Release Notes
Abstract
This technical note provides guidance for installing IBM Guardium Data Protection patch 11.0p580, including any new features or enhancements, resolved or known issues, or notices associated with the patch.
Content
Patch information
- Patch file name: SqlGuard-11.0p580_Bundle_Jan_15_2026.tgz.enc.sig
- MD5 checksum: e09ca7c2f320b5ed18226c41d3a15cff
Finding the patch
- Select the following options to download this patch on the IBM Fix Central website and click Continue.
- Product selector: IBM Security Guardium
- Installed version: 11.5
- Platform: All
- On the "Identify fixes" page, select Browse for fixes and click Continue.
- On the "Select fixes" page, select Appliance Bundle. Then, enter the patch information in the Filter fix details field to locate the patch.
For information about Guardium patch types and naming conventions, see the Understanding Guardium patch types and patch names support document.
Prerequisites
- Guardium 11.0p500 (see release note)
- The latest Guardium health check patch 11.0p9997
- The latest Guardium patch signing certificate on your Guardium appliance. For more information, see IBM Guardium - Patch signing certificate set to expire in March 2025.
Installation
Notes:
- This patch is an appliance bundle that includes fixes for version 11.5.
- This patch is cumulative and includes all the fixes from previously released patches.
- This patch restarts the Guardium system.
- Do not reboot the appliance while the patch install is in progress. Contact IBM Support if there is an issue with patch installation.
- When changing the password of CLI and guardcli users in the Guardium command line interface, a password strength warning appears even when strong passwords are not enabled. To remove the strong password checks, execute the CLI command store user strong_password disable.
- If you have single sign-on enabled and are upgrading from below 11.0p530, you must re-download metadata from the upgraded central manager and apply it on the identity provider.
Overview:
- Download the patch and extract the compressed package outside the Guardium system.
- Be sure to check the latest version of this patch release note online just before you install this patch.
- Pick a "quiet" or low-traffic time to install the patch on the Guardium system.
- Apply the latest health check patch.
- Install patches in a top-down manner on all Guardium systems: start with the central manager, then aggregators, then the collectors.
- Apply the latest quarterly Guardium Data Protection Service (DPS) patch and Rapid Response DPS patches available on the IBM Fix Central website.
For information about installing patches, see Installing patches in the Guardium documentation.
Attention
Guardium appliance bundle upgrade time extended due to MySQL tables conversion
Following MySQL support requirements, most tables are converted from MyISAM to InnoDB starting with Guardium appliance bundle versions 11.0p550 and later, and versions 12.0p25 and later. Due to the large size of some tables, which are mostly static tables, the conversion might consume more time than usual during an appliance bundle upgrade. Note: Do not cancel the patch installation process. If you have any concerns, contact IBM Support. For more information, see Guardium appliance bundle upgrade time extended due to MySQL tables conversion.
Guardium sniffer certification expired on 3 March 2025
The previous sniffer default certificate expired on 3 March 2025 and you must install a Guardium appliance patch to renew the certificate. For Guardium 11.5 systems, appliance bundle patch 11.0p545 or later provides an updated certificate. For more information, see IBM Guardium sniffer certification expires March 2025.
The previous sniffer default certificate expired on 3 March 2025 and you must install a Guardium appliance patch to renew the certificate. For Guardium 11.5 systems, appliance bundle patch 11.0p545 or later provides an updated certificate. For more information, see IBM Guardium sniffer certification expires March 2025.
Guardium patch signing certificate expired on 29 March 2025
Guardium appliance patches are signed by an internal certificate to validate that the patch is created by Guardium. Unsigned patch files cannot be installed. The previous patch signing certificate for Guardium appliance patches expired on 29 March 2025. This patch, 11.0p580, is signed by the new patch signing certificate. Therefore, to install this patch, your Guardium appliance must be prepared by installing an ad hoc or bundle patch with the fix that allows patches signed by old or new certificates to be installed. See IBM Guardium - Patch signing certificate set to expire in March 2025 and follow the steps in the "What to do after March 29th 2025" section if the patch signing certificate was not renewed.
Guardium appliance patches are signed by an internal certificate to validate that the patch is created by Guardium. Unsigned patch files cannot be installed. The previous patch signing certificate for Guardium appliance patches expired on 29 March 2025. This patch, 11.0p580, is signed by the new patch signing certificate. Therefore, to install this patch, your Guardium appliance must be prepared by installing an ad hoc or bundle patch with the fix that allows patches signed by old or new certificates to be installed. See IBM Guardium - Patch signing certificate set to expire in March 2025 and follow the steps in the "What to do after March 29th 2025" section if the patch signing certificate was not renewed.
SHA256 GIM client certificates
After applying patch 11.0p530 or later, Guardium supports SHA256 Guardium Installation Manager (GIM) certificates. This has the following implications:
After applying patch 11.0p530 or later, Guardium supports SHA256 Guardium Installation Manager (GIM) certificates. This has the following implications:
- The default certificates could be either SHA256 or SHA128, depending on the GIM server certificate setup. Custom certificates that use SHA256 are more secure and are recommended for GIM connections. Note that GIM connectivity is not interrupted after applying this patch.
- GIM only verifies bundles signed with SHA256 and requires installation of a transitional GIM bundle to support the GIM client change from SHA128 to SHA256.
For more information, see Updating Guardium Data Protection GIM clients with SHA256 certificates.
Microsoft certificates expired on 20 May 2024
Microsoft certificates (microsoftca1-4) expired on 20 May 2024. The following Guardium patches provide updated certificates:
Microsoft certificates (microsoftca1-4) expired on 20 May 2024. The following Guardium patches provide updated certificates:
- 11.3 systems that use patch 11.0p392 or later
- 11.4 systems that use patch 11.0p485 or later
- 11.5 systems that use patch 11.0p535 or later
- 12.0 systems that use patch 12.0p5 or later
Install the correct patch for your Guardium systems to use the updated certificates. For more information, see https://www.ibm.com/support/pages/node/7080145
Enhancements
This patch includes the following enhancements.
| Issue key | Summary |
|---|---|
| GRD-101421 | Support for configuring proxy settings with certificates by using the store certificate keystore trusted console CLI command to import the proxy certification authority (CA) certificate into the Guardium keystore across all managed units. The certificate alias can be any arbitrary value. The alias name does not affect functionality. For more information, see Certificate CLI Commands. |
| GRD-115452 | Updated Java Database Connectivity (JDBC) drivers for Oracle, Microsoft SQL Server, Apache Cassandra, and Datastax Cassandra. |
Resolved issues
This patch resolves the following issues.
Patch | Issue key | Summary | Known issue (APAR) |
|---|---|---|---|
| 11.0p575 | See release note for patch 11.0p575 | ||
| 11.0p580 | GRD-88744 | Analytic User Feedback report unavailable in Query-Report Builder | DT451550 |
| GRD-109498 | Policy rule did not work correctly | DT454346 | |
| GRD-110653 | Vulnerability Assessment scan results for IBM Db2 for z/OS show message "Unsupported Security PTF patch detected" for Db2 for z/OS Authorized Program Analysis Report (APAR) product temporary fix (PTF) starting with 'UO' prefix | DT454625 | |
| GRD-111612 | "License key is NULL" message appears when accepting license in GUI after collector is patched to 11.0p550 if appliance language is Japanese | DT455239 | |
| GRD-112324 | Authentication error from the Alerter if the SMTP server uses NTLM and Guardium SMTP mail is configured with AUTH set, and STARTTLS on/enabled | DT458928 | |
| GRD-113956 | Failure accessing reports in a shared dashboard | DT457609 | |
| GRD-114046 | Same policy shows several times on GUI on the collector | DT455569 | |
| GRD-114739 | All managed units stay in inactive state on new primary central manager after disaster recovery drill | DT459564 | |
| GRD-115058 | After upgrading Guardium to version 12.2 the Risk Spotter policy disappeared | DT457592 | |
| GRD-116040 | store cli_userauth ldap CLI command failed | DT457706 | |
| GRD-117233 | Unable to access system with IP address after SAML was enabled |
Security fixes
This patch contains the following security fixes.
Patch | Issue key | Summary | CVE |
|---|---|---|---|
| 11.0p575 | See release note for patch 11.0p575 | ||
| 11.0p580 | GRD-91110 | PSIRT: PVR0559560, PVR0571236 Multiple spring-components (Publicly disclosed vulnerability found by Mend) - webapps | CVE-2024-38820, CVE-2024-38827 |
| GRD-100242 | PSIRT: PVR0642761 IBM SDK, Java Technology Edition Quarterly CPU - Apr 2025 - Includes Oracle April 2024 CPU plus CVE-2025-4447 | CVE-2025-4447 | |
| GRD-107750 | SE - Nessus - RHEL 7 : python3-setuptools (RHSA-2025:11607) | CVE-2025-47273 | |
| GRD-107763 | SE - Nessus - RHEL 7 : sqlite (RHSA-2025:12349) | CVE-2025-6965 | |
| GRD-107781 | SE - Nessus - RHEL 7 : libxml2 (RHSA-2025:13464) | CVE-2025-7425 | |
| GRD-108470 | SE - Nessus - RHEL 7 : libxml2 (RHSA-2025:13789) | CVE-2025-32415 | |
| GRD-109149 | SE - Nessus - RHEL 7 : squid (RHSA-2025:14414) | CVE-2021-28651, CVE-2025-54574 | |
| GRD-109477 | SE - Nessus - RHEL 7 : libarchive (RHSA-2025:14828) | CVE-2025-5914 | |
| GRD-109478 | SE - Nessus - RHEL 7 : kernel (RHSA-2025:14748) | CVE-2022-49788, CVE-2022-50020, CVE-2022-50022, CVE-2024-57980, CVE-2025-21928, CVE-2025-23150, CVE-2025-38000, CVE-2025-38177, CVE-2025-38350 | |
| GRD-109788 | SE - Nessus - RHEL 7 : pam (RHSA-2025:15106) | CVE-2025-8941, CVE-2025-6020 | |
| GRD-110391 | SE - Nessus - RHEL 7 : linux-firmware (RHSA-2023:7513) | CVE-2023-20569, CVE-2023-20593 | |
| GRD-110393 | SE - Nessus - RHEL 7 : kernel (RHSA-2025:15648) | CVE-2025-38332, CVE-2025-38352 | |
| GRD-110659 | SE - Nessus - RHEL 7 : postgresql (RHSA-2025:16099) | CVE-2025-8714 | |
| GRD-110660 | SE - Nessus - RHEL 7 : python3 (RHSA-2025:16117) | CVE-2025-8194 | |
| GRD-110780 | SE - Nessus - RHEL 7 : udisks2 (RHSA-2025:16130) | CVE-2025-8067 | |
| GRD-111453 | SE - Nessus - RHEL 7 : kernel (RHSA-2025:17161) | CVE-2022-48701, CVE-2022-50211, CVE-2022-50229, CVE-2023-53125, CVE-2025-38200, CVE-2025-38477 | |
| GRD-113396 | SE - Nessus - RHEL 7 : squid (RHSA-2025:19167) | CVE-2025-62168, CVE-2021-28651, CVE-2025-54574 | |
| GRD-114008 | PSIRT: PVR0685130 IBM SDK, Java Technology Edition Quarterly CPU - Oct 2025 - Includes Oracle October 2025 CPU | CVE-2025-53066, CVE-2025-53057 | |
| GRD-114237 | SE - Nessus - RHEL 7 : sssd (RHSA-2025:19847) | CVE-2025-11561 | |
| GRD-114729 | SE - Nessus - RHEL 7 : kernel (RHSA-2025:21063) | CVE-2022-48978, CVE-2023-53373, CVE-2025-22026, CVE-2025-37797, CVE-2025-38556, CVE-2022-49788, CVE-2022-50020, CVE-2022-50022, CVE-2024-57980, CVE-2025-21928, CVE-2025-23150, CVE-2025-38000, CVE-2025-38177, CVE-2025-38350, CVE-2022-48701, CVE-2022-50211, CVE-2022-50229, CVE-2023-53125, CVE-2025-38200, CVE-2025-38477, CVE-2025-38332, CVE-2025-38352, CVE-2023-53305, CVE-2025-38718, CVE-2022-50408, CVE-2022-3640, CVE-2023-53365, CVE-2022-50386, CVE-2022-50341 | |
| GRD-115557 | SE - Nessus - RHEL 7 : linux-firmware (RHSA-2024:5978) | CVE-2023-31315 | |
| GRD-115569 | SE - Nessus - RHEL 7 : python3 (RHSA-2025:1750) | CVE-2024-6232 | |
| GRD-115585 | SE - Nessus - RHEL 7 : perl-FCGI (RHSA-2025:8625) | CVE-2025-40907 | |
| GRD-115805 | SE - Nessus - RHEL 7 : xorg-x11-server (RHSA-2025:22040) | CVE-2025-62229, CVE-2025-62230, CVE-2025-62231 | |
| GRD-116218 | SE - Nessus - RHEL 7 : bind (RHSA-2025:22205) | CVE-2025-40778 | |
| GRD-117015 | CVE-2025-55752- Tomcat upgrade in Guardium v11.x | CVE-2025-55752 |
[{"Type":"MASTER","Line of Business":{"code":"LOB76","label":"Data Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSMPHH","label":"IBM Security Guardium"},"ARM Category":[{"code":"a8m3p000000PCTuAAO","label":"Platform\/Installation\/Deployment"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"11.5.0"}]
Was this topic helpful?
Document Information
Modified date:
22 April 2026
UID
ibm17259480