IBM i PTF Guide, Volume 24, Number 24

June 15, 2022 Doug Bidwell

If it seems like just about every week there is a security vulnerability within the broad and deep expanse of the IBM i platform, well it isn’t just seeming like that. It is like that. And this week we start out with four news ones that you have to contend with in the IBM i PTF Guide.

First, we have Security Bulletin: Due to use of Spring Framework, IBM Db2 Web Query for i is vulnerable to unprotected fields (CVE-2022-22968), remote code execution (CVE-2022-22965), and denial of service (CVE-2022-22950). Find out more about that at this link. Here are the patches that address this vulnerability:

Affected Releases	Group PTF and Minimum Level for Remediation
IBM i 7.5		SF99671 level 6
IBM i 7.4		SF99654 level 6
IBM i 7.3		SF99533 level 6

Second, peruse Security Bulletin: IBM Db2 Mirror for i is vulnerable to directory traversal due to Moment.js (CVE-2022-24785). Read all about it on this page. Patches are as follows:

Affected Releases	Group PTF/Minimum Level		PTF
7.5			SF99951 level 1			SI79449
7.4			SF99668 level 19		SI79448

Third, we present to you Security Bulletin: IBM Db2 Mirror for i is vulnerable to denial of service due to gson 217225. Get the scoop on this at this link right here. Get your PTFs for this one:

Affected Releases	Group PTF/Minimum Level		PTF
7.5			SF99951 level 1			SI77900
7.4			SF99668 level 17		SI77899

And fourth, you will find Security Bulletin: IBM Db2 Mirror for i is vulnerable to cross-site scripting due to Angular (220414), and you can find out more about this vulnerability here and these are you patches:

Affected Releases	Group PTF/Minimum Level		PTF
7.5			SF99951 level 1			SI79449
7.4			SF99668 level 19		SI79448

Now, here is another thing: There is an Official Support Statement for the IBM WebSphere Application Server Product on the IBM i OS, which is IBM Document Number 645523. If you are running WAS in any version, you are gonna want to read this!!!

Here is the rundown of PTF Groups by IBM i release level since we last published, with IBM i 7.5 added in since it has been shipping for several weeks now:

PTF Groups 7.5:

Db2 Web Query for i V2.3.0
QMGTOOLS

PTF Groups 7.4:

Db2 Web Query for i V2.3.0
Fix list for IBM WebSphere Application Server Liberty
QMGTOOLS

PTF Groups 7.3:

Db2 Web Query for i V2.3.0
Fix list for IBM WebSphere Application Server Liberty
QMGTOOLS

PTF Groups 7.2:

QMGTOOLS

PTF Groups 7.1:

Zilch

New (or Updated) links added to the ‘Links’ tab in the guide this week:

Nadda

New (or Updated) links added to the ‘QMGtools’ tab in the guide this week:

New (or Updated) links added to the ‘ACS_NAV’ tab in the guide this week:

Nothing here.

Tips/Definitions: Drink lots of water, change your socks, take Advil for pain, carry on. . . .

The Guide at a glance: There are no new defectives this week (06/11/22). Here is the defective PTF rundown, which is the last defective for each release:

	Defect		Defective	APAR	Fixing
	Date		PTF			PTF
	--------	--------	-------	-------
7.5	06/03/22	SI78809		SE78003	SI80094 (When available)
7.4	06/03/22	SI79097		SE78003	SI80093 (When available)
7.3	06/03/22	SI79186		SE78003	SI80092 (When available)
7.2	12/08/21	SI77634		SE73420	SI78039	(Read the link in the guide!)
7.1	07/29/19	SI69653		SE71807	SI70603 (5733SC1, OpenSSH, available!)

Be sure to access the link in the Guide for further details.

Below is the usual archive of the IBM i PTF Guide to help you work through the PTFs in chronological order:

June 11, 2022: Volume 24, Number 24

June 4, 2022: Volume 24, Number 23

May 28, 2022: Volume 24, Number 22

May 25, 2022: Volume 24, Number 21

May 14, 2022: Volume 24, Number 20

May 7, 2022: Volume 24, Number 19

April 30, 2022: Volume 24, Number 18

April 23, 2022: Volume 24, Number 17

April 16, 2022: Volume 24, Number 16

April 2, 2022: Volume 24, Number 14