IBM i PTF Guide, Volume 25, Number 20

May 17, 2023 Doug Bidwell

Sorry it took us a few extra days to get this edition of the IBM i PTF Guide out the door. This week, you have three security vulnerabilities and one end of the road for updates to WebSphere Application Server V8.5. Let’s deal with the WebSphere situation first.

IBM WebSphere Application Server V8.5 Group PTFs for IBM i operating system will no longer be released. You can read more about it here. Here are the final IBM i Group PTF levels containing the 8.5.5.23 fix pack level:

IBM i 7.4: SF99661 level 10
IBM i 7.3: SF99581 level 16
IBM i 7.2: SF99481 level 23

Now, let’s go through the security issues.

First, we have Security Bulletin: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to spoofing when using Web Server Plug-ins (CVE-2022-39161), which you can find out more about here.

Affected Product(s)							Version(s)	Plug-in Version
IBM WebSphere Application Server with Web Server Plug-ins		9.0		8.5, 9.0
IBM WebSphere Application Server with Web Server Plug-ins		8.5		8.5, 9.0
IBM WebSphere Application Server Liberty with Web Server Plug-ins		17.0.0.3 - current	8.5, 9.0

Second, there is Security Bulletin: IBM WebSphere Application Server is vulnerable to an XML External Entity (XXE) Injection vulnerability (CVE-2023-27554), and more details are available here.

Affected Product(s)			Version(s)
IBM WebSphere Application Server	9.0
IBM WebSphere Application Server	8.5

And third, there is Security Bulletin: OpenSSL for IBM i is vulnerable to denial of service attacks and the ability for remote attacker to obtain sensitive information due to multiple vulnerabilities, with more information at this link. The issue can be fixed by applying a PTF to IBM i. IBM i releases 7.5, 7.4, 7.3, and 7.2 will be fixed. The IBM i PTF numbers for OpenSSL in 5733-SC1 contain the fixes for the vulnerabilities.

IBM i Release	5733-SC1	PTF Number
7.5			SI83245	
7.4, 7.3, 7.2			SI83194

Here is the rundown of PTF Groups by IBM i release level since we last published:

PTF Groups 7.5:

High Availability for IBM i
Fix list for IBM WebSphere Application Server Liberty
WebSphere Application Server traditional V9.0
WebSphere Application Server V8.5
MustGather: How To Obtain and Install QMGTOOLS

PTF Groups 7.4:

High Availability for IBM i
Fix list for IBM WebSphere Application Server Liberty
WebSphere Application Server traditional V9.0
WebSphere Application Server V8.5
MustGather: How To Obtain and Install QMGTOOLS

PTF Groups 7.3:

Fix list for IBM WebSphere Application Server Liberty
WebSphere Application Server traditional V9.0
WebSphere Application Server V8.5
MQ for IBM i – v7.1.0/v8.0.0/V9.0.0/V9.1/V9.2
MustGather: How To Obtain and Install QMGTOOLS

Tip O’ The Week: The “Help” About, Check for Updates only checks the first three digits. If you are on ACS 1.1.9.1, checking for updates will not tell you about 1.1.9.2 . . . .

New (or Updated) links added to the ‘Links’ tab in the guide this week:

WAS Process To Download and Restore IBM WebSphere Application Server Fix Pack Repositories To the IBM i IFS, 667103
WAS Download WAS 9.0 from Passport Advantage Online, 617577
WAS Download WAS 9.0.5 from Passport Advantage Online, 886233

New (or Updated) links added to the ‘QMGtools’ tab in the guide this week:

Nein

New (or Updated) links added to the ‘ACS_NAV’ tab in the guide this week:

Nuthin’

New (or Updated) links added to the ‘Prtr Links’ tab in the guide this week:

Nothing here, either

New (or Updated) links Redbooks added this week:

Nothing here as well

The Guide at a glance: There are new defectives this week (05/13/23). Here is the defective PTF rundown, which is the last defective for each release:

	Defect		Defective	APAR	Fixing
	Date		PTF			PTF
	--------	--------	-------	-------
7.5	02/24/23	MF70751		MA50112	MF70868 (When available)
7.4	02/24/23	MF70747		MA50112	MF70861 (When available)
7.3	02/22/23	MF70677		MA50059	MF70736 (When available)
					MF70600
					MF70440

Be sure to access the link in the Guide for further details.

Below is the usual archive of the IBM i PTF Guide to help you work through the PTFs in chronological order:

May 13, 2023: Volume 25, Number 20

May 6, 2023: Volume 25, Number 19

April 29, 2023: Volume 25, Number 18

April 22, 2023: Volume 25, Number 17

April 15, 2023: Volume 25, Number 16

April 8, 2023: Volume 25, Number 15

April 1, 2023: Volume 25, Number 14

March 25, 2023: Volume 25, Number 13

March 18, 2023: Volume 25, Number 12

March 11, 2023: Volume 25, Number 11