IBM i PTF Guide, Volume 26, Number 20

June 3, 2024 Doug Bidwell

Here is something you need to be aware of: IBM i APAR and PTF records have migrated to Known Issues records and Fix Information records to be consistent with other IBM patching systems for other platforms and software. So read up on it at this link here.

And, as often happens, we also have three new security vulnerabilities to cope with.

First, we have Security Bulletin: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to an XML External Entity (XXE) injection vulnerability (CVE-2024-22354), which you can find out more about here. Here are the affected products:

Affected Product(s)				Version(s)
IBM WebSphere Application Server Liberty		17.0.0.3 - 24.0.0.5
IBM WebSphere Application Server		9.0
IBM WebSphere Application Server		8.5

Second, we have Security Bulletin: IBM WebSphere Application Server could provide weaker than expected security (CVE-2023-50313), which you can find out more about here. Here are the products affected by this vulnerability:

Affected Product(s)				Version(s)
IBM WebSphere Application Server		9.0
IBM WebSphere Application Server		8.5

And third and finally, there is Security Bulletin: IBM i is vulnerable to a local privilege escalation due to an unqualified library call in IBM Performance Tools for i [CVE-2024-27264], which you can find out more about at this link. Here are the patches for this one:

Release	Product		PTF Number
7.5	5770-PT1		SJ00164
				SJ00167
				SJ00275
7.4	5770-PT1		SJ00164
				SJ00167
				SJ00275
7.3	5770-PT1		SJ00163
				SJ00166
				SJ00274
7.2	5770-PT1		SJ00162
				SJ00165
				SJ00273

Here is the rundown of PTF Groups by IBM i release level since we last published:

PTF Groups 7.5:

Fix list for IBM WebSphere Application Server Liberty

PTF Groups 7.4:

Fix list for IBM WebSphere Application Server Liberty

PTF Groups 7.3:

Fix list for IBM WebSphere Application Server LibertyHIPERs (High Impact/Pervasive)

Tip O’ The Week: IBM Power Facts and Features: https://www.ibm.com/downloads/cas/YXJOGJRK.

New (or Updated) links added to the ‘Links’ tab in the guide this week:

SAV/RST: Determining When the Last Date/Time a SAVSYS and Other Save/Restore Commands Were Performed on a System, 641641
SAV/RST: Determine when GO SAVE Option 21 was Run and Estimating How Long a GO SAVE Option 21 Takes, 683957
MQ: IBM MQ 9.3 Getting Started with Install or Migration on IBM i, 7141546
JAVA: 5 Ways to Check WebSphere Java Version, N/A

New (or Updated) links added to the ‘QMGtools’ tab in the guide this week:

None

New (or Updated) links added to the ‘ACS_NAV’ tab in the guide this week:

None

New (or Updated) links added to the ‘Prtr Links’ tab in the guide this week:

None

New (or Updated) links Redbooks added this week:

None

New (or Updated) “Stuff” added to REF tab in the guide this week:

None

The Guide at a glance: There are new defectives this week (05/25/24). Here is the defective PTF rundown, which is the last defective for each release:

Defective PTF rundown (The last defective for each release):
	Defect		Defective	APAR		Fixing
	Date		PTF				PTF
	--------		--------		-------	-	-----------------------	
7.5	04/23/24		SI85693		DT378886	SJ00269 (When available)
			SI84240
7.4	04/23/24		SI85692		DT378886	SJ00268 (When available)
			SI84239
7.3	01/10/24		SI85576		SE81023	SI85663 (When available)

Be sure to access the link in the Guide for further details.

Below is the usual archive of the IBM i PTF Guide to help you work through the PTFs in chronological order:

May 25, 2024: Volume 26, Number 20

May 18, 2024: Volume 26, Number 19

May 11, 2024: Volume 26, Number 18

May 4, 2024: Volume 26, Number 17

April 20, 2024: Volume 26, Number 16

April 13, 2024: Volume 26, Number 15

April 6, 2024: Volume 26, Number 14

March 30, 2024: Volume 26, Number 13

March 24, 2024: Volume 26, Number 12

March 16, 2024: Volume 26, Number 11