RE: DB2 Web Query Security Bulletin

Just to tie this off...

I downloaded v2.4 and followed the document on installing manually. It wasn't that bad.

1. We had to download and install a prerequisite software: 5770SS1 Option 43 Additional Fonts https://www.ibm.com/support/pages/node/6839889
2. I then downloaded the 5733WQX v2.4 images (2) from ESS along with the License keys
3. Created an image catalog https://www.ibm.com/support/pages/node/6578651
4. Followed the install: https://www.ibm.com/support/pages/system/files/inline-files/DB2%20Web%20Query%20Install_2.4.0_1.pdf
5. Before starting it back up, I used SNDPTFORD SF99673 (for v7r5) to get the level 3 PTFs required for the vulnerabilities https://www.ibm.com/support/pages/node/7105215?myns=swgother&mynp=OCSWG60&mync=E&cm_sp=swgother-_-OCSWG60-_-E

After loading and applying that PTF Group I did STRWEBQRY - this took a LONG time (45-60 minutes). It converted/created all the sample reports etc.

So far it looks good (but the day is not over). The UI has changed again, but it's for the better IMHO.

If you are hesitating in doing the update from v2.3, I would suggest trying it. Make sure you do a SAVWEBQRY first.

This link was helpful for finding Developer Workbench: https://www.ibm.com/support/pages/release-240-ptfs-and-going-service

Hope this helps someone else.

Greg

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Greg Wilburn
Sent: Thursday, January 4, 2024 9:15 AM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: RE: DB2 Web Query Security Bulletin

For anyone with Web Query and not on 2.4

From IBM:

Note that release 230 is out of support since October 31. Based on the response from development I would suggest an update to 240.

Development's response is as follows:
IBM does not assess out-of-support releases for vulnerabilities. General experience across many products has been that most vulnerabilities found in the oldest supported release are also applicable to the prior out-of-support release. You should proceed with the expectation that statement is applicable for Web Query.

Greg