IBM i PTF Guide, Volume 26, Number 8

February 26, 2024 Doug Bidwell

It is a rare week when there is not some sort of security bulletin that affects all of the major operating systems, and this week is not one of those rare weeks. There are three security vulnerabilities affecting the current IBM i releases as well as a group of security patches for the vintage IBM i 7.2 release. Let’s get started with the security vulnerabilities, as is our common practice.

First, we have Security Bulletin: Multiple Vulnerabilities in IBM Java SDK affect IBM WebSphere Application Server and IBM WebSphere Application Server Liberty due to January 2024 CPU, which you can find out more about here. The affected products are:

Affected Product(s)				Version(s)
IBM WebSphere Application Server		8.5
IBM WebSphere Application Server		9.0
IBM WebSphere Application Server Liberty		Continuous delivery

Second, we have Security Bulletin: OpenSSH for IBM i is vulnerable to a machine-in-the-middle attack due to a flaw in the SSH transport protocol. [CVE-2023-48795], details of which are available here. The PTFs by release for this issue are as follows:

IBM i Release	5733-SC1	PTF Number
7.5			SI85935
7.4			SI85948
7.3			SI85948
7.2			SI85948

Third, we have Security Bulletin: OpenSSH for IBM i is vulnerable to an attacker executing arbitrary commands due to improper validation. [CVE-2023-51385], which is outlined at this link.

IBM i Release	5733-SC1	PTF Number
7.5			SI85935
7.4			SI85948
7.3			SI85948
7.2			SI85948

Then we have the IBM 7.2 Group Security – level 129 – set of patches, which is SF99718 and which you can read about here.

Here is the rundown of PTF Groups by IBM i release level since we last published:

PTF Groups 7.5:

HIPERs (High Impact/Pervasive)
Security
WebSphere Application Server V8.5

PTF Groups 7.4:

Security
WebSphere Application Server V8.5

PTF Groups 7.3:

Security
WebSphere Application Server V8.5

Tip O’ The Week: Latest IBM Pre-upgrade Verification (PRUV) tool for IBM i for MacOS or Windows is dated 2024-01-24. Find out more at this link.

New (or Updated) links added to the ‘Links’ tab in the guide this week:

PTF: Required PTFs for Upgrading to IBM i 7.5, 6248359

New (or Updated) links added to the ‘QMGtools’ tab in the guide this week:

None

New (or Updated) links added to the ‘ACS_NAV’ tab in the guide this week:

How to edit bookmarks in Navigator for i, 7028566

New (or Updated) links added to the ‘Prtr Links’ tab in the guide this week:

None

New (or Updated) links Redbooks added this week:

None

The Guide at a glance: There are new defectives this week (02/24/24). Here is the defective PTF rundown, which is the last defective for each release:

	Defect		Defective	APAR	Fixing
	Date		PTF			PTF
	--------	--------	-------	------------------------	
7.5	01/10/24	SI85576		SE81023	SI85663 (When available)
7.4	01/24/24	SI84712		SE81069	SI85707 (Read Special Instructions!!)
				SI84563
				SI83654
7.3	01/10/24	SI85576		SE81023	SI85663 (When available)

Be sure to access the link in the Guide for further details.

Below is the usual archive of the IBM i PTF Guide to help you work through the PTFs in chronological order:

February 24, 2024: Volume 26, Number 8

February 17, 2024: Volume 26, Number 7

February 10, 2024: Volume 26, Number 6

February 3, 2024: Volume 26, Number 5

January 27, 2024: Volume 26, Number 4

January 20, 2024: Volume 26, Number 3

January 13, 2024: Volume 26, Number 2

January 6, 2024: Volume 26, Number 1

December 30, 2023: Volume 25, Number 53

December 23, 2023: Volume 25, Number 52