IBM QRadar

IBM is notifying administrators that an upgrade issue might affect a small number of Consoles in QRadar 7.4.3 and QRadar 7.4.3 Fix Pack 1 that is under investigation. QRadar Development temporarily removed the SFS files for QRadar 7.4.3 and 7.4.3 Fix Pack 1 from IBM Fix Central and administrators are advised to delay QRadar 7.4.3 or 7.4.3 Fix Pack 1 upgrades. If you upgraded to QRadar 7.4.3 or 7.4.3 Fix Pack 1, administrators must review this support notice and open a case for support to review your Console.

Flash Notice: https://www.ibm.com/support/pages/node/6480739

If you use QRadar SIEM and upgraded to either of these versions, open a case as described in the flash notice and we can quickly review your Console. Be sure to use a case title of: 7.4.3 Upgrade QR29880.

NOTE: QRadar on Cloud Console appliances are being reviewed by DevOps teams. There is no reason for QRadar on Cloud admins to open a case if they are using QRadar on Cloud 7.4.3.

As more information becomes available, the flash notice will be updated.

Update: The ISO for QRadar 7.4.3 is still available on IBM Fix Central as new installs are not impacted by this upgrade issue. ISO files are only used for new appliance installations, therefore this issue does not impact users who complete new installs of QRadar 7.4.3 using the ISO file.

Hi Jonathan,

thanks for this update. I've just followed your instructions.

Regards,

Ralph

The initial flash notice has been updated to include more information. This issue relates to CVE -2021-29880 for users with domains configured.

A Security Bulletin for the CVE was issued to all users to identify this issue. If you do not have domains configured, you are not affected. If you have domains configured, we are asking those users to open a QRadar Support case so we can confirm the issue as described in the updated flash notice text.