Re: How to see if a particular CVE has been addressed in IBM i?

[Jack Kingsley <iseriesflorida@xxxxxxxxx>]

Rob, here is a command to show the apache version.

https://www.ibm.com/support/pages/how-determine-version-apache-http-server-ibm-i

If you know where your tomcat server is installed in the IFS, look for the
version.sh file.
https://mkyong.com/tomcat/how-to-check-tomcat-version-installed/

Current apache tomcat versions:
http://tomcat.apache.org/whichversion.html




On Mon, May 3, 2021 at 11:16 AM Rob Berendt <rob@xxxxxxxxx> wrote:

> We got dinged on a security scan.
> Our IBM i 7.4 has been flagged as exposed to CVE-2020-9484.
> History has taught me that whether or not the people at IBM i have put out
> PTF's which are supposed to address this particular CVE is irrelevant.  The
> only way to pass the scan is to get on a higher level of Tomcat.
> From the CVE the following seem to be affected:Apache Tomcat versions
> 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to
> 7.0.103
>
> How do you tell exactly:
> 1 - what version of Tomcat you are using?
> 2 - if a PTF is out which upgrades your version?
> Also, is this like WAS where we have to do more steps other than just put
> on the PTF to upgrade?
>
> All of our active "HTTP servers" say "Apache/2.4.34 (IBM i)".
> All of our active "Application Servers" say "V8.5 (int app svr)".
>
> Rob Berendt
> --
> IBM Certified System Administrator - IBM i 6.1
> Group Dekko
> Dept 1600
> Mail to:  7310 Innovation Blvd, Suite 104
>           Ft. Wayne, IN 46818
> Ship to:  7310 Innovation Blvd, Dock 9C
>           Ft. Wayne, IN 46818
> http://www.dekko.com
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
> questions.
>
> Help support midrange.com by shopping at amazon.com with our affiliate
> link: https://amazon.midrange.com