<div class="socmaildefaultfont" dir="ltr" style="font-family:Arial, Helvetica, sans-serif;font-size:10pt" ><div dir="ltr" >Bhupender,</div>
<div dir="ltr" > </div>
<div dir="ltr" >PTFs for the 5.0.3 branch are no longer produced (as is the case for 5.0.2, 5.0.1, and 5.0.0), but efixes for 5.0.3 can be requested. When requesting the efix, please indicate the APAR number listed in bulletin below, as well as the location of the bulletin itself, just in case:</div>
<div dir="ltr" > </div>
<div dir="ltr" ><a href="https://www.ibm.com/support/pages/node/6151701?myns=s033&mynp=OCSTXKQY&mync=E&cm_sp=s033-_-OCSTXKQY-_-E">https://www.ibm.com/support/pages/node/6151701?myns=s033&mynp=OCSTXKQY&mync=E&cm_sp=s033-_-OCSTXKQY-_-E</a></div>
<div dir="ltr" > </div>
<div dir="ltr" > Felipe</div>
<div dir="ltr" > </div>
<div dir="ltr" >----<br>Felipe Knop knop@us.ibm.com<br>GPFS Development and Security<br>IBM Systems<br>IBM Building 008<br>2455 South Rd, Poughkeepsie, NY 12601<br>(845) 433-9314 T/L 293-9314<br> </div>
<div dir="ltr" > </div>
<div dir="ltr" > </div>
<blockquote data-history-content-modified="1" data-history-expanded="1" dir="ltr" style="border-left:solid #aaaaaa 2px; margin-left:5px; padding-left:5px; direction:ltr; margin-right:0px" >----- Original message -----<br>From: Bhupender thakur <thakur.hpc@gmail.com><br>Sent by: gpfsug-discuss-bounces@spectrumscale.org<br>To: gpfsug main discussion list <gpfsug-discuss@spectrumscale.org><br>Cc:<br>Subject: [EXTERNAL] Re: [gpfsug-discuss] GPFS vulnerability with possible root exploit on versions prior to 5.0.4.3 (and 4.2.3.21)<br>Date: Wed, Apr 22, 2020 2:24 PM<br>
<div dir="ltr" ><div dir="ltr" >Has IBM released or does IBM plan to release a fix in the<span style="font-size:13.333333015441895px" > 5.0.3.x branch?</span></div></div>
<div><div dir="ltr" >On Wed, Apr 22, 2020 at 8:45 AM Felipe Knop <<a href="mailto:knop@us.ibm.com" target="_blank">knop@us.ibm.com</a>> wrote:</div>
<blockquote style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex" ><div dir="ltr" style="font-family:Arial,Helvetica,sans-serif;font-size:10pt" ><div dir="ltr" >Stephan,</div>
<div dir="ltr" > </div>
<div dir="ltr" >Security bulletins need to go through an internal process, including legal review. In addition, we are normally required to ensure the fix is available for all releases before the security bulletin can be published. Because of that, we normally don't list details for security fixes in either the readmes or APARs, since the information can only be disclosed in the bulletin itself.</div>
<div dir="ltr" > </div>
<div dir="ltr" >----</div>
<div dir="ltr" >The bulletin below has:</div>
<div dir="ltr" > </div>
<div dir="ltr" style="margin-left:40px" >If you cannot apply the latest level of service, contact IBM Service for an efix:</div>
<div dir="ltr" ><p style="margin-left:40px" >- For IBM Spectrum Scale V5.0.0.0 through V5.0.4.1, reference APAR IJ23438</p>
<p style="margin-left:40px" >- For IBM Spectrum Scale V4.2.0.0 through V4.2.3.20, reference APAR IJ23426</p></div>
<div dir="ltr" >"V5.0.0.0 through V5.0.4.1" should have been "V5.0.0.0 through V5.0.4.2". (I have asked the text to be corrected)</div>
<div dir="ltr" > </div>
<div dir="ltr" > </div>
<div dir="ltr" > </div>
<div dir="ltr" > Felipe</div>
<div dir="ltr" > </div>
<div dir="ltr" >----<br>Felipe Knop <a href="mailto:knop@us.ibm.com" target="_blank">knop@us.ibm.com</a><br>GPFS Development and Security<br>IBM Systems<br>IBM Building 008<br>2455 South Rd, Poughkeepsie, NY 12601<br>(845) 433-9314 T/L 293-9314<br> </div>
<div dir="ltr" > </div>
<div dir="ltr" > </div>
<blockquote dir="ltr" style="border-left-width:2px;border-left-style:solid;border-left-color:rgb(170,170,170);margin-left:5px;padding-left:5px;direction:ltr;margin-right:0px" >----- Original message -----<br>From: Stephan Graf <<a href="mailto:st.graf@fz-juelich.de" target="_blank">st.graf@fz-juelich.de</a>><br>Sent by: <a href="mailto:gpfsug-discuss-bounces@spectrumscale.org" target="_blank">gpfsug-discuss-bounces@spectrumscale.org</a><br>To: <<a href="mailto:gpfsug-discuss@spectrumscale.org" target="_blank">gpfsug-discuss@spectrumscale.org</a>><br>Cc:<br>Subject: [EXTERNAL] Re: [gpfsug-discuss] GPFS vulnerability with possible root exploit on versions prior to 5.0.4.3 (and 4.2.3.21)<br>Date: Wed, Apr 22, 2020 5:04 AM<br>
<div><font size="2" face="Default Monospace,Courier New,Courier,monospace" >Hi<br><br>I took a lookat the "Readme and Release notes for release 5.0.4.3 IBM<br>Spectrum Scale 5.0.4.3<br>Spectrum_Scale_Data_Management-5.0.4.3-x86_64-Linux Readme"<br>But I did not find the entry which mentioned the "For IBM Spectrum Scale<br>V5.0.0.0 through V5.0.4.1, reference APAR IJ23438" APAR number which is<br>mentioned on the "Security Bulletin: A vulnerability has been identified<br>in IBM Spectrum Scale where an unprivileged user could execute commands<br>as root ( CVE-2020-4273)" page.<br><br>shouldn't it be mentioned there?<br><br>Stephan<br><br><br>Am 22.04.2020 um 10:19 schrieb Jaime Pinto:<br>> In case you missed (the forum has been pretty quiet about this one),<br>> CVE-2020-4273 had an update yesterday:<br>><br>> <a href="https://www.ibm.com/support/pages/node/6151701?myns=s033&mynp=OCSTXKQY&mync=E&cm_sp=s033-_-OCSTXKQY-_-E" target="_blank">https://www.ibm.com/support/pages/node/6151701?myns=s033&mynp=OCSTXKQY&mync=E&cm_sp=s033-_-OCSTXKQY-_-E</a> <br>><br>><br>> If you can't do the upgrade now, at least apply the mitigation to the<br>> client nodes generally exposed to unprivileged users:<br>><br>> Check the setuid bit:<br>> ls -l /usr/lpp/mmfs/bin | grep r-s | awk '{system("ls -l<br>> /usr/lpp/mmfs/bin/"$9)}')<br>><br>> Apply the mitigation:<br>> ls -l /usr/lpp/mmfs/bin | grep r-s | awk '{system("chmod u-s<br>> /usr/lpp/mmfs/bin/"$9)}'<br>><br>> Verification:<br>> ls -l /usr/lpp/mmfs/bin | grep r-s | awk '{system("ls -l<br>> /usr/lpp/mmfs/bin/"$9)}')<br>><br>> All the best<br>> Jaime<br>><br>> .<br>> .<br>> . ************************************<br>> TELL US ABOUT YOUR SUCCESS STORIES<br>> <a href="http://www.scinethpc.ca/testimonials" target="_blank">http://www.scinethpc.ca/testimonials</a><br>> ************************************<br>> ---<br>> Jaime Pinto - Storage Analyst<br>> SciNet HPC Consortium - Compute/Calcul Canada<br>> <a href="http://www.scinet.utoronto.ca" target="_blank">www.scinet.utoronto.ca</a> - <a href="http://www.computecanada.ca" target="_blank">www.computecanada.ca</a><br>> University of Toronto<br>> 661 University Ave. (MaRS), Suite 1140<br>> Toronto, ON, M5G1M1<br>> P: 416-978-2755<br>> C: 416-505-1477<br>> _______________________________________________<br>> gpfsug-discuss mailing list<br>> gpfsug-discuss at <a href="http://spectrumscale.org" target="_blank">spectrumscale.org</a><br>> <a href="http://gpfsug.org/mailman/listinfo/gpfsug-discuss" target="_blank">http://gpfsug.org/mailman/listinfo/gpfsug-discuss</a></font><br> </div>
<div id="gmail-m_7924886576552699466MIMEAttachInfoDiv" style="display:none" title="octet-stream|smime.p7s" > </div>
<div><font size="2" face="Default Monospace,Courier New,Courier,monospace" >_______________________________________________<br>gpfsug-discuss mailing list<br>gpfsug-discuss at <a href="http://spectrumscale.org" target="_blank">spectrumscale.org</a><br><a href="http://gpfsug.org/mailman/listinfo/gpfsug-discuss" target="_blank">http://gpfsug.org/mailman/listinfo/gpfsug-discuss</a></font></div></blockquote>
<div dir="ltr" > </div></div><br>_______________________________________________<br>gpfsug-discuss mailing list<br>gpfsug-discuss at <a href="http://spectrumscale.org" rel="noreferrer" target="_blank">spectrumscale.org</a><br><a href="http://gpfsug.org/mailman/listinfo/gpfsug-discuss" rel="noreferrer" target="_blank">http://gpfsug.org/mailman/listinfo/gpfsug-discuss</a></blockquote></div>
<div><font size="2" face="Default Monospace,Courier New,Courier,monospace" >_______________________________________________<br>gpfsug-discuss mailing list<br>gpfsug-discuss at spectrumscale.org<br><a href="http://gpfsug.org/mailman/listinfo/gpfsug-discuss" target="_blank">http://gpfsug.org/mailman/listinfo/gpfsug-discuss</a> </font></div></blockquote>
<div dir="ltr" > </div></div><BR>