Fix (APAR): PH46897 Status: Fix Release: 9.0.5.12,9.0.5.11 Operating System: AIX,HP-UX,Linux,Solaris,Windows,z/OS Supersedes Fixes: PH44829, PH44271 CMVC Defect: xxxxxx Byte size of APAR: 37123958 Date: 2022-06-14 Abstract: Multiple vulnerabilities in IBM HTTP Server used by IBM WebSphere Application Server (CVE-2022-26377 CVSS 7.3 and more) Description/symptom of problem: PH46897 resolves the following problem: CVE-2022-26377 (n/a on 9.0) CVE-2022-28614 CVE-2022-28615 CVE-2022-29404 (9.0 only) CVE-2022-30556 (9.0 only) CVE-2022-31813 ERROR DESCRIPTION: Confidential for Security Integrity ifix for CVE-2022-26377 (and more) PROBLEM SUMMARY: Confidential for Security Integrity ifix for CVE-2022-26377 (and more) PROBLEM CONCLUSION: Confidential for CVE-2022-26377 Directions to apply fix: Special Instructions: None NOTE: The user must: * Be at V1.8.5 or newer of the Installation Manager. Certain iFixes may require a newer version of the Installation Manager and the Installation Manager will inform you during the installation process if a newer version is required. * Be logged in with the same authority level when unpacking a fix, fix pack, or refresh pack. The IBM Information Center can provide details, if needed, on the use of the Installation Manager to apply the interim fix: http://www.ibm.com/support/knowledgecenter/SSDV2W_1.8.5/com.ibm.cic.agent.ui.doc/helpindex_imic.html. 1) Shutdown IBM HTTP Server 2) Apply the interim fix using Installation Manager 3) Restart IBM HTTP Server Directions to remove fix: The IBM Information Center can provide details, if needed, on the use of the Installation Manager to remove the interim fix: http://www.ibm.com/support/knowledgecenter/SSDV2W_1.8.5/com.ibm.cic.agent.ui.doc/helpindex_imic.html. 1) Shutdown IBM HTTP Server 2) Remove the interim fix using Installation Manager 3) Restart IBM HTTP Server Directions to re-apply fix: 1) Stop IBM HTTP Server. 2) Follow the directions to apply the fix. 3) Restart IBM HTTP Server. Additional Information: