Re: [gpfsug-discuss] GPFS vulnerability with possible root exploit on versions prior to 5.0.4.3 (and 4.2.3.21)

2020-04-22 Thread Bhupender thakur
Thanks for the clarification Felipe. On Wed, Apr 22, 2020 at 1:06 PM Felipe Knop wrote: > Bhupender, > > PTFs for the 5.0.3 branch are no longer produced (as is the case for > 5.0.2, 5.0.1, and 5.0.0), but efixes for 5.0.3 can be requested. When > requesting the efix, please indicate the APAR

Re: [gpfsug-discuss] GPFS vulnerability with possible root exploit on versions prior to 5.0.4.3 (and 4.2.3.21)

2020-04-22 Thread Bhupender thakur
Has IBM released or does IBM plan to release a fix in the 5.0.3.x branch? On Wed, Apr 22, 2020 at 8:45 AM Felipe Knop wrote: > Stephan, > > Security bulletins need to go through an internal process, including legal > review. In addition, we are normally required to ensure the fix is > available

Re: [gpfsug-discuss] GPFS vulnerability with possible root exploit on versions prior to 5.0.4.3 (and 4.2.3.21)

2020-04-22 Thread Felipe Knop
Stephan,   Security bulletins need to go through an internal process, including legal review. In addition, we are normally required to ensure the fix is available for all releases before the security bulletin can be published. Because of that, we normally don't list details for security fixes in

Re: [gpfsug-discuss] GPFS vulnerability with possible root exploit on versions prior to 5.0.4.3 (and 4.2.3.21)

2020-04-22 Thread Stephan Graf
Hi I took a lookat the "Readme and Release notes for release 5.0.4.3 IBM Spectrum Scale 5.0.4.3 Spectrum_Scale_Data_Management-5.0.4.3-x86_64-Linux Readme" But I did not find the entry which mentioned the "For IBM Spectrum Scale V5.0.0.0 through V5.0.4.1, reference APAR IJ23438" APAR number

[gpfsug-discuss] GPFS vulnerability with possible root exploit on versions prior to 5.0.4.3 (and 4.2.3.21)

2020-04-22 Thread Jaime Pinto
In case you missed (the forum has been pretty quiet about this one), CVE-2020-4273 had an update yesterday: https://www.ibm.com/support/pages/node/6151701?myns=s033=OCSTXKQY=E_sp=s033-_-OCSTXKQY-_-E If you can't do the upgrade now, at least apply the mitigation to the client nodes generally