IBM i PTF Guide, Volume 26, Number 11

March 18, 2024 Doug Bidwell

This week in IBM i is sponsored by security vulnerabilities and precious little else. There are three security vulnerabilities that are new that you need to be aware of, so let’s get to it and let you get back to work.

First, we have Security Bulletin: IBM Db2 Web Query for i is vulnerable to a remote attacker bypassing security restrictions or to denial of service, which you can read more about here. The fixes are as follows:

IBM Db2 Web Query for i 		Release		OS Release
5733WQX 		2.4.0		7.4 and 7.5
				SI85982
				SI85987

Second, we have Security Bulletin: IBM HTTP Server (powered by Apache) for IBM i is vulnerable to a denial of service attack using HTTP/2 protocol. [CVE-2023-44487], which you can find out more about at this link.

IBM i Release	5770-DG1	PTF Number
7.5			SI86128
7.4			SI86127
7.3			SI86126

And third, we have Security Bulletin: IBM i is vulnerable to a privilege elevation due to an unqualified library call in Db2 for IBM i. [CVE-2024-22346], which is a much more serious thing as judged by the number of PTFs and the fact that Big Blue has patched IBM i 7.2 through IBM i 7.5. You can read more about this Db2 vulnerability at this link, and here is the rundown on patches to plug this hole:

IBM i Release	PTF Numbers
7.5	SF99950 750 Db2 for IBM i Level 6
7.4	SF99704 740 Db2 for IBM i Level 27
7.3	SI85678, SI85716, SI85731, SI85769, SI85776, SI85779, SI85781, SI85789, SI85798, SI85800, SI85802, SI85804, SI85811
7.2	SI85679, SI85715, SI85732, SI85770, SI85775, SI85777, SI85780, SI85788, SI85797, SI85799, SI85801, SI85803, SI85810

Here is the rundown of PTF Groups by IBM i release level since we last published:

PTF Groups 7.5:

Nothing

PTF Groups 7.4:

Nothing

PTF Groups 7.3:

Nothing

Tip O’ The Week: Latest IBM Pre-upgrade Verification (PRUV) tool for IBM i for MacOS or Windows is dated 2024-01-24. Find out more at this link.

New (or Updated) links added to the ‘Links’ tab in the guide this week:

IPL: Causes of Abnormal IPLs, 638517

New (or Updated) links added to the ‘QMGtools’ tab in the guide this week:

Nothing

New (or Updated) links added to the ‘ACS_NAV’ tab in the guide this week:

Nothing

New (or Updated) links added to the ‘Prtr Links’ tab in the guide this week:

None

New (or Updated) links Redbooks added this week:

None

The Guide at a glance: There are new defectives this week (03/16/24). Here is the defective PTF rundown, which is the last defective for each release:

Defective PTF rundown (The last defective for each release):

	Defect		Defective	APAR	Fixing
	Date		PTF			PTF
	--------	--------	-------	------------------------	
7.5	01/10/24	SI85576		SE81023	SI85663 (When available)
7.4	03/05/24	HF71521	MA50510	MF71656 (When available)
7.3	01/10/24	SI85576		SE81023	SI85663 (When available)

Be sure to access the link in the Guide for further details.

Below is the usual archive of the IBM i PTF Guide to help you work through the PTFs in chronological order:

March 16, 2024: Volume 26, Number 11

March 9, 2024: Volume 26, Number 10

March 2, 2024: Volume 26, Number 9

February 24, 2024: Volume 26, Number 8

February 17, 2024: Volume 26, Number 7

February 10, 2024: Volume 26, Number 6

February 3, 2024: Volume 26, Number 5

January 27, 2024: Volume 26, Number 4

January 20, 2024: Volume 26, Number 3

January 13, 2024: Volume 26, Number 2