IT02529: TPC 5.X-SECURITY VULNERABILITIES HAVE BEEN DISCOVERED IN OPENSSL THAT WERE REPORTED ON JUNE 5, 2014 BY THE OPENSSL PROJECT.

Fix Pack 5.1.1.5 (July 2014) for Tivoli Storage Productivity Center
Fix Pack 5.2.4 (November 2014) for Tivoli Storage Productivity Center
Fix Pack 5.2.4.1 (December 2014) for Tivoli Storage Productivity Center
Refresh Pack 5.2.5 (March 2015) for Tivoli Storage Productivity Center (withdrawn)
Fix Pack 5.1.1.6 (March 2015) for Tivoli Storage Productivity Center
Fix Pack 5.2.5.1 (April 2015) for Tivoli Storage Productivity Center (withdrawn)
Refresh Pack 5.2.6 (June 2015) for Tivoli Storage Productivity Center
Refresh Pack 5.2.3 (August 2014) for Tivoli Storage Productivity Center
Refresh Pack 5.2.7 (August 2015) for Tivoli Storage Productivity Center
Fix Pack 5.1.1.9 (October 2015) for Tivoli Storage Productivity Center
IBM Spectrum Control V5.2.8 (December 2015)
IBM Spectrum Control V5.2.9 (February 2016)
IBM Spectrum Control V5.2.10 (May 2016)
IBM Spectrum Control V5.2.10.1 (July 2016)
IBM Spectrum Control V5.2.11 (August 2016)
Fix Pack 5.1.1.12 (October 2016) for Tivoli Storage Productivity Center
Fix Pack 5.1.1.13 (February 2017) for Tivoli Storage Productivity Center
Fix Pack 5.1.1.14 (June 2017) for Tivoli Storage Productivity Center
Fix Pack 5.1.1.15 (Sept 2017) for Tivoli Storage Productivity Center
IBM Spectrum Control V5.2.12 (November 2016)
IBM Spectrum Control V5.2.13 (March 2017)
IBM Spectrum Control V5.2.14 (May 2017)
IBM Spectrum Control V5.2.15 (August 2017)
IBM Spectrum Control V5.2.15.2 (November 2017)
IBM Spectrum Control V5.2.16 (March 2018)
IBM Spectrum Control V5.2.17 (May 2018)
IT02536, IT02529: OpenSSL security vulnerabilities in Tivoli Storage Productivity Center CVE CVE-2014-0224
Fix Pack 5.1.1.8 (July 2015) for Tivoli Storage Productivity Center
Fix Pack 5.2.7.1 (February 2016) for Tivoli Storage Productivity Center

APAR status

• Closed as program error.

Error description

• Tivoli Storage Productivity Center is affected by the following
  OpenSSL vulnerabilities: CVE-2014-0224
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * TPC 5.x users monitoring XIV storage systems                 *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * See ERROR DESCRIPTION.                                       *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Refer to the security bulletin and apply fix maintenance as  *
  * soon as practicable.                                         *
  * http://www.ibm.com/support/docview.wss?uid=swg21677131       *
  ****************************************************************
  

Problem conclusion

• The fix for this APAR is targeted for the following maintenance
  package:
  
  | fix pack | 5.1.1-TIV-TPC-FP0005 - target July 2014
  | refresh pack | 5.2-TIV-TPC-RP0003 - target August 2014
  
  http://www-01.ibm.com/support/docview.wss?&uid=swg21320822
  
  An interim fix is available now.
  http://www.ibm.com/support/docview.wss?uid=swg21677131
  The target dates for future refresh packs or fix packs do not
  represent a formal commitment by IBM. The dates are subject to
  change without notice.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Modules/Macros

• OpenSSL
  

Fix information

• Fixed component name

  TPC

• Fixed component ID

  5608TPC00

Applicable component levels

• R510 PSY

     UP

• R511 PSY

     UP

• R520 PSY

     UP

• R521 PSY

     UP

• R522 PSY

     UP