Fix (APAR):  PH43113

Status:  Fix

Release:  8.5.5.21,8.5.5.20

Operating System:  AIX,HP-UX,IBM i,Linux,Solaris,Windows,z/OS

Supersedes Fixes:  

CMVC Defect:  xxxxxx

Byte size of APAR:  260626

Date: 2022-02-28

Abstract:  java.lang.ClassNotFoundException for                            SecureSerializedViewCollection during Session Persistence

Description/symptom of problem:  
PH43113 resolves the following problem:

ERROR DESCRIPTION:
The application can fail with the following exception:          
java.lang.ClassNotFoundException: org.apache.myfaces.applicatio 
n.viewstate.SecureSerializedViewCollection                      

LOCAL FIX:
N/A                                                             

PROBLEM SUMMARY:

USERS AFFECTED:
 Users of JSF with either PH34711 or
PH36923 applied on IBM WebSphere
Application Server versions
8.5.5.5-8.5.5.21 and 8.0.0.15.
Users of JSF-2.0 on WebSphere Liberty
versions 21.0.0.2 - 22.0.0.2.
Note: IBM WebSphere Application Server
version 9.0 is unaffected by this error.

PROBLEM DESCRIPTION:
java.lang.ClassNotFoundException:
org.apache.myfaces.application.viewstat
e.SecureSerializedViewCollection
occurs with session persistence

RECOMMENDATION:
None

Following PH34711 and PH36923 for jsf-2.0, an export was
missed, which will cause a ClassNotFoundException if session
persistence is enabled. Both database and memory-to-memory
persistence are affected. This exception is encountered during
session deserialization as the class is looked up.  The
resulting stack trace will look similar to:
Websphere:
java.lang.ClassNotFoundException:
org.apache.myfaces.application.viewstate.SecureSerializedViewCol
lection at java.lang.Class.forNameImpl(Native Method) at
java.lang.Class.forName(Class.java:333) at
com.ibm.ws.util.WsObjectInputStream.loadClass(WsObjectInputStrea
m.java:229) at
...
at
java.io.ObjectInputStream.readObject(ObjectInputStream.java:517)
at
com.ibm.ws.session.utils.SessionLoader$1.run(SessionLoader.java:
112) at
java.security.AccessController.doPrivileged(AccessController.jav
a:738) at
com.ibm.ws.session.utils.SessionLoader.loadObject(SessionLoader.
java:106)
Liberty:
SESN0051E: An attempt to deserialize a session object from the
backend has resulted in a ClassNotFoundException
Exception is:java.lang.ClassNotFoundException:
org.apache.myfaces.application.viewstate.SecureSerializedViewCol
lection    at
...
java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:522)
at
com.ibm.ws.serialization.DeserializationObjectInputStream.loadCl
ass(DeserializationObjectInputStream.java:62)    at
com.ibm.ws.serialization.internal.DeserializationObjectInputStre
amImpl.loadClass(DeserializationObjectInputStreamImpl.java:48)
at
com.ibm.ws.serialization.DeserializationObjectInputStream.resolv
eClass(DeserializationObjectInputStream.java:133)    at
com.ibm.ws.serialization.DeserializationObjectInputStream.resolv
eClass(DeserializationObjectInputStream.java:171)   ...
com.ibm.ws.session.utils.SessionLoader.loadObject(SessionLoader.
java:62)    at
com.ibm.ws.session.store.db.DatabaseHashMap.getValue(DatabaseHas
hMap.java:1613)    at
com.ibm.ws.session.store.db.DatabaseSession.getSingleRowAppData(
DatabaseSession.java:168)    at
com.ibm.ws.session.store.db.DatabaseSession.getSwappableData(Dat
abaseSession.java:81)

PROBLEM CONCLUSION:
JSF was updated to avoid this ClassNotFoundException. The fix   
for this APAR is targeted for inclusion in fix packs 8.5.5.22   
and Liberty 22.0.0.3.                                           
                                                                
For more information, see 'Recommended Updates for              
WebSphere Application Server':                                  
https://www.ibm.com/support/pages/node/715553                   


Directions to apply fix:  
NOTE: Mark with an X the:
1) Release the fix applies to
2) The Editions that apply
3) And then DELETE THIS NOTE

Fix applies to Editions:
Release 8.5
X Application Server (Express or BASE)
__ Network Deployment (ND)
__ Liberty Core
X Edge Components
X Developer

Install Fix to all WebSphere installations unless special instructions are included below.

Special Instructions: None

NOTE:
The user must:
* Logged in with the same authority level when unpacking a fix, fix pack or refresh pack.
* Be at V1.4.3 or newer of the Installation Manager. Certain iFixes may require a newer version of the Installation Manager and the Installation Manager will inform you during the installation process if a newer version is required.

The IBM Knowledge Center can provide details, if needed, on the use of the Installation Manager to apply the iFixes.
http://publib.boulder.ibm.com/infocenter/install/v1r4/index.jsp.  Shutdown WebSphere Application Server before applying the iFixes.  Restart WebSphere Application Server after applying the iFixes.



Directions to remove fix:  

The IBM Knowledge Center can provide details, if needed, on the use of the Installation Manager to remove the iFixes.
http://publib.boulder.ibm.com/infocenter/install/v1r4/index.jsp.  Shutdown WebSphere Application Server before removing the iFixes.  Restart WebSphere Application Server after removing the iFixes.



Directions to re-apply fix:  
1) Shutdown WebSphere Application Server.

2) Follow the Fix instructions to apply the fix.

3) Restart WebSphere Application Server.





Additional Information: