IBM i PTF Guide, Volume 24, Number 49

December 7, 2022 Doug Bidwell

It is another one of those weeks when there are a slew of security vulnerabilities to attend to. Four that we know of, to be precise.

First, there is Security Bulletin: IBM WebSphere Application Server Liberty is vulnerable to a denial of service due to Google protobuf-java (CVE-2022-3171, CVE-2022-3509), which you can read more about at this link. This vulnerability affects IBM WebSphere Application Server Liberty versions 21.0.0.2 through 22.0.0.12.

Second, there is Security Bulletin: ISC BIND on IBM i is vulnerable to denial of service due to memory leaks and a flaw in resolver code (CVE-2022-2795, CVE-2022-38177, CVE-2022-38178), which you can find out more about here. The IBM i PTF numbers contain the fix for the vulnerabilities:

IBM i Release 5770-SS1		PTF Number 
7.5				SI81706	
7.4				SI81707	
7.3				SI81708	
7.2				SI81709

Third, there is Security Bulletin: Digital Certificate Manager for IBM i is vulnerable to cross-site scripting (CVE-2022-34358), which you can see more about here. The IBM i PTF numbers contain the fix for the vulnerability:

IBM i Release 5770-SS1		PTF Number
7.5				SI80415	
7.4				SI80414	
7.3				SI80413	
7.2				SI80412

Additional URLs were identified that can be used for a cross-site scripting attack resulting in superseded PTFs. The IBM i superseding PTF numbers contain the fix for the vulnerability:

IBM i Release	5770-SS1	PTF Number	
7.5				SI81854	
7.4				SI81853	
7.3				SI81852	
7.2				SI81845

It is recommended that the heritage version of Digital Certificate Manager not be used. PTFs are available that disable the heritage version of Digital Certificate Manager. IBM i releases 7.5, 7.4, and 7.3 will be disabled. The IBM i PTF numbers to disable heritage version of Digital Certificate Manager:

IBM i Release	5770-DG1	PTF Number
7.5				SI81417	
7.4				SI81418	
7.3				SI81419

And fourth, there is Security Bulletin: ISC DHCP server for IBM i is vulnerable to a denial of service attack due to a memory leak and reference count overflow (CVE-2022-2928, CVE-2022-2929), which you can get more information about at this link here. The IBM i PTF numbers contain the fix for the vulnerabilities.

IBM i Release	5770-SS1	PTF Number
7.5				SI81438
7.4				SI81439
7.3				SI81440
7.2				SI81441

Now, here is the rundown of PTF Groups by IBM i release level since we last published:

PTF Groups 7.5:

Latest Cumulative PTF Package
HIPERs (High Impact/Pervasive)
Security
Technology Refresh
DB2 for IBM i

PTF Groups 7.4:

Latest Cumulative PTF Package
HIPERs (High Impact/Pervasive)
Security
Technology Refresh
DB2 for IBM i
IBM Db2 Mirror for i
Temporary Storage PTFs

PTF Groups 7.3:

Latest Cumulative PTF Package
HIPERs (High Impact/Pervasive)
Security
Technology Refresh

PTF Groups 7.2:

HIPERs (High Impact/Pervasive)
Security

New (or Updated) links added to the ‘Links’ tab in the guide this week:

DBU: ProData – Home of DBU

New (or Updated) links added to the ‘QMGtools’ tab in the guide this week:

None

New (or Updated) links added to the ‘ACS_NAV’ tab in the guide this week:

None

New (or Updated) links added to the ‘Prtr Links’ tab in the guide this week:

Nadda

Tips/Definitions: How long has it been since you did a SAVE 21?

The Guide at a glance: There are no new defectives this week (12/03/22). Here is the defective PTF rundown, which is the last defective for each release:

	Defect		Defective	APAR	Fixing
	Date		PTF			PTF
	--------	--------	-------	-------
7.5	11/22/22	SI81328		SE78918	SI81867 (When available)
7.4	12/01/22	MF69286	MA49947	MF70500 (When available)
7.3	12/01/22	MF69085	MA49947	MF70499 (When available)
7.2	12/08/21	SI77634		SE73420	SI78039	(Read the link in the guide!)

Be sure to access the link in the Guide for further details.

Below is the usual archive of the IBM i PTF Guide to help you work through the PTFs in chronological order:

December 3, 2022: Volume 24, Number 49

November 26, 2022: Volume 24, Number 48

November 19, 2022: Volume 24, Number 47

November 12, 2022: Volume 24, Number 46

November 5, 2022: Volume 24, Number 45

October 29, 2022: Volume 24, Number 44

October 22, 2022: Volume 24, Number 43

October 15, 2022: Volume 24, Number 42

October 8, 2022: Volume 24, Number 41

October 1, 2022: Volume 24, Number 40