AIX

 View Only
Expand all | Collapse all

Patches conflicting with less than most current version of Storage Protect

  • 1.  Patches conflicting with less than most current version of Storage Protect

    IBM Champion
    Posted Sun July 21, 2024 06:34 AM

    I patched AIX to address some CVEs.  Now I can't get our Storage Protect 8.1.19 running due to ciphers/TLS.

    The other team has found that 8.1.23 has found that it updates Storage Protect ciphers/TLS.

    Apparently I'm not the first...

    Our Manages Services provider is one of those that likes to stay on a version until it's about to become out of support.  That tends to conflict with the flurry of CVEs coming out...



    ------------------------------
    Robert Berendt IBMChampion
    ------------------------------


  • 2.  RE: Patches conflicting with less than most current version of Storage Protect

    Posted Mon July 22, 2024 02:57 AM

    Hi!

    Can you share some details, what you upgraded?  We are using Storage Protect as well, but haven't run into any trouble, yet.  But our backup team was planing some upgrades in the coming weeks.  So some more details might be interesting for them.


    Best regards,

      Alexander



    ------------------------------
    Alexander Reichle-Schmehl
    ------------------------------

    Original Message


  • 3.  RE: Patches conflicting with less than most current version of Storage Protect

    IBM Champion
    Posted Mon July 22, 2024 04:59 AM

    I put on these patches:

    Vulnerability in libxml2 could allow a remote attacker to cause a denial of service (CVE-2024-25062)
    https://aix.software.ibm.com/aix/efixes/security/libxml2_advisory6.asc

    Vulnerability in sendmail could allow a remote attacker to spoof an email (CVE-2023-51765).
    https://aix.software.ibm.com/aix/efixes/security/sendmail_advisory4.asc

    AIX is vulnerable to privilege escalation (CVE-2024-27273)
    https://aix.software.ibm.com/aix/efixes/security/kernel_advisory7.asc

    AIX is vulnerable to a denial of service (CVE-2024-2511, CVE-2024-0727) due to OpenSSL
    https://www.ibm.com/support/pages/node/7160457

    After these I had SSL issues.  No, I do not have details.

    Since my original post Storage Protect was upgraded to 8.1.23 and it still doesn't seem to be working.  Our BP is working with IBM on this.



    ------------------------------
    Robert Berendt IBMChampion
    ------------------------------

    Original Message


  • 4.  RE: Patches conflicting with less than most current version of Storage Protect

    Posted Mon July 22, 2024 11:29 AM

    Thanks for sharing the informations you could provide.  I passed them along to my backup colleagues for their consideration in their upgrade tests.



    ------------------------------
    Alexander Reichle-Schmehl
    ------------------------------

    Original Message