IBM i PTF Guide, Volume 26, Number 13

April 8, 2024 Doug Bidwell

Three is the magic number, as we all know. This week, there is another trio of vulnerabilities in parts of the IBM i software stack. And all three currently supported IBM i releases all have a slew of group patches as well. Let’s start with the vulnerabilities because these are always important to know about and deal with.

First, we have Security Bulletin: IBM WebSphere Application Server Liberty is vulnerable to cross-site scripting (CVE-2024-27270), which you can find out more about at this link. The affected products include IBM WebSphere Application Server Liberty, versions 23.0.0.3 through 24.0.0.3 – who names these things?

Second, we have Security Bulletin: IBM WebSphere Application Server Liberty is vulnerable to a denial of service (CVE-2024-22353), and the link describing what is going on here is at this particular link. The affected products include IBM WebSphere Application Server Liberty, versions 17.0.0.3 through 24.0.0.3.

Third and finally, we have Security Bulletin: IBM Java SDK and IBM Java Runtime for IBM i are vulnerable to confidentiality impacts and a timing-based side-channel attack due to multiple vulnerabilities; more information about this vulnerability is available here. The patches available for the IBM i releases are as follows:

IBM i Release	PTF Group and Level
7.5	SF99955 Level 9	
7.4	SF99665 Level 22	
7.3	SF99725 Level 32

Here is the rundown of PTF Groups by IBM i release level since we last published:

PTF Groups 7.5:

HIPERs (High Impact/Pervasive)
Security
Java
IBM HTTP Server for i
MustGather: How To Obtain and Install QMGTOOLS

PTF Groups 7.4:

HIPERs (High Impact/Pervasive)
Security
Java
IBM HTTP Server for i
MustGather: How To Obtain and Install QMGTOOLS

PTF Groups 7.3:

HIPERs (High Impact/Pervasive)
Security
Java
IBM HTTP Server for i
MustGather: How To Obtain and Install QMGTOOLS

Tip O’ The Week: PCAP/WireShark: How to format IBM i TRCCNN and CMNTRC communication traces to .pcap files (Wireshark format), 667611. Find out more at this link.

New (or Updated) links added to the ‘Links’ tab in the guide this week:

PCAP/WireShark: How to format IBM i TRCCNN and CMNTRC communication traces to .pcap files (Wireshark format), 667611

New (or Updated) links added to the ‘QMGtools’ tab in the guide this week:

Nothing

New (or Updated) links added to the ‘ACS_NAV’ tab in the guide this week:

IBM Navigator for i – Roadmap, 6485241
IBM Navigator for i – PTF Information, 6486565

New (or Updated) links added to the ‘Prtr Links’ tab in the guide this week:

None

New (or Updated) links Redbooks added this week:

None

The Guide at a glance: There are new defectives this week (03/30/24). Here is the defective PTF rundown, which is the last defective for each release:

	Defect		Defective	APAR	Fixing
	Date		PTF			PTF
	--------	--------	-------	------------------------	
7.5	01/10/24	SI85576		SE81023	SI85663 (When available)
7.4	03/05/24	MF71521		MA50510	MF71656 (When available)
7.3	01/10/24	SI85576		SE81023	SI85663 (When available)

Be sure to access the link in the Guide for further details.

Below is the usual archive of the IBM i PTF Guide to help you work through the PTFs in chronological order:

March 30, 2024: Volume 26, Number 13

March 24, 2024: Volume 26, Number 12

March 16, 2024: Volume 26, Number 11

March 9, 2024: Volume 26, Number 10

March 2, 2024: Volume 26, Number 9

February 24, 2024: Volume 26, Number 8

February 17, 2024: Volume 26, Number 7

February 10, 2024: Volume 26, Number 6

February 3, 2024: Volume 26, Number 5

January 27, 2024: Volume 26, Number 4