Fix (APAR):  PH43113

Status:  Fix

Release:  21.0.0.9

Operating System:  AIX,HP-UX,IBM i,Linux,OS X,Solaris,Windows,z/OS

Supersedes Fixes:  PH36923

CMVC Defect:  

Byte size of APAR:  3440684

Date: 2022-02-21

Abstract:  java.lang.ClassNotFoundException for                            SecureSerializedViewCollection during Session Persistence

Description/symptom of problem:  
PH43113 resolves the following problem:

ERROR DESCRIPTION:
The application can fail with the following exception:          
java.lang.ClassNotFoundException: org.apache.myfaces.applicatio 
n.viewstate.SecureSerializedViewCollection                      

LOCAL FIX:
N/A                                                             

PROBLEM SUMMARY:

USERS AFFECTED:
 Users of JSF with either PH34711 or
PH36923 applied on IBM WebSphere
Application Server versions
8.5.5.5-8.5.5.21 and 8.0.0.15.
Users of JSF-2.0 on WebSphere Liberty
versions 21.0.0.2 - 22.0.0.2.
Note: IBM WebSphere Application Server
version 9.0 is unaffected by this error.

PROBLEM DESCRIPTION:
java.lang.ClassNotFoundException:
org.apache.myfaces.application.viewstat
e.SecureSerializedViewCollection
occurs with session persistence

RECOMMENDATION:
None

Following PH34711 and PH36923 for jsf-2.0, an export was
missed, which will cause a ClassNotFoundException if session
persistence is enabled. Both database and memory-to-memory
persistence are affected. This exception is encountered during
session deserialization as the class is looked up.  The
resulting stack trace will look similar to:
Websphere:
java.lang.ClassNotFoundException:
org.apache.myfaces.application.viewstate.SecureSerializedViewCol
lection at java.lang.Class.forNameImpl(Native Method) at
java.lang.Class.forName(Class.java:333) at
com.ibm.ws.util.WsObjectInputStream.loadClass(WsObjectInputStrea
m.java:229) at
...
at
java.io.ObjectInputStream.readObject(ObjectInputStream.java:517)
at
com.ibm.ws.session.utils.SessionLoader$1.run(SessionLoader.java:
112) at
java.security.AccessController.doPrivileged(AccessController.jav
a:738) at
com.ibm.ws.session.utils.SessionLoader.loadObject(SessionLoader.
java:106)
Liberty:
SESN0051E: An attempt to deserialize a session object from the
backend has resulted in a ClassNotFoundException
Exception is:java.lang.ClassNotFoundException:
org.apache.myfaces.application.viewstate.SecureSerializedViewCol
lection    at
...
java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:522)
at
com.ibm.ws.serialization.DeserializationObjectInputStream.loadCl
ass(DeserializationObjectInputStream.java:62)    at
com.ibm.ws.serialization.internal.DeserializationObjectInputStre
amImpl.loadClass(DeserializationObjectInputStreamImpl.java:48)
at
com.ibm.ws.serialization.DeserializationObjectInputStream.resolv
eClass(DeserializationObjectInputStream.java:133)    at
com.ibm.ws.serialization.DeserializationObjectInputStream.resolv
eClass(DeserializationObjectInputStream.java:171)   ...
com.ibm.ws.session.utils.SessionLoader.loadObject(SessionLoader.
java:62)    at
com.ibm.ws.session.store.db.DatabaseHashMap.getValue(DatabaseHas
hMap.java:1613)    at
com.ibm.ws.session.store.db.DatabaseSession.getSingleRowAppData(
DatabaseSession.java:168)    at
com.ibm.ws.session.store.db.DatabaseSession.getSwappableData(Dat
abaseSession.java:81)

PROBLEM CONCLUSION:
JSF was updated to avoid this ClassNotFoundException. The fix   
for this APAR is targeted for inclusion in fix packs 8.5.5.22   
and Liberty 22.0.0.3.                                           
                                                                
For more information, see 'Recommended Updates for              
WebSphere Application Server':                                  
https://www.ibm.com/support/pages/node/715553                   


Directions to apply fix:  
        1. Open a console and direct it to the location of your iFix jar
        2. Run the command "java -jar 21009-wlp-archive-IFPH43113.jar". The following launch options
        are available for the jar:

        --installLocation [LibertyRootDir] by default the jar will look for a "wlp" directory
        in its current location. If your WebSphere Liberty install
        location is different to "wlp" and/or is not in the same
        directory as the jar then you can use this option to change
        where the jar will patch. [LibertyRootDir] can either be
        relative to the location of the jar or an absolute file path.

        --suppressInfo hides all messages other than confirming the
        patch has completed or error messages.

        3. Stop your WebSphere Liberty server(s).
        4. When you next start your WebSphere Liberty server(s), the fix will become active in your runtime.







Directions to remove fix:  
        1. Stop your WebSphere Liberty server(s).
        2. You will need to delete the following files if they exist (file locations are
        relative to your WebSphere Liberty install root):

         - lib/com.ibm.ws.jsf_1.0.56.cl210920220208-1958.jar
         - lib/fixes/21009-wlp-archive-IFPH43113_21.0.0009.20220208_2313.xml
         - lib/fixes/21009-wlp-archive-IFPH43113_21.0.0009.20220208_2313.lpmf

        3. When you next start your WebSphere Liberty server(s), the fix will become inactive in your runtime.







Directions to re-apply fix:  
        1. Follow the instructions to apply the fix.







Additional Information: