RE: How to see if a particular CVE has been addressed in IBM i?

Tim,

Thank you for the reply.

If the scanner checks our Apache server and says it is running Tomcat version xyz and that version is known to be susceptible to CVE such and such does IBM upgrade the version of tomcat that the apache server is running or does it just patch the current version of Tomcat to address that CVE? Because not upgrading to a newer version of Tomcat does not help us pass the security scan.

Even when we had IBM doing our security scans they did not want to hear about ptf's or any such thing. We had this issue where DNS bind was on an old version and even though IBM i had patched the CVE's of concern the other team at IBM did not care one whit and would only pass the scan if the DNS bind version was updated. Which generally only happens at a release upgrade. We ended up having to remove the DNS server from almost all lpars. There is a black hat fix where you update the file /QIBM/UserData/OS400/DNS/ATTREXT and lie about the bind version but I didn't want to play that game.

Am I going to have to remove the apache server also in order to pass security scans?

BTW, I checked the link you suggested, https://www.ibm.com/support/pages/node/1170946 and it does not mention CVE-2020-9484 which we are getting dinged on.
Case number: TS005562849



Rob Berendt