Re: How to see if a particular CVE has been addressed in IBM i?

We got dinged on a security scan.
Our IBM i 7.4 has been flagged as exposed to CVE-2020-9484.
History has taught me that whether or not the people at IBM i have put out
PTF's which are supposed to address this particular CVE is irrelevant. The
only way to pass the scan is to get on a higher level of Tomcat.
From the CVE the following seem to be affected:Apache Tomcat versions
10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to
7.0.103

How do you tell exactly:
1 - what version of Tomcat you are using?
2 - if a PTF is out which upgrades your version?
Also, is this like WAS where we have to do more steps other than just put
on the PTF to upgrade?

All of our active "HTTP servers" say "Apache/2.4.34 (IBM i)".
All of our active "Application Servers" say "V8.5 (int app svr)".

Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 7310 Innovation Blvd, Suite 104
Ft. Wayne, IN 46818
Ship to: 7310 Innovation Blvd, Dock 9C
Ft. Wayne, IN 46818
http://www.dekko.com

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com