IBM i PTF Guide, Volume 24, Number 31

August 3, 2022 Doug Bidwell

As often happens with systems software these days, there are a bunch of new security vulnerabilities with the IBM i stack that you need to be aware of.

First, there is Security Bulletin: OpenSSL for IBM i is vulnerable to arbitrary command execution (CVE-2022-2068), which you can find out more about at this link. The IBM i PTF numbers contain the fix for the vulnerability:

IBM i Release	5733-SC1	PTF Number
7.5		SI80588
		7.4, 7.3, 7.2	SI80587

Then there is Security Bulletin: IBM WebSphere Application Server Liberty is vulnerable to Identity Spoofing (CVE-2022-22476), which you can find out more about here.

And next up, we have Security Bulletin: IBM HTTP Server (powered by Apache) for IBM i is vulnerable to bypass security restrictions and obtain sensitive information due to multiple vulnerabilities, which is detailed here. The IBM i PTF numbers contain the fix for the vulnerability:

IBM i Release	5770-DG1	PTF Number
		7.5		SI80337
		7.4		SI80353
		7.3		SI80354
		7.2		SI80355

And finally, there is Security Bulletin: IBM PowerVM VIOS could allow a remote attacker to tamper with system configuration or cause a denial of service (CVE-2022-35643), which you can find out more about here.

Here is the rundown of PTF Groups by IBM i release level since we last published:

PTF Groups 7.5:

HIPERs (High Impact/Pervasive)
Security
Backup Recovery Solutions
Content Manager OnDemand for i – 5770-RD1 7.5

PTF Groups 7.4:

Security
Backup Recovery Solutions
Content Manager OnDemand for i – 5770-RD1 7.5

PTF Groups 7.3:

HIPERs (High Impact/Pervasive)
Security
Backup Recovery Solutions
Content Manager OnDemand for i – 5770-RD1 7.5

PTF Groups 7.2:

Security
Backup Recovery Solutions

New (or Updated) links added to the ‘Links’ tab in the guide this week:

Nadda

New (or Updated) links added to the ‘QMGtools’ tab in the guide this week:

New (or Updated) links added to the ‘ACS_NAV’ tab in the guide this week:

Nothing here.

Tips/Definitions: There is a new IBM Redbook on the entry Power10 machines called Power S1014, S1022s, S1022, and S1024 Technical Overview and Introduction, which you can download here.

The Guide at a glance: There are no new defectives this week (07/30/22). Here is the defective PTF rundown, which is the last defective for each release:

Defective PTF rundown (The last defective for each release):

Defective PTF rundown (The last defective for each release):
	Defect		Defective	APAR	Fixing
	Date		PTF			PTF
	--------	--------	-------	-------
7.5	06/03/22	SI78809		SE78003	SI80094 (When available)
7.4	06/22/22	MF69859		MA49739	MF70026 (When available)
			MF69848
			MF69823
			MF69756
			MF69743
			MF69740
			MF69736
			MF69501
			MF69477
			MF69435
			MF69411
			MF69196
			MF69193
			MF68999
			MF68985		
7.3	06/22/22	MF69735		MA49739	MF70028 (When available)
			MF68984	
7.2	12/08/21	SI77634		SE73420	SI78039	(Read the link in the guide!)

Be sure to access the link in the Guide for further details.

Below is the usual archive of the IBM i PTF Guide to help you work through the PTFs in chronological order:

July 30, 2022: Volume 24, Number 31

July 23, 2022: Volume 24, Number 30

July 16, 2022: Volume 24, Number 29

July 9, 2022: Volume 24, Number 28

June 25, 2022: Volume 24, Number 26

June 18, 2022: Volume 24, Number 25

June 11, 2022: Volume 24, Number 24

June 4, 2022: Volume 24, Number 23

May 28, 2022: Volume 24, Number 22

May 25, 2022: Volume 24, Number 21