Fix (APAR):  PH43113

Status:  Fix

Release:  21.0.0.9,21.0.0.5,21.0.0.4,21.0.0.3

Operating System:  AIX,IBM i,Linux,OS X,Windows,z/OS

Supersedes Fixes:  PH34711,PH36923

CMVC Defect:  xxxxxx

Byte size of APAR:  19238567

Date: 2022-03-11

Abstract:  java.lang.ClassNotFoundException for                            SecureSerializedViewCollection during Session Persistence

Description/symptom of problem:  
PH43113 resolves the following problem:

ERROR DESCRIPTION:
The application can fail with the following exception:          
java.lang.ClassNotFoundException: org.apache.myfaces.applicatio 
n.viewstate.SecureSerializedViewCollection                      

LOCAL FIX:
N/A                                                             

PROBLEM SUMMARY:

USERS AFFECTED:
 Users of JSF with either PH34711 or
PH36923 applied on IBM WebSphere
Application Server versions
8.5.5.5-8.5.5.21 and 8.0.0.15.
Users of the jsf-2.0 feature on WebSphere
Liberty 21.0.0.4 through 22.0.0.2.
Users of the jsf-2.0 feature on WebSphere
Liberty with either PH34711 or PH36923
applied.
Note: IBM WebSphere Application Server
version 9.0 is unaffected by this error.

PROBLEM DESCRIPTION:
java.lang.ClassNotFoundException:
org.apache.myfaces.application.viewstat
e.SecureSerializedViewCollection
occurs with session persistence

RECOMMENDATION:
None

Following PH34711 and PH36923 for jsf-2.0, an export was
missed, which will cause a ClassNotFoundException if session
persistence is enabled. Both database and memory-to-memory
persistence are affected. This exception is encountered during
session deserialization as the class is looked up.  The
resulting stack trace will look similar to:
Websphere:
java.lang.ClassNotFoundException:
org.apache.myfaces.application.viewstate.SecureSerializedViewCol
lection at java.lang.Class.forNameImpl(Native Method) at
java.lang.Class.forName(Class.java:333) at
com.ibm.ws.util.WsObjectInputStream.loadClass(WsObjectInputStrea
m.java:229) at
...
at
java.io.ObjectInputStream.readObject(ObjectInputStream.java:517)
at
com.ibm.ws.session.utils.SessionLoader$1.run(SessionLoader.java:
112) at
java.security.AccessController.doPrivileged(AccessController.jav
a:738) at
com.ibm.ws.session.utils.SessionLoader.loadObject(SessionLoader.
java:106)
Liberty:
SESN0051E: An attempt to deserialize a session object from the
backend has resulted in a ClassNotFoundException
Exception is:java.lang.ClassNotFoundException:
org.apache.myfaces.application.viewstate.SecureSerializedViewCol
lection    at
...
java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:522)
at
com.ibm.ws.serialization.DeserializationObjectInputStream.loadCl
ass(DeserializationObjectInputStream.java:62)    at
com.ibm.ws.serialization.internal.DeserializationObjectInputStre
amImpl.loadClass(DeserializationObjectInputStreamImpl.java:48)
at
com.ibm.ws.serialization.DeserializationObjectInputStream.resolv
eClass(DeserializationObjectInputStream.java:133)    at
com.ibm.ws.serialization.DeserializationObjectInputStream.resolv
eClass(DeserializationObjectInputStream.java:171)   ...
com.ibm.ws.session.utils.SessionLoader.loadObject(SessionLoader.
java:62)    at
com.ibm.ws.session.store.db.DatabaseHashMap.getValue(DatabaseHas
hMap.java:1613)    at
com.ibm.ws.session.store.db.DatabaseSession.getSingleRowAppData(
DatabaseSession.java:168)    at
com.ibm.ws.session.store.db.DatabaseSession.getSwappableData(Dat
abaseSession.java:81)

PROBLEM CONCLUSION:
JSF was updated to avoid this ClassNotFoundException. The fix   
for this APAR is targeted for inclusion in fix packs 8.5.5.22   
and Liberty 22.0.0.3.                                           
                                                                
For more information, see 'Recommended Updates for              
WebSphere Application Server':                                  
https://www.ibm.com/support/pages/node/715553                   


Directions to apply fix:  
Install Fix to all WebSphere installations unless special instructions are included below.

Special Instructions: None

NOTE:
The user must:
* Logged in with the same authority level when unpacking a fix, fix pack or refresh pack.
* Be at V1.9.0 or newer of the Installation Manager. Certain iFixes may require a newer version of the Installation Manager and the Installation Manager will inform you during the installation process if a newer version is required.

The IBM Information Center can provide details, if needed, on the use of the Installation Manager to apply the iFixes.
http://www.ibm.com/support/knowledgecenter/SSDV2W_1.8.5/com.ibm.cic.agent.ui.doc/helpindex_imic.html. Shutdown WebSphere Application Server Liberty before applying the iFixes. Restart WebSphere Application Server Liberty after applying the iFixes.

Directions to remove fix:  

The IBM Information Center can provide details, if needed, on the use of the Installation Manager to remove the iFixes.
http://www.ibm.com/support/knowledgecenter/SSDV2W_1.8.5/com.ibm.cic.agent.ui.doc/helpindex_imic.html. Shutdown WebSphere Application Server Liberty before removing the iFixes. Restart WebSphere Application Server Liberty after removing the iFixes.

Directions to re-apply fix:  
1) Shutdown WebSphere Application Server Liberty.

2) Follow the Fix instructions to apply the fix.

3) Restart WebSphere Application Server Liberty.



Additional Information: