in CM produces stack trace

    When an invalid URL is passed to SSPCM, it may produce a stack trace back
    to the console.  This should be suppressed.

    Resolution: Now capture/handle the exception thrown when an invalid URL is
    passed to the CM servlet Filter.  Post the exception in the cms.log, but
    not in the CM dashboard.

  MFT-13393/IT41274 (CM)        - Empty SSH keystore causes RESTAPI import
                                  issue
                                  
    Two issues were found when exporting a configuration using the RESTAPI and
    importing it again.   An empty SSH keystore would export okay, but get an
    exception during the subsequent import.  Likewise a PeSit protocol netmap
    with a TLS protocol version of "SSL" would fail on the way in.
    
    Resolution: Corrected the validators on the RESTAPI import to handle an 
    empty SSH keystore and convert "SSL" in a PeSit netmap to "TLSv1".

  MFT-13461/        (CM)        - CM Help button pointing to 3.4.x documentation
  
    The Help button in the SSPCM 6.0.3.0 GUI was pointing to the 3.4.x 
    documentation on IBM's Knowledge Center.
    
    Resolution: Updated the Help button URL to point to the 6.0.3 documentation 
    on IBM's Knowledge Center.

  SSP-5756/ADV0040204 (Engine,PS) - Upgrade all Log4j 1.x to 2.x in Perimeter
                                  Server

    The Perimeter Server code provided by Precisely had a dependency on 
    Log4j 1.x, which has been deprecated.

    Resolution: Use new PS jars from Precisely based on PS_6010200, which
    have been refactored to use the Log4j 2.17.2 jar files. The rest of the 
    product has been upgraded to the Log4j 2.17.2 jars as well. See
    https://www.ibm.com/support/pages/node/6608552 for the Security Bulletin.
    
    ACTION: When updating the SSP Engine to this build, the SSP provided remote
    PS instances should be updated at the same time.  Note: Do not use the
    SSP provided PS install images to update a B2Bi PS.

  SSP-5886/ADV0049489 (Engine,CM) - Upgrade Eclipse Jetty to 9.4.48
  SSP-5944/ADV0059312

    A newer version of the Jetty toolkit is available.

    Resolution: Upgraded the Jetty toolkit to the 9.4.48 level to address
    several vulnerabilities. See
    https://www.ibm.com/support/pages/node/6608556 for the Security Bulletin.

  MFT-13174/        (Engine)    - Intermittent FASP file transfer startup
                                  failure for SSP CD adapter with CDz as SNODE 
                                  and PNODE.

    Customer running multiple concurrent FASP transfers between 2 CD Mainframes
    and 2 SSPs were getting intermittent link failures at session startup. 
    There was a race condition when closing the FASP channel, which could cause
    a subsequent FASP transfer to fail.

    Resolution: Firmed up the code around closing the FASP channel to avoid the 
    race condition.

  MFT-13310/IT41758 (Engine)    - Active SFTP session count on Perimeter server
                                  is increasing when backend rejects connection

    When the SFTP adapter encounters an exception creating a backend session, it
    did not close the session properly and the session count was not decremented,
    causing the session count to keep growing.

    Resolution: Now call disconnect() when the exception happens, which cleans 
    up the session and decrements the session count.

  MFT-13450/IT41740 (CM)        - RESTAPI can import truststore too large for
                                  CM to push to engine
                                  
    The SSPCM RestAPI service was not validating the size of the
    truststore/keystore that was been imported into the CM. It could allow
    a keystore or truststore that was too large to push to an engine.

    Resolution: Added validation to check the size of the keystore/truststore 
    that user attempts to import into the CM via the RESTAPI. Note: The 
    default size limit is 500000 (appx 500k) and can be overridden with a 
    -Dsspcm.input.config.data.size.limit=nnn parm in the startCM.sh startup 
    script.

  MFT-13512/IT41732 (Engine)    - SSP not reducing SFTP session count when a
                                  password change operation stalls
                                  
    The Customer's SFTP adapter was pointing to the back end system which 
    required a change password operation on the first connection, which SSP 
    does not support.  When the operation timed out, the session was closed, 
    but the session count did not getting decremented. Eventually, the max 
    sessions was reached for the SFTP adapter and it had to be restarted.

    Resolution: Now close the SftpSubSys when the SessionChannel is getting 
    closed, which causes the SFTP session count to be decremented.

  MFT-13216/IT41946 (CM)        - Upgrade jQuery, jqModal script packages

    Scan found that the jQuery and jModal scripting modules were outdated and
    needed to be replaced.  They also contained Cross-site scripting (XSS)
    vulnerabilities.

    Resolution: Updated the script packages to jQuery 3.6.0 and jqModal 1.4.2.

  MFT-13592/IT41928 (Engine)    - SFTP sessions disconnected for small files
                                  when using ICAP provider CAS (avscan)

    When using ICAP provider CAS (avscan), SFTP sessions get disconnected for
    small files even though the upload and scan are successful. Certain clients 
    like Filezilla reuse the SSH packet ids immediately after they receive the
    response for a prior request with the same id. SSP did not account for 
    this.
    
    Resolution: Changes were made to account for the packet id reuse by the 
    client within the same session.

  MFT-13461/        (CM)        - Update copyright page pointed to by CM

    The copyright.html page referenced in the CM was still referring to an 
    older version of SSP.

    Resolution: Updated the copyright page with the SSP 6.0.3.0 version.

  MFT-13497/        (Engine)    - SSP failover detection does not check status
                                  of inbound PS configured in adapter.

    The SSP failover manager currently monitors the Perimeter Servers (PS) used
    to connect to the backend server and to SEAS. However, it does not monitor
    the inbound PS for the inbound connections, so if the PS goes down, the 
    adapter's listener is not turned off and its status stays green in the 
    Configuration Manager monitoring screen.

    Resolution: Added support for the Failover Manager to monitor the inbound 
    PS.

  MFT-13539/        (CM)        - Failure on SSL config export after CM upgrade

    A Customer upgraded from a previous release with expired and missing keys 
    in their CM SSL configuration. When running the configureCmSsl tool to 
    export the configuration, the tool got a java.lang.NullPointerException in
    com.sterlingcommerce.security.provider.SspFileUtil.

    Resolution: Now check that valid values are returned from the
    SecureConnectionFactory Module during the export operation.

  MFT-13558/IT42097 (Engine)    - SFTP not presenting CTR ciphers in FIPS mode

    When running in FIPS mode, the SFTP adapter was removing the CTR ciphers 
    from being presented to the remote side.
    
    Resolution: Now allow the aes128ctr, aes192ctr, and aes256ctr ciphers when
    running in FIPS mode.

  MFT-13690/IT42061 (Engine)    - Support for rsa-sha2 host key signatures

    Currently, SSP SFTP adapter only sends ssh-rsa as the host key algorithm 
    supported to the incoming client. Some trading partners have deprecated 
    this algorithm and want to use rsa-sha2-256 and rsa-sha2-512 as well.

    Resolution: Added rsa-sha2-512 and rsa-sha2-256 as additional host key
    algorithms with ssh-rsa and made them preferred in that order.

  SSP-5945          (CM,Engine) - Include iFix, Build, and Platform in SSP
                                  utility messages

    Resolution: Enhancement to include the SSP version, iFix, build, and 
    platform information on CM and engine startup, as well as on most SSP
    utilities.

  MFT-13632/        (Engine)    - Unable to stop Engine with stopEngine.sh

    The Customer is unable to stop the engine with the stopEngine.sh mode=auto 
    command. The sspengine.log shows ERROR Could not connect to Engine. Either 
    Engine is not running or the Engine connection parameters are incorrect.
    ConnectionException: java.net.SocketTimeoutException: connect timed out
    Further testing showed that the Customer's /etc/hosts file had bad 
    information for the local hostname and the engine's configureAccepter.sh
    showed that no hostname was configured. 
    
    Resolution: When no hostname is configured for the engine accepter, plug in
    localhost during the stopEngine command to ensure it can connect to the
    local engine and shut it down.
    Workaround:  ./stopEngine.sh mode=auto host=localhost

  MFT-13707/IT42228 (Engine)    - PSFTP client receiving 11 return code after
                                  successful session

    After SSP6030 Build201, a PSFTP session which successfully logged in and
    transferred files, got a "User Disconnected" type 11 message at logoff.
    The trading partner assumed a session failure and sent the file(s) again
    resulting in duplicate data.

    Resolution: Corrected a timing issue where SSP disconnected the client at
    EOF instead of letting the session close properly.

  MFT-13193/IT42397 (Engine)    - SFTP session on one adapter emits some
                                  messages on other adapter

    Messages early in the life of an SFTP session were ending up in the log of
    the first SFTP adapter to come up, rather than in the adapter log that the
    session    was running on. These early messages are difficult to associate
    with the correct adapter.

    Resolution: Now push the early SFTP messages without a session id to the
    Maverick.log so that they cause less confusion.

  MFT-13609/        (CM)        - SSPCM not initializing OSA interface
                                  consistently at startup

    After starting SSPCM, Control Center does not recognize SSP-OSA until any
    GUI field is updated. The SSPM was not checking whether the OSA had been
    properly initialized, hence publishing to Control Center was not taking
    place.

    Resolution: Now re-initialize the OSA at startup if it cannot be confirmed
    that it is completely initialized.

  MFT-13700/IT42199 (Engine)    - ICAP SFTP to reject upload when maximum
                                  allowed file/request size is exceeded

    By default, SSO skips the ICAP virus scan if the file size being uploaded
    exceeds a specified limit. It uploads it with an extension of 'unscanned'.
    However, the Customer does not want any file to be uploaded if it has not
    been scanned.

    Resolution: Added a property in the ICAP Configuration screen
    "sftp.reject.upload.files.larger.than.limit" when set to true will not
    upload the file to backend server in the scenario mentioned above.

  SSP-5967/         (Engine,CM) - Old uninstaller scripts not deleted during
                                  upgrade.

    Old uninstaller scripts in tne UninstallerData directory were not being
    deleted during the SSP upgrade.

    Resolution. Corrected faulty logic in the InstallAnywhere directives to
    delete old uninstall scripts.

  MFT-13463/        (Engine)    - Native memory leak in IBMJCEPlus provider

    SFTP Customers were reporting a native memory leak.  Over days or weeks
    their memory usge showed to be using a larger percentage of the system
    native memory.  Running with the IBMJCE provider ahead of the IBMJCEPlus
    provider in the jre/lib/security/java.security file provided some mild
    relief.

    Resolution: The IBM Java team found a memory leak in the IBMJCEPlus
    provider and provided the 8.0.7.16 JRE with the IJ44040 fix applied.

  MFT-13737/        (Engine)    - HSM manageCSR -update unable to add
                                  certificate from CA
  
    SSP Customer using an HSM device with FIPS turned on were unable to 
    successfully use the GenerateCSR operation to create a certificate keypair.

    Resolution: The IBM Java team updated the temporary signing operation
    done during keypair generation in the IBMPKCS11 HSM code to utilize
    SHA256withRSA. They provided the 8.0.7.16 JRE with the IJ44075 fix applied.

  MFT-13768/        (Engine)    - SFTP support for hmac-sha2-256 in FIPS mode
  
    When the SSP Engine is configured in FIPS mode, the hmac-sha2-256 is not
    available for use in SFTP session handshaking.
    
    Resolution: Now allow hmac-sha2-256 when in FIPS mode for SFTP sessions.

  SSP-5882/         (CM,Engine) - ADV0054062 – Insecure TLS/SSL in use
  
    Resolution: Moved TLS ciphers which use SHA1 or CBC out of the default
    selected ciphers list for FTP, CD, and HTTP adapters and for traffic 
    between the CM and the engine. Internal  CVE-2022-34361 created.  See
    https://www.ibm.com/support/pages/node/6844763 for the Security Bulletin.


  SSP-5978/         (CM,Engine) - ADV0034524 - Oracle Deferred CVE from Java 
                                  Apr 2021 CPU
  
    When JAR files signed with SHA-1 are disallowed (now the default behavior), 
    they may not be rejected in some circumstances.  (CVE-2021-2163)

    Resolution: The fix ensures that JAR files signed with SHA-1 are always 
    rejected when SHA-1 is disabled via the jdk.security.legacyAlgorithms 
    security property.   This iFix delivers IBM JRE 8.0.7.16.  See
    https://www.ibm.com/support/pages/node/6844763 for the Security Bulletin.

  MFT-13707/        (Engine)    - SFTP session count increasing after applying
                                  fix for MFT-13707 (see MFT-13512)
                                  
    Customer applied the fix for MFT-13707 to resolve the PSFTP client getting
    a return code 11 after a successful session.  However, it caused the 
    session creep issue (MFT-13512) to come back.
    
    Resolution: Corrected the fix to handle both issues at session shutdown.

  MFT-13751/        (Engine)    - PEN-Test Security Findings

    Customer's PEN testing found 4 issues:
    i) HTTP client able to enumerate error messages using the ID (parameter c)
    ii) Do not use the query param values from the client request
    iii) Validate path part of the URL before redirecting
    iv) Modification log from login.js java script shows up in the browser.
    
    Resolution: Made the following changes to address the issues:
    i & ii) Store the error code in SspWebSession and use that value
    iii) Canonicalize the URI path and create a URI with the path string.
    iv) Removed the modification log from login.js java script

  MFT-13798/        (CM,Engine) - Arrange default ciphers in security order for
                                  TLSv1.2

    Customer's security team found SSP was subject to ROBOT vulnerabilities
    because they still included TLS_RSA cipher suites in the default list of
    ciphers.
    
    Resolution: Now put TLS_ECDHE_ECDSA_* and TLS_ECDHE_RSA_* first in the
    default list of ciphers. Customers who want to remove the TLS_RSA_* ciphers
    from the end of the list can do so.

  MFT-13804/        (Engine)    - ICAP config fails to add extension to 
                                  unscanned files

    Customer found that while "Apply extension to unscanned files" was checked,
    their unscanned files were not being uploaded with the ".unscanned" suffix.
    
    Resolution: Now ensure that files which are not scanned for viruses get the
    ".unscanned" extension.

  MFT-13897/        (Engine)    - Error during myFileGateway 2.0 logout when
                                  keycert from a non-default keystore

    Logout Requests to IdP get signed by the keycert specified in the SSO 
    configuration. When a keycert is selected from a non default keystore the 
    signing fails because it cannot find the keycert. Keycerts stored in a
    non-default keystore have a prefix of "<keystore name>:".

    Resolution:  Added logic to account for the difference between the naming
    convention of keycerts in default and non-default keystores.

  SSP-5643/         (CM)        - Misleading error messages when bypassing host
                                  header verification.
                                  
    If cm.bypass.host.header.check=true and skip.local.hostnames.lookup=true 
    are specified in the cmconfig.properties files, ERROR messages are produced
    at startup, even though it is not an error condition.
      INFO  Main - CM Alternate Hosts: []
      ERROR Main - Not looking up local hostnames for host header validation
      ERROR Main - Error - The list of allowed hostnames in host headers is empty. 
      
    Resolution: Changed these ERROR messages to WARN.

  SSP-6003/         (CM)        - List of ciphers for TLSv1.2 different if
                                  engine installed before CM

    On a new install, if the engine is installed before the CM and the keycert
    is imported into the CM, weaker CBC ciphers are also imported to the CM as
    defaults.
    
    Resolution: Now remove the weak CBC ciphers from the engine default list so 
    that they are shared as defaults with the CM.

  SSP-4128/         (Engine)    - Change error message at SFTP logoff time to
                                  warn

    During our internal load testing, we found an error message issued
    thousands of times.
      "logUserOff() - System error - SftpAccessInstance is missing"
    This is a timing issue at logoff time which is not really an error.

    Resolution: Changed the message to WARN to keep the logs from growing in
    ERROR mode.

  SSP-4136/         (CM,Engine) - manageKeycert getting Unsupported password-
                                  based encryption algorithm

    Internal testing revealed that the manageKeyCerts -export command was 
    unable to export a cert from the CM in PEM format nor to import a pkcs12
    exported cert into the engine.

    Resolution: Updated the manageKeyCerts tool to use newer ciphers for 
    encrypting and decrypting during export and import. New cipher is
    "PBEWithHmacSHA512AndAES_256" and also added backward compatibility code 
    for legacy "PBEWithSHAAnd3KeyTripleDES".

  SSP-5883/ADV0054861 (CM,Engine) - Container: Make CM Host header checking
                                    true by default

    Currently SSP CM has an option to do Host hedaer checking. In containers, 
    this is not true by default.

    Resolution: Now enable host name verification during container deployment.
    Action: Update the hostNameVerification and hostNames values in the
    values.yaml file to suit your configuration. This is CVE-2022-34362. For
    the security bulletin, see https://www.ibm.com/support/pages/node/6890663.

  SSP-5905/ADV0054854 (CM,Engine) - Generate unique vector during install to
                                    use for encryption
                                    
    Internal scans showed that the Initialization Vector (IV) used to seed
    encryption operations in the product was the same for all installations.
    
    Resolution: For new installs only (not upgrades), generate a unique IV for
    that installation and save it in the ./conf/system/iv.enc file. This is
    CVE-2022-35720. See https://www.ibm.com/support/pages/node/6890663 for the 
    security bulletin.

  SSP-5971/         (CM)        - Saving ICAP configuration fails if certain
                                  property not included

    When saving the ICAP configuration tab in the SSPCM GUI, an alert is issued
    if the icap.http.unscanned.header.value is not specified as true or false.

    Resolution: Now set the default for the icap.http.unscanned.header.value to
    true so that the admin can save the GUI without the property being required.

  SSP-6022/ADV0043524 (CM/Engine) - Upgrade Apache Xerces to xerces-2.12.0

    Internal scans showed that a denial of service CVE (CVE-2022-23437) had 
    been raised against the version of Apache Xerces shipped with SSP. We are
    proactively upgrading the toolkit to satisfy Customer scans.
    
    Resolution: Upgraded the Apache Xerces toolkit to xerces-2.12.0.  See
    https://www.ibm.com/support/pages/node/6890663 for the security bulletin.

  SSP-6024/ADV0069566 (CM/Engine) - Upgrade IBM Websphere MQ Client to 9.3.02
  
    Internal scans showed that a denial of service CVE (CVE-2022-31772) had
    been raised against the version of IBM Websphere MQ Client shipped with 
    SSP. We are proactively upgrading the toolkit to satisfy Customer scans.
    
    Resolution: Upgraded the IBM Websphere MQ Client toolkit to 9.3.02.  See
    https://www.ibm.com/support/pages/node/6890663 for the security bulletin.

  MFT-13463/        (Engine)    - Memory leak when sessions close and go stale

    Customer found that their perimeter server MemoryManager was reporting high 
    memory usage (gmm.allocation) and their os top command was reporting high
    native menory growth.
    
    Resolution: In addition to the JRE 8.0.7.16 which resolved some native 
    memory leaks in the IBMJCEPlus security provider, we now ship with a new
    default of  physicalConnMgr.killStale_CLOSE_WAIT=true  in the 
    <engine>/bin/perimeter.properties file.  

  MFT-14071/        (CM)        - Maximum file size in SSP ICAP configuration 
                                  only allows 1GB
                                  
    Customer testing with ICAP virus scanning needs the ability to scan files
    larger than 1 GB.
    
    Resolution:  Raised the maximum byte count for ICAP scanning to 10 GB.

  SEAS-2942/        - Add support for installing on Windows 2019

    Resolution: Upgraded to build with InstallAnywhere 2021 SP2, which adds
    support for Windows 2019.

  SSP-6116/         (CM,Engine) - Increase internal encryption key length to
                                  256 bits

    Resolution: Increased the length of the internal encryption key from 128
    to 256 bits to make it more computationally intensive.

  SSP-6217/         (CM,Engine) - Drop old duplcate jars from build process

    Resolution: Streamlined the checkout process to eliminate old duplicate
    jar files from shipping.

  SSP-6221/         (CM,Engine) - Upgrade cipher used for encrypting the 
                                  configuration files

    Resolution: For new installs, change the encryption used for storing
    configuration files. Change to use PBEWithHmacsSHA512And256BitAES and 
    "AES/GCM/PKCS5Padding" for the encryption algorithm and use a 256-bit key.
    Also added backward compatibility code.

  SSP-5768/         (CM,Engine) - Max allowed ICAP request size less than shown

    Customer attempting to scan files up to 10 GB through ICAP could not get
    beyond file sizes of 1.6GB or so.

    Resolution: Changed an Integer field to a Long to allow for larger file
    sizes.

  SSP-5834/         (CM)        - Remove CM failover.log and sspengine.log

    Resolution: Remove the failover.log and sspengine.log from being created on
    the CM, as they are only supposed to be written by the engine.

  SSP-6141/         (CM)        - Do not require trust store and Idp trust cert
                                  in SSP Internal Portal Authentication.
                                  
    When creating an SSO configuration in the SSPCM, and specifying an SSP  
    Internal Portal in the Logon Portal tab, the GUI is requiring a trust store 
    and cert be filled out from the External Portal section.
    
    Resolution: No longer require a trust store and cert be entered when 
    creating an SSP Internal Portal SSO configuration.

  MFT-14157/        (Engine)    - CD adapter getting CSP021I 0 Configuration
                                  parameter not set error msg
                                  
    Receiving following error in secureproxy.log after starting up Secure Proxy:
      ERROR [PASLISTENER1364] sys.ADAPTER.dev-cd - cd CSP021I 0 Configuration 
      parameter not set. Parameter,default=snode.address,127.0.0.1;1364
      
    Resolution: Changed the message to INFO instead of ERROR, since it is not
    an error condition at startup.

  MFT-14160/        (Engine)    - User lockout duration extends with each
                                  subsequent authentication failure
                                  
    When an SFTP user fails to authenticate 3 times in a row, they are locked
    out for a duration of time set in the CM->Credentials->User Stores, default
    300 seconds. However, if the user connects within that 300 seconds, the
    login is rejected (without trying to authenticate) and the lockout is reset
    for another 300 seconds.  The Customer was having to stop and restart the
    engine to unlock the user so they could login again.

    Resolution: Now continue to reject locked out users, but no longer reset 
    the duration when a user connects again, but ignore theduring the lockout.

  MFT-14090/IT43587 (Engine)    - ICAP getting SFTP errors during multi-GB 
                                  transfers

    When transferring large files (above 7 GB) and the file size is greater
    than the ICAP scan limit, can get OutOfMemory (OOM) errors.

    Resolution: Now wait for more space in the cache when the ICAP limit has
    been reached. Also refactored the request ids used on the back end and
    changed some synchronization logic to avoid deadlocks.

  MFT-14233/IT43588 (Engine)    - SFTP clients fail when ICAP is enabled.
  
    Certain SFTP clients complained that the SSH_FXP_STATUS message received 
    was bad.
    
    Resolution: Changed the Language string in the SSH_FXP_STATUS message
    being sent back to the client to "en" (English) instead of null.

  MFT-14240/IT43590 (CM,Engine) - ICAP response timeout updated to 1800 secs
  
    The ICAP response timeout was limited to 600 secs which is 10 mins.
    
    Resolution: Raised the ICAP timeout limit to 1800 seconds (30 min).

  SSP-5458/         (CM)        - Warning on certificate expiration in CM
  
    Resolution: Added a warning message at CM startup when it has certificates
    which have expired or will expire within 6 months:
    
      WARN Main - Certificate has expired or will expire within 6 months:
        Cert name: <cert name> Cert store: dfltCMKeystore
        Expires on: Thu Apr 06 14:15:16 CDT 2023

  SSP-5991/ADV0070229 (CM,Engine) - IBM Java CPU Oct2022 CVE-2022-21628 
                                  - CVSS 5.3
  SSP-6020/ADV0070230 (CM,Engine) - IBM Java OpenJ9 - CVE-2022-3676 - CVSS 6.5
  SSP-6256/ADV0077814 (CM,Engine) - IBM Java CPU Jan2023 CVE-2023-21830
                                  - CVSS 5.3
  SSP-6257/ADV0081465 (CM,Engine) - IBM Java XML vulnerability deferred from
                                    Oracle Apr 2022 CPU CVE-2022-21426 
                                  - CVSS 5.3

    Resolution: Upgraded the IBM JRE to the 8.0.8.0 level to satisfy the CVEs
    in the quarterly Oracle October 2022 and January 2023 CPUs.
    See the Security Bulletin at https://www.ibm.com/support/pages/node/6987143.
    This version of the JRE has all known fixes for native memory OutOfMemory
    (OOM) issues in the IBMJCEPlus security provider.
		
  SSP-6394         - Error found in startEngine.out in SSP 6030
  
    Invalid system passPhrase results in nullpointer exception (NPE)
	during expire keycertificate check during SSP Engine and CM 
	startup
  
    Resolution: Checked the system passphrase for nullPointer
    
  MFT-14090/        - ICAP getting SFTP errors during multi-GB transfers
      
    When transferring large files (close to 10 GB (or even 7 GB )
	and the file size is greater than the ICAP scan limit, an  
	Out Of Memory(OOM) error occurs, even if accounted for the max ICAP 
	size limit to be cached.
  
    Resolution: Made code change to wait for more space in the cache once 
	the ICAP scan limit is reached, to add additional buffers from the 
	client. More space will be available as a thread
    is started to send cached buffers to the backend SFTP server.
  
  MFT-14294/IT43664 - ListCmCerts.sh ExpireDays was not listing expiring
                      certificate correctly
      
    Resolution: Added logic to properly display expiring certtificates in SSP 
    Keystores 	
					  
  MFT-14336/IT43709 - sshj SFTP client's sessions not getting clean disconnect 
                      after SSP upgrade
  
    When the client is closing the sftp channel, SSP was closing everything 
	on its side . It was disconnecting the ssh connection before closing the 
	channel.
  
    Resolution: Changed the order on SSP side to close the sftp channel and 
	then disconnect the ssh connection. Still this jssh sample client is 
	throwing stacktrace. Created a 	system property "sftp.channel.disconnect", 
	when set to false, will bypass this disconnect (the default value is true).
	With this change the sshj client is terminates the connection correctly.					  
					  
  MFT-14440/IT43993 - Files not being scanned when using myFileGateway 2.0 with
                      ICAP enabled on adapter
  
    There is a mix up of log message ids. This is preventing the audit log message
	to be logged correctly for the Myfilegateway ICAP scan of file uploaded.
  
    Resolution: Corrected the affacted message ids and their respective
	messages. 
			
  MFT-14488/IT43986   - ICAP - How to Get Rid of ".unscanned" Extension
  
	Currently we skip scan if the file is larger than the scan limit and add 
	the 'unscanned' extension to the uploaded file even if the "Apply 
	extension to unscanned files" check box is unchecked.
  
	Resolution: Added changes to NOT add the ‘unscanned’ extension to the 
	file name if the "Apply extension to unscanned files" check box is unchecked.
  
  SSP-6105          - Support for SSH Key Signature Verification.
    
    SSP doesn't currently have support for SSH Key Signature Verification
	via SEAS custom exit.
  
    Resolution: Add support for SSH Key signature verification
	via SEAS custom exit.
  
  SSP-6224         - Update Apache Commons FileUpload to version 1.5
    
    Apache Commons FileUpload and Tomcat are vulnerable to a denial of 
	service, caused by not limit the number of request parts to be processed
	in the file upload function. By sending a specially-crafted request with 
	series of uploads, a remote attacker could exploit this vulnerability 
	to cause a denial of service condition.
  
    Resolution: Update Apache Commons FileUpload to version 1.5 
  
  SSP-6343         - Upgrade Maverick version to 1.7.50
    
    Updated Maverick to latest 1.7.50 version as on going 
	maintenance and SSH Key signature 	verification requires 
	this particular version.
  
    Resolution: Changes are made in SSP to provide additional data 
	collected during key authentication in the SEAS key authentication 
	request. This will be made available to key authentication custom exit in SEAS.
	
	
  MFT-14317/        (Engine)        - Common Name Check failure
  
	Common name check validation was using BufferedInputStream, which was 
	causing IO Exception.
  
	Resolution: Instead of using BufferedInputStream, we have updated to 
	            ByteArrayInputStream  
  
  MFT-14388/          (CM)          - Updated maximumContentSize default value
  
    Maximum form content length value was picking from start.sh file.
	
	Resolution: Changed to use value specified in CM GUI SystemSettings's 
	            SysGlobals Maximum form content length
  
  MFT-14564/IT44318   (Engine)      - disable client initiated SSL 
                           renegotiation 
                                      on SSP HTTPS adapter
									  
    It was discovered that SSP allows SSL renegotiation to HTTP adapters.	

    Resolution:	 Logic has now been added to the Java system properties 
	to disable the SSL renegotiation from the client itself.
									  
  SSP-6351/ADV0083078 (CM)          - Updated jettison version to 1.5.4
  
    Multiple vulnerabilities affect Codehaus Jettison older version
	
	Resolution: Upgraded version of jettison to 1.5.4
  
  SSP-6354/ADV0083298 (CM)          - Updated jersey jar
  
    SSP 6030 Blackduck scan jersey 1.16 was vulnerable.

	Resolution: Updated jersey version to 1.19.4
  
  SSP-6354/ADV0083298 (CM)          - Update jersey jar
  
    SSP 6030 Blackduck scan jersey 1.16 was vulnerable.
	
	Resolution: Updated jersey version to 1.19.4
	
  SSP-6407/ADV0084858 (CM)          - Updated IBM mq client version to 9.3.0.5
  
    IBM MQ Clients are vulnerable to a denial of service attack when processing 
	configuration files. Since we're using IBM MQ client 9.3.0.2, we need to 
	upgrade it.
	
	Resolution: Upgraded version of IBM MQ Client to 9.3.0.5
	
	
  SSP-6626/ADV0088146 (CM, Engine)  - IBM Apr 2023 Java CPU
	
	IBM JRE must be updated to 8.0.8.5 version Jetty
	
	Resolution: Upgraded JRE to 8.0.8.5
	
	
  MFT-14726/IT44389    (CM)         - Rest API failing for POST Add KeyDef Entry
  
    Earlier Xml's character length was checking with hard coded value
  
    Resolution: Removed hard-coded check for (MAXIMUM_FORM_CONTENT_SIZE) and 
    use dynamic check which was already available in the system
  
  SSP-6601/           (CM)             - Extra property values were being added  
                                     to the security properties file  during 
									 disable/enable bootstrap operation
									 
    Extra property values were being added to the security.properties file 
	during disable/enabled bootstrap operation
	
	Added fix to replace "bootstrap.passphrase" property value only
	
  
	
  MFT-14663/IT4442     (Engine)     - Some SFTP user sessions do not disconnect
                                      gracefully
									  
	When the client is closing the sftp channel, SSP was closing everything on
	its side. It was disconnecting the ssh connection before closing the 
	channe1
	
	Resolution: Tweaked the place where channel is closed. Made changes to 
	close the channel in onChannelClose() method instead of onChannelClosing()
	method.
	
  MFT-14884/IT44648    (Engine)     - Some SFTP clients are reporting error on file
                                  uploads when ICAP is on
								  
	SSP uses an Async task to send all the cached data buffers to backend, 
	after ICAP virus scanning is successful. This Async task uses ForkJoin 
	Common thread pool. In some cases this thread is not executing.
	
	Resolution:  Changed code to use a separate thread pool for the above
                Async task.
				
  MFT-14916/IT44718    (CM)         - SSP CM is not enforcing HSTS header for 
                                      non 2XX response with curl
	Description: Jetty webserver is not enforcing HSTS, as defined by RFC
	6797
	
	Resolution: Added logic in SSP CM to return HSTS header when configured
    in SSP CM Security header properties panel.	
	
  MFT-14904/           (CM)         - SSP not sending the X-Forwarded-Host header 
                                      causing failure in PEM component.
									  
	Description: When matching Host Header value with valid HostIp value
    specified as the adapter property, SSP is doing DNS look up and this
	can result in error if there is no DNS service in DMZ. This is causing
  	X-Forwarded-Host header not getting set when sending the request to PEM.
	
	Resolution: Made two changes. 1. Changed code so no DNS look up happens and 
	compare the host or IP name as is. 2. Allow for multiple Host names 
	(comma separated) to be specified for the property "proxy.host.name.or.ip".
    However, this requires a change in validation to allow for multple values.
	This will be fixed under a different internal defect.

  MFT-14885/IT44737    (Engine)     - SSP not encoding URLs correctly while 
                                      sending back to b2bi
    Description: Root Cause Analysis: HTTP Adapter is not sending the same url
	it received from client to backend B2Bi, when there are special 
	characters in url. The URL in the HTTP request being sent to backend is not
	getting encoded correctly.
	
	Resolution: Made a change to encode correctly
	
  
  MFT-14706            (CM, Engine) - Password with Danish Character is not 
                                      working when use is logging into SSP's
 									  HTTP-SSO page
    Description: Password with Danish Character is not working when use is 
	logging into SSP's HTTP-SSO pag
	
	Resolution: Added logic for partial fix by using UTF-A encoding
  
  MFT-14926            (Engine)     - Added USCF keyword to FM70.xsd
    
	Description: KQV keyword "USCF" found in FM70, but not defined in XML 
	schema definition
	
	Resolution: Added USCF entry into FM70.xsd