IBM i PTF Guide, Volume 25, Number 16

April 17, 2023 Doug Bidwell

In a rare occurrence, there are no updates to the PTF Groups for the currently supported releases – IBM i 7.5, IBM i 7.4, and IBM i 7.3 – but there sure are a whole bunch of security vulnerabilities that IBM i shops have to deal with.

First, there are two of them dealing with WebSphere Application Server Liberty. In PH50863:IBM WebSphere Application Server Liberty is vulnerable to a denial of service, which you can find out more about here and which deals with CVE-2023-24998 CVSS 7.5. Then there is PH52739:IBM WebSphere Application Server Liberty is vulnerable to a privilege escalation due to RESTEasy (CVE-2023-0482 CVSS 5.3), which you can find out more about here.

Second, we have Security Bulletin: IBM Db2 Mirror for i is vulnerable to attacker obtaining sensitive information due to Java string processing in IBM Toolbox for Java (CVE-2022-43928), more of which you can learn about at this link. Patches are:

		5770-DBM	5770-SS1 
IBM Db2 Mirror for i	7.4	SI83019		SI82444
				SI83028		SI82954
IBM Db2 Mirror for i	7.5	SI83018		SI82443
				SI83029		SI82948

Third, there is Security Bulletin: IBM i components are affected by CVE-2021-4104 (log4j version 1.x), for which more information is available at this link.

IBM i Release	5770-DG1	Level
7.4		SF99662 - 	19
7.3		SF99722 - 	38
7.2		SF99713 - 	49

Fourth, you have Security Bulletin: IBM i DNS is affected by denial of service attacks due to flaws in ISC BIND (CVE-2022-3094, CVE-2022-3736, CVE-2022-3924). More information available here, and the IBM i PTF numbers for 5770-SS1 Option 31 Domain Name System contain the fix for the vulnerabilities:

IBM i Release	5770-SS1 Option 31	PTF Number
	7.5				SI82623
	7.4				SI82624	
	7.3				SI82625	
	7.2				SI82626

Here is the rundown of PTF Groups by IBM i release level since we last published:

PTF Groups 7.5:

Nothing

PTF Groups 7.4:

Nothing as well

PTF Groups 7.3:

Nothing here too

New (or Updated) links added to the ‘Links’ tab in the guide this week:

PowerHA/FlashCopy FSFC Features and Upgrades – 5.1, 6856191

New (or Updated) links added to the ‘QMGtools’ tab in the guide this week:

Nadda

New (or Updated) links added to the ‘ACS_NAV’ tab in the guide this week:

Nope

New (or Updated) links added to the ‘Prtr Links’ tab in the guide this week:

Nothing here, either

New (or Updated) links Redbooks added this week:

Why doesn’t IBM do Redbooks the way it used to?

Tips/Definitions: We will get you a new tip. Right now, we think you should be spending time with friends and family.

The Guide at a glance: There are new defectives this week (04/15/23). Here is the defective PTF rundown, which is the last defective for each release:

	Defect		Defective	APAR	Fixing
	Date		PTF			PTF
	--------	--------	-------	-------
7.5	02/24/23	MF70751		MA50112	MF70868 (When available)
7.4	02/24/23	MF70747		MA50112	MF70861 (When available)
7.3	02/22/23	MF70677		MA50059	MF70736 (When available)
			MF70600
			MF70440

Be sure to access the link in the Guide for further details.

Below is the usual archive of the IBM i PTF Guide to help you work through the PTFs in chronological order:

April 15, 2023: Volume 25, Number 16

April 8, 2023: Volume 25, Number 15

April 1, 2023: Volume 25, Number 14

March 25, 2023: Volume 25, Number 13

March 18, 2023: Volume 25, Number 12

March 11, 2023: Volume 25, Number 11

March 4, 2023: Volume 25, Number 10

February 25, 2023: Volume 25, Number 9

February 18, 2023: Volume 25, Number 8

February 13, 2023: Volume 25, Number 7