Open Source Development

Power Open Source Development

Explore the open source tools and capabilities for building and deploying modern applications on IBM Power platforms including AIX, IBM i, and Linux.


#Power


#Power


#Servers
#Opensource
 View Only

  • 1.  AIX is affected by multiple vulnerabilities in Python.

    Posted 08/19/22 04:36 PM
    Per https://www.ibm.com/support/pages/node/6607878, AIX is affected by multiple vulnerabilities due to Python, and a new version of python (python-3.9.12.0) is available from https://www-01.ibm.com/marketing/iwm/iwm/web/pickUrxNew.do?source=aixbp.

    This caught my eye for a couple of reasons:
    a) all the CVE's listed at https://www.ibm.com/support/pages/node/6607878 are against either expat or libexpat (i.e. not python), and
    b) the level of python available from the AIX Toolbox is only python3-3.7.12-1.ppc (i.e. not 3.9.12.0)

    Should we be concerned that the AIX Web Download Pack version of python appears to be so much newer than the AIX Toolbox version? Or does the AIX Toolbox version incorporate all of the fixes that are in the AIX Web Download Pack version?

    ------------------------------
    Erich Wolz
    ------------------------------

    #AIXOpenSource


  • 2.  RE: AIX is affected by multiple vulnerabilities in Python.

    Posted 08/22/22 03:31 AM

    We are shipping Python3.9 in AIX base from AIX 7.3 onwards. This python is not a replacement for AIX Toolbox python but rather a useful thing if any other AIX native components want to use python. It is built with xlc and linked statically against the dependencies (like expat, bzip2 , gdbm .. etc). Please check "/usr/opt/python3/python3.9_README" for more details.
    Inorder to address the security vulnerabilites faster, we are shipping the updated Python fileset in AIX web download pack programs (just like openssl). 
    So this should not be confused with AIX Toolbox python. 



    ------------------------------
    Ayappan P
    ------------------------------



  • 3.  RE: AIX is affected by multiple vulnerabilities in Python.

    Posted 08/22/22 04:35 AM
    Thank you Ayappan. 
    Just to add python on AIX toolbox is built using dynamic linking and expat on AIX toolbox is updated to fix these vulnerabilities.
    So if you are running with latest packages from AIX toolbox you should be fine. 


    ------------------------------
    SANKET RATHI
    ------------------------------

    Original Message


  • 4.  RE: AIX is affected by multiple vulnerabilities in Python.

    Posted 08/22/22 07:10 PM
    > So this should not be confused with AIX Toolbox python

    Except that I'm still confused... mostly because I don't have the AIX Web Download Pack version of python installed, so I don't have access to a copy of the "/usr/opt/python3/python3.9_README" file :-)

    I get that the two packages are built differently, but don't both of these packages provide python3 functionality (one, the v3.7 version ; the other, the 3.9 version)?  

    ------------------------------
    Erich Wolz
    ------------------------------

    Original Message


  • 5.  RE: AIX is affected by multiple vulnerabilities in Python.

    Posted 08/23/22 03:30 AM
    The Python in AIX web download pack is only for AIX 7.3. It is packaged in lpp format and ships files in a private path "/usr/opt/python3" with symbolic links for binaries like python3, pip3.., created in /usr/bin. As I mentioned earlier, AIX native components can use this python in the future if they want to. AIX native components cannot use Toolbox python or any Toolbox packages. 
    This Python and AIX Toolbox Python will not interfere with each other. And the AIX Toolbox packages like dnf, python3 modules.., all are based out of Toolbox python. We will soon be updating the Toolbox default python 3.7 to python3.9.

    ------------------------------
    Ayappan P
    ------------------------------

    Original Message


  • 6.  RE: AIX is affected by multiple vulnerabilities in Python.

    Posted 08/23/22 09:54 AM
    Thanks for clarifying.  Just to add, when the Toolbox default python3.7 is updated to python3.9, it still won't be affected by the multiple vulnerabilities identified in https://www.ibm.com/support/pages/node/6607878, because the Toolbox expat and libexpat have already been updated?

    ------------------------------
    Erich Wolz
    ------------------------------

    Original Message


  • 7.  RE: AIX is affected by multiple vulnerabilities in Python.

    Posted 08/23/22 09:57 AM
    Yes, that's right. It won't be affected.

    ------------------------------
    Ayappan P
    ------------------------------

    Original Message


Related Content