IT49002: IBM STORAGE INSIGHTS SECURITY APAR FOR PSIRT-MSC-2024-9045

APAR status

• Closed as program error.

Error description

• TPE ID: PSIRT-MSC-2024-9045
  Record Source: PSIRT
  Description: A malicious Polyfill reference has been identified
  in this package. The issue is located in the files:
  "package\demo\index.html" and
  "package\karma.conf.js".
  To address this security concern, we recommend taking one of two
  actions: either remove the affected file completely or replace
  the suspicious reference with a trusted alternative. Reliable
  Polyfill sources include Cloudflare
  (https://cdnjs.cloudflare.com/polyfill) and Fastly
  (https://community.fastly.com/t/new-options-for-polyfill-io-user
  s/2540).
   Mend Note: For more detailed information about the Polyfill
  supply chain attack and its widespread impact, you can refer to
  our comprehensive blog post at
  https://www.mend.io/blog/more-than-100k-sites-impacted-by-polyfi
  ll-supply-chain-attack/.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Storage Insights users                                   *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * SECURITY APAR FOR MSC-2024-9045                              *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  

Problem conclusion

• The fix for this APAR is contained in the following release:
  
  IBM Storage Insights 1Q26   [ 54X-IBM-SI ]
  ( release target 1Q 2026 / January )
  
  To protect IBM Storage Insights against emerging
  security vulnerabilities, the service was updated to
  protected against vulnerabilities.
  
  No action is required, there is nothing that you need
  to do following the IBM Storage Insights upgrade.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  STORAGE INSIGHT

• Fixed component ID

  5608TPCSI

Applicable component levels