IT45617: Thirdparty component updates for cumulative security update 9.3.0.17

APAR status

• Closed as program error.

Error description

• List of third party packages updated in cumulative security
  update:  9.3.0.17
  

Local fix

Problem summary

• ****************************************************************
  USERS AFFECTED:
  Users of the IBM MQ components affected by the third party
  product list in the product conclusion.
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  A new version for some third party packages included in IBM MQ
  are available, and updated in MQ CSU 9.3.0.17
  

Problem conclusion

• The following updates are included in this APAR :
  
  - jetty-client 9.4.54.v20240208
  - axios 1.6.8
  - follow-redirects 1.15.6
  - LIBCURL 8.6.0
  - OpenSSL for IBMi 3.0.13
  
  - JRE to 8.0.8.20 on AIX, Windows, and Linux
  -- Applications using the IBM MQ classes for Java and the IBM MQ
  classes for JMS who are running the application using the JRE
  embedded into the MQ installation
  -- IBM MQ Managed File Transfer Edition
  -- IBM MQ Advanced Message Protocol (AMQP)
  -- IBM MQ Telemetry Transport (MQTT)
  -- IBM MQ Explorer
  -- IBM MQ REST API
  -- IBM MQ Console
  -- IBM MQ IPT
  
  --  IBM MQ has assessed the issues addressed in this update and
  will release an IBM MQ security bulletin for any vulnerabilities
  applicable to IBM MQ components? use of the Java APIs and
  runtime environment. Users who use the supplied IBM Java runtime
  to execute other code or applications not supplied with IBM MQ
  should review the complete list of vulnerabilities fixed to
  check applicability of any vulnerabilities based on the API
  usage of those applications:
  https://www.ibm.com/support/pages/java-sdk-security-vulnerabilit
  ies
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v9.3 LTS   9.3.0.17
  
  The latest available maintenance can be obtained from
  'IBM MQ Recommended Fixes'
  https://www.ibm.com/support/pages/recommended-fixes-ibm-mq
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'IBM MQ
  Planned Maintenance Release Dates'
  https://ibm.biz/mqplannedmaintenance
  
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  MQ BASE V9.3

• Fixed component ID

  5724H7291

Applicable component levels