× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.



Greetings...  
 
The HTTP Apache Server and Tomcat are totally separate things.  Your HTTP
Server can NEVER be running on tomcat.   They are totally different
deliveries, and technology stacks.   
 
IBM has NO control over tomcat on any customer system, as it is not
shipped with the IBM i operating system nor PTF in any way.  Tomcat, is
only user deployed.  
 
IBM HTTP Server, that is updated view PTFs and all CVEs are delivered via
PTFs.  Details on the web page below.    IBM has no plans on updating the
Apache HTTP version on a more regular cadence as its not needed as all
issues are resolved and if the scanning tool were to actually attempt to
exploit a venerability would find it properly corrected. 
 
 

Tim Rowe, timmr@xxxxxxxxxx
Business Architect Application Development & Systems Management for IBM i
IBM i ISV Council
IBM i Development Lab, Rochester, MN
(507) 253-6191 (Tie) 553-6191

http://www-03.ibm.com/systems/power/software/i/are/index.html
http://ibm.biz/IBMi_ACS
 
message: 3
date: Wed, 5 May 2021 13:58:27 +0000
from: Rob Berendt <rob@xxxxxxxxx>
subject: RE: How to see if a particular CVE has been addressed in IBM
i?

Tim,

Thank you for the reply.

If the scanner checks our Apache server and says it is running Tomcat
version xyz and that version is known to be susceptible to CVE such and
such does IBM upgrade the version of tomcat that the apache server is
running or does it just patch the current version of Tomcat to address
that CVE?  Because not upgrading to a newer version of Tomcat does not
help us pass the security scan.  

Even when we had IBM doing our security scans they did not want to hear
about ptf's or any such thing.  We had this issue where DNS bind was on an
old version and even though IBM i had patched the CVE's of concern the
other team at IBM did not care one whit and would only pass the scan if
the DNS bind version was updated.  Which generally only happens at a
release upgrade.  We ended up having to remove the DNS server from almost
all lpars.  There is a black hat fix where you update the file
/QIBM/UserData/OS400/DNS/ATTREXT and lie about the bind version but I
didn't want to play that game.

Am I going to have to remove the apache server also in order to pass
security scans?

BTW, I checked the link you suggested,
[1]https://www.ibm.com/support/pages/node/1170946 and it does not mention
CVE-2020-9484 which we are getting dinged on.
Case number:  TS005562849

Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to:  7310 Innovation Blvd, Suite 104
          Ft. Wayne, IN 46818
Ship to:  7310 Innovation Blvd, Dock 9C
          Ft. Wayne, IN 46818
[2]http://www.dekko.com ;

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Tim
Rowe
Sent: Wednesday, May 5, 2021 8:11 AM
To: midrange-l@xxxxxxxxxxxxxxxxxx
Cc: midrange-l@xxxxxxxxxxxxxxxxxx
Subject: Re: How to see if a particular CVE has been addressed in IBM i?

CAUTION: This email originated from outside of the organization. Do not
click links or open attachments unless you recognize the sender and know
the content is safe.

   Greetings.

   Couple of things.... IBM i, the operating system while we support
(through
   a TSS services contract) and allow Tomcat Application Servers to run on
   IBM i (and they run very well I might add) we do not ship Tomcat. We
did
   once upon a very long time ago... I believe its been about 16 years now
   since we actually shipped any version of tomcat.  The users is
responsible
   downloading new version and maintaining their levels for Tomcat.  This
   specific CVE is for Tomcat, so there would not be a PTF that would
correct
   this issue.

   As for the Apache server.  We have a Wed page that lists ALL CVEs that
   have been found in HTTP Apache core code, that actually affect the
   implantation of Apache HTTP server that we ship in DG1 on IBM i. We use
   the Apache foundation Apache HTTP Server as our base, but as this HTTP
   server has been implemented into ILE, we have to make changes, there
are
   some modules that we dont support, etc.  While we dont update the major
   version all the time we target to update that about every other year,
but
   we do include the fixes for EVERY CVE published, and ship those updates
in
   PTFs. The details on the CVE and the corresponding PTFs can be found at
    [1][3]https://www.ibm.com/support/pages/node/1170946

   Last one...  "Application Servers" say "V8.5 (int app svr)"
   While we dont ship Tomcat... we do ship an integrated Web Application
   Server .  The int app svr is based on IBM Liberty. Conceptually.... its
   IBMs version of Tomcat but of course...'better'.  :)    Pretty much any
   application you have running on Tomcat...yea you could move it to this
   integrated application server and it would work just fine there.
    Benefits.... now IBM is responsible for keeping that updated and
   maintained.  The liberty server is developed on a continuous delivery
   model, the IBM i team updates to the latest GM version approx 4 times a
   year unless there is some significant bug or security issue reported
and
   we will updates sooner.

   PTFs for IBM i HTTP Server and Integrated Application Servers (which
the
   IBM i Rest engine is built on) are all shipped as part of the HTTP PTF
   Group.

   >> > We got dinged on a security scan.
   >> > Our IBM i 7.4 has been flagged as exposed to CVE-2020-9484.
   >> > History has taught me that whether or not the people at IBM i have
   put
   >> out
   >> > PTF's which are supposed to address this particular CVE is
   irrelevant.
   >> The
   >> > only way to pass the scan is to get on a higher level of Tomcat.
   >> > From the CVE the following seem to be affected:Apache Tomcat
versions
   >> > 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and
7.0.0
   to
   >> > 7.0.103
   >> >
   >> > How do you tell exactly:
   >> > 1 - what version of Tomcat you are using?
   >> > 2 - if a PTF is out which upgrades your version?
   >> > Also, is this like WAS where we have to do more steps other than
just
   >> put
   >> > on the PTF to upgrade?
   >> >
   >> > All of our active "HTTP servers" say "Apache/2.4.34 (IBM i)".
   >> > All of our active "Application Servers" say "V8.5 (int app svr)".
   >> >

   Tim Rowe, timmr@xxxxxxxxxx
   Business Architect Application Development & Systems Management for IBM
i
   IBM i ISV Council
   IBM i Development Lab, Rochester, MN
   (507) 253-6191 (Tie) 553-6191

   [4]http://www-03.ibm.com/systems/power/software/i/are/index.html
   [5]http://ibm.biz/IBMi_ACS ;

     4. Re: How to see if a particular CVE has been addressed in IBM
         i? (Jack Kingsley)

References

   Visible links
   1. [6]https://www.ibm.com/support/pages/node/1170946
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: [7]https://lists.midrange.com/mailman/listinfo/midrange-l ;
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at [8]https://archive.midrange.com/midrange-l ;.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: [9]https://amazon.midrange.com ;

------------------------------

Subject: Digest Footer

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) digest list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: [10]https://lists.midrange.com/mailman/listinfo/midrange-l ;
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at [11]https://archive.midrange.com/midrange-l ;.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: [12]https://amazon.midrange.com ;

------------------------------

End of MIDRANGE-L Digest, Vol 20, Issue 622
*******************************************
 
 

References

Visible links
1. https://www.ibm.com/support/pages/node/1170946
2. http://www.dekko.com/
3. https://www.ibm.com/support/pages/node/1170946
4. http://www-03.ibm.com/systems/power/software/i/are/index.html
5. http://ibm.biz/IBMi_ACS
6. https://www.ibm.com/support/pages/node/1170946
7. https://lists.midrange.com/mailman/listinfo/midrange-l
8. https://archive.midrange.com/midrange-l
9. https://amazon.midrange.com/
10. https://lists.midrange.com/mailman/listinfo/midrange-l
11. https://archive.midrange.com/midrange-l
12. https://amazon.midrange.com/

As an Amazon Associate we earn from qualifying purchases.

This thread ...

Follow-Ups:

Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.