Greetings.
Couple of things.... IBM i, the operating system while we support (through
a TSS services contract) and allow Tomcat Application Servers to run on
IBM i (and they run very well I might add) we do not ship Tomcat. We did
once upon a very long time ago... I believe its been about 16 years now
since we actually shipped any version of tomcat. The users is responsible
downloading new version and maintaining their levels for Tomcat. This
specific CVE is for Tomcat, so there would not be a PTF that would correct
this issue.
As for the Apache server. We have a Wed page that lists ALL CVEs that
have been found in HTTP Apache core code, that actually affect the
implantation of Apache HTTP server that we ship in DG1 on IBM i. We use
the Apache foundation Apache HTTP Server as our base, but as this HTTP
server has been implemented into ILE, we have to make changes, there are
some modules that we dont support, etc. While we dont update the major
version all the time we target to update that about every other year, but
we do include the fixes for EVERY CVE published, and ship those updates in
PTFs. The details on the CVE and the corresponding PTFs can be found at
[1]
https://www.ibm.com/support/pages/node/1170946
Last one... "Application Servers" say "V8.5 (int app svr)"
While we dont ship Tomcat... we do ship an integrated Web Application
Server . The int app svr is based on IBM Liberty. Conceptually.... its
IBMs version of Tomcat but of course...'better'. :) Pretty much any
application you have running on Tomcat...yea you could move it to this
integrated application server and it would work just fine there.
Benefits.... now IBM is responsible for keeping that updated and
maintained. The liberty server is developed on a continuous delivery
model, the IBM i team updates to the latest GM version approx 4 times a
year unless there is some significant bug or security issue reported and
we will updates sooner.
PTFs for IBM i HTTP Server and Integrated Application Servers (which the
IBM i Rest engine is built on) are all shipped as part of the HTTP PTF
Group.
>> > We got dinged on a security scan.
>> > Our IBM i 7.4 has been flagged as exposed to CVE-2020-9484.
>> > History has taught me that whether or not the people at IBM i have
put
>> out
>> > PTF's which are supposed to address this particular CVE is
irrelevant.
>> The
>> > only way to pass the scan is to get on a higher level of Tomcat.
>> > From the CVE the following seem to be affected:Apache Tomcat versions
>> > 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0
to
>> > 7.0.103
>> >
>> > How do you tell exactly:
>> > 1 - what version of Tomcat you are using?
>> > 2 - if a PTF is out which upgrades your version?
>> > Also, is this like WAS where we have to do more steps other than just
>> put
>> > on the PTF to upgrade?
>> >
>> > All of our active "HTTP servers" say "Apache/2.4.34 (IBM i)".
>> > All of our active "Application Servers" say "V8.5 (int app svr)".
>> >
Tim Rowe, timmr@xxxxxxxxxx
Business Architect Application Development & Systems Management for IBM i
IBM i ISV Council
IBM i Development Lab, Rochester, MN
(507) 253-6191 (Tie) 553-6191
http://www-03.ibm.com/systems/power/software/i/are/index.html
http://ibm.biz/IBMi_ACS
4. Re: How to see if a particular CVE has been addressed in IBM
i? (Jack Kingsley)
References
Visible links
1.
https://www.ibm.com/support/pages/node/1170946
midrange.com
