> Next week, there will be new advisory published for openssl.
Looks like what we need isn't SUMA, but a "pull from ibm.com" flag for update_all...
;-)
Original Message:
Sent: 10/13/26 05:47 AM
From: Sandeep Umesh
Subject: Problem with DNS and openssl_fix49
Please hold on with this ifix for now.
Next week, there will be new advisory published for openssl.
------------------------------
Sandeep Umesh
AIX Security Development
IBM India Pvt Ltd
------------------------------
Original Message:
Sent: 10/13/26 05:15 AM
From: José Pina Coelho
Subject: Problem with DNS and openssl_fix49
Hi Sandeep,
It would be up to the sysadmin to create scripts that validate that his use cases are still intact after the updates are installed.
Most people would create/use a test for sshd, since they need sshd. Someone that arrives at the machine through other means doesn't need the sshd test, and should test their means of arrival.
Another option is a script at the end of inittab that does the tests and if they fail automatically rollback + reboot.
As things stand currently, you have to apply the updates manually and test to decide if you should reject.
Remote updates keep running into issues with failed sshd, which pushes you into either mksysb or alt_rootvg recoveries, this work can and should be automated/automatable.
BTW: since you're in the AIX security development, can you please check if you can get the bad ifix handling to move from multiple versions of the ifix package to pulling the bad one and releasing the fixed one with a bumped version ?
Regards, Jp.
------------------------------
José Pina Coelho
IT Specialist at Kyndryl
------------------------------
Original Message:
Sent: 10/13/26 02:38 AM
From: Sandeep Umesh
Subject: Problem with DNS and openssl_fix49
That's a good thought. But who will create and maintain this /etc/accept.sh ?
There could be different scripts based on the updates / filesets that requires to be installed.
Sandeep Umesh
AIX Security Development
------------------------------
Sandeep Umesh
------------------------------
Original Message:
Sent: 10/12/26 08:17 AM
From: José Pina Coelho
Subject: Problem with DNS and openssl_fix49
Yes, validation is good, but since we've been having more of this sort of issues lately, I wonder if we now need another flag to installp/update_all...
something along the lines of: "Install updates/filesets/whatever, run the specified acceptance test script, reject the changes if acceptance test fails".
update_all -cYd /mnt/73tl4sp1 -T /etc/accept.sh
/etc/accept.sh:
(sshd -T && lssrc -s sshd | grep active) || exit 1 # Before we test anything else, check that sshd is OK
...
for i in $(find /etc/accept.d -type f)
do
[ -x $i ] && { $i || exit 1 ; }
done
------------------------------
José Pina Coelho
IT Specialist at Kyndryl
------------------------------
Original Message:
Sent: 10/12/26 07:23 AM
From: Alexander Pettitt
Subject: Problem with DNS and openssl_fix49
Yes, I agree that if it is broken it should be pulled. There has to be another announcement and another download anyway.
I feel validated by my post ifix reconnect and sudo to root testing before closing my existing root shell. I will never wonder if it is a waste of time again.
------------------------------
Alexander Pettitt
------------------------------
Original Message:
Sent: 10/12/26 06:16 AM
From: José Pina Coelho
Subject: Problem with DNS and openssl_fix49
I really with they'd stop doing this and start pulling 49 and publishing 50... otherwise asking things like "what advisory did we install on openssl" becomes unanswerable...
------------------------------
José Pina Coelho
IT Specialist at Kyndryl
------------------------------
Original Message:
Sent: 10/09/26 06:59 AM
From: Alexander Pettitt
Subject: Problem with DNS and openssl_fix49
There is a new version of the openssl 49 fix - https://aix.software.ibm.com/aix/efixes/security/openssl_advisory49.asc
CHANGE HISTORY: First Issued: Wed Sep 30 06:56:20 CDT 2026 Updated: Fri Oct 9 03:18:49 CDT 2026 Update: Updated the iFix to include the previously missing OpenSSL 1.1 and 1.0.2 shared libraries.
------------------------------
Alexander Pettitt
------------------------------
Original Message:
Sent: 10/08/26 02:29 AM
From: Łukasz Czepelski
Subject: Problem with DNS and openssl_fix49
Revert the patch and update everything-dnf, sudo, rsync, etc. (all of which depend on libcrypto.so.1.1).
------------------------------
Łukasz Czepelski
------------------------------