PH62875: SCANNING SOFTWARE TOOL FOUND SEVERAL JAR FILES THAT REQUIRE LATER VERSIONS BE INSTALLED

APAR status

• Closed as program error.

Error description

• Scan tool detected jar files that require later versions. The
  following is a list of some of the files:
  
  Installed Version:
  
  org.bouncycastle:bcprov-jdk15on 1.67
  org.elasticsearch:elasticsearch 7.14.0
  org.apache.cxf:cxf-core 3.5.3
  org.apache.commons:commons-compress 1.21
  org.apache.avro:avro 1.11.1
  

Local fix

• ITXCQ - ITX00062628
  CF  /  CF
  Circumvention: None
  

Problem summary

• Users Affected:
  IBM Transformation Extender users concerned about third party
  vulnerabilities.
  
  Problem Description:
  Various third party libraries had vulnerabilities.
  
  Platforms Affected:
  All
  

Problem conclusion

• Third party libraries were updated.
  
  Specifically:
  eventreporter/elasticsearch-7.17.23.jar
  jars/com.ibm.itx.dtx.m4excel/commons-compress-1.26.0.jar
  jars/com.hcl.hip.adapters.m4kafka/commons-compress-1.26.0.jar
  jars/com.hcl.hip.adapters.m4kafka/avro-1.11.3.jar
  restapi/tx-rest.war , which contains:
   WEB-INF/lib/bcprov-jdk18on-1.78.1.jar
   WEB-INF/lib/cxf-core-3.5.8.jar
  
  Applies to:
  10.1.2.1
  
  Fixed in the next service packs and releases.
  
  To obtain the fix for this APAR:
  
  To see if the next fix pack or product release is available,
  check the IBM Transformation Extender product Release Notes
  page:
  https://www.ibm.com/support/pages/node/318755
  
  If a fix pack release is available, download it from Fix
  Central:
  http://www.ibm.com/support/fixcentral/
  
  If a new product release is available, download it from
  PassportAdvantage:
  https://www.ibm.com/software/passportadvantage/pao_customer.html
  
  
  If the fix pack or product release is not available and you
  require the APAR fix immediately, request a Limited Availability
  Interim Fix (LAIF) by opening a support Case:
  https://www.ibm.com/mysupport
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  ITX

• Fixed component ID

  5724Q2300

Applicable component levels