IBM Fix list for IBM HTTP Server Version 8.5 - United States Fix list Fixlist List of Updates list of defects maintenance refresh pack cumulative fix fix pack fixpack service pack FixListDocument PRODUCT DOCUMENTATION

ABSTRACT
IBM HTTP Server provides periodic fixes for release 8.5. The following is a complete listing of fixes for Version 8.5 with the most recent fix at the top.

CONTENT
 

[https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/0.1F4.gif] Back to all versions [http://www.ibm.com/support/docview.wss?uid=swg27006973] 


Fix Pack 14 (8.5.5.14) [https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/0.5D6.gif] Fix Pack 13 (8.5.5.13) [https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/0.804.gif] Fix Pack 12 (8.5.5.12) [https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/0.9DA.gif] Fix Pack 11 (8.5.5.11) [https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/0.B56.gif] Fix Pack 10 (8.5.5.10) [https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/0.CD2.gif] Fix Pack 9 (8.5.5.9) [https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/0.E48.gif] Fix Pack 8 (8.5.5.8) [https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/0.FBE.gif] Fix Pack 7 (8.5.5.7) [https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/0.1134.gif] Fix Pack 6 (8.5.5.6) [https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/0.12AA.gif] Fix Pack 5 (8.5.5.5) [https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/0.1420.gif] Fix Pack 4 (8.5.5.4) [https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/0.1596.gif] Fix Pack 3 (8.5.5.3) [https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/0.16F8.gif] Fix Pack 2 (8.5.5.2) [https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/0.185A.gif] Fix Pack 1 (8.5.5.1) [https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/0.19D0.gif] Refresh Pack (8.5.5) [https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/0.1B46.gif] Fix Pack 2 (8.5.0.2) [https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/0.1CBC.gif] Fix Pack 1 (8.5.0.1) 


Fix Pack 14 (8.5.5.14) Fix release date: 20 August 2018
Last modified: 20 August 2018
Status: Recommended

[https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/0.2186.gif]Download Fix Pack 14 [http://www.ibm.com/support/docview.wss?uid=ibm10719839]

This fixpack is delivered for IBM Ported Tools on z/OS using APAR/PTF: PH01159 [http://www.ibm.com/support/docview.wss?uid=isg1PH01159]/ UI57810. Back to Top APAR Description PI90598 CVE-2017-12613 for IBM HTTP Server
http://www-01.ibm.com/support/docview.wss?uid=swg22013598 [http://www-01.ibm.com/support/docview.wss?uid=swg22013598] PI94222 Multiple vulnerabilities in GSKit bundled with IBM HTTP Server
http://www-01.ibm.com/support/docview.wss?uid=swg22015347 [http://www-01.ibm.com/support/docview.wss?uid=swg22015347] PI95670 Multiple vulnerabilities in IBM HTTP Server (CVE-2017-15710, CVE-2017-15715,CVE-2018-1301)
http://www-01.ibm.com/support/docview.wss?uid=swg22015344 [http://www-01.ibm.com/support/docview.wss?uid=swg22015344] PI91075 [http://www.ibm.com/support/docview.wss?uid=swg1PI91075] Add environment variable to record "SSLVersion" failure PI91351 [http://www.ibm.com/support/docview.wss?uid=swg1PI91351] Add toleration for TLS certificate extension InhibitAnyPolicy marked as non-critical PI91850 [http://www.ibm.com/support/docview.wss?uid=isg1PI91850] MVSDS does not list member contents when using relative generation number to create a member list with PDS/PDSE GDG (z/OS only) PI91975 [http://www.ibm.com/support/docview.wss?uid=swg1PI91975] The 'Header unset Content-Type' directive does not unset the Content-Type response header. PI92017 [http://www.ibm.com/support/docview.wss?uid=swg1PI92017] Include CGI program name when writing stderr to the error log when using mod_cgi PI92053 [http://www.ibm.com/support/docview.wss?uid=swg1PI92053] Let child processes avoid graceful shutdown if ECONNREFUSED, ECONNABORTED, ECONNRESET occur during client accept(). PI92092 [http://www.ibm.com/support/docview.wss?uid=isg1PI92092] FSUM6245 seen when upgrading IHS to a new fix pack and using an intermediate symbolic link (z/OS only) PI92407 [http://www.ibm.com/support/docview.wss?uid=isg1PI92407] Log startup message for low 64-bit MEMLIMIT PI93212 [http://www.ibm.com/support/docview.wss?uid=isg1PI93212] Throttle SSL0600E error messages PI93624 [http://www.ibm.com/support/docview.wss?uid=swg1PI93624] Increase default LDAPSharedCacheSize PI94050 [http://www.ibm.com/support/docview.wss?uid=swg1PI94050] High CPU/Hang with IHS mod_auth_basic LDAP PI94539 [http://www.ibm.com/support/docview.wss?uid=swg1PI94539] mod_proxy_http does not allow headers larger than 8K bytes. PI95610 [http://www.ibm.com/support/docview.wss?uid=swg1PI95610] Namespace collision when mod_ibm_ssl.so is loaded alongside libodr.so. PI95964 [http://www.ibm.com/support/docview.wss?uid=isg1PI95964] Add mod_cgi directive to allow users to configure timeouts for CGI applications. PI95983 [http://www.ibm.com/support/docview.wss?uid=swg1PI95983] Allow Content-Type to be edited via the Header directive. PI96321 [http://www.ibm.com/support/docview.wss?uid=swg1PI96321] Update embedded LDAP SDK to 6.4.x PI97314 [http://www.ibm.com/support/docview.wss?uid=swg1PI97314] Add mod_backtrace for Windows 
Note: If the original installation was performed at 8.5.5.11 or earlier, fixpack 8.5.5.14 and later will replace the embedded IBM Java 6 with IBM Java 8.

Note: IBM HTTP Server 8.5.5.14 contains all applicable security fixes in Apache HTTP Server versions up through 2.2.34.

Fix Pack 13 (8.5.5.13) Fix release date: 05 February 2018
Last modified: 05 February 2018
Status: Superseded

[https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/0.2186.gif]Download Fix Pack 13 [http://www.ibm.com/support/docview.wss?uid=swg24044479]

This fixpack is delivered for IBM Ported Tools on z/OS using APAR/PTF: PI93091 [http://www.ibm.com/support/docview.wss?uid=isg1PI93091] / UI53558. Back to Top APAR Description PI82481 CVE-2017-7679 for IBM HTTP Server
http://www-01.ibm.com/support/docview.wss?uid=swg22005280 [http://www-01.ibm.com/support/docview.wss?uid=swg22005280] PI87445 CVE-2017-9798 for IBM HTTP Server
http://www-01.ibm.com/support/docview.wss?uid=swg22009782 [http://www-01.ibm.com/support/docview.wss?uid=swg22009782] PI87663 CVE-2017-12618 for IBM HTTP Server
http://www-01.ibm.com/support/docview.wss?uid=swg22009782 [http://www-01.ibm.com/support/docview.wss?uid=swg22009782] PI83257 [http://www.ibm.com/support/docview.wss?uid=swg1PI83257] Reduce memory usage from long mod_rewrite configurations. PI83350 [http://www.ibm.com/support/docview.wss?uid=isg1PI83350] Add jobname and job id to SMF 103 records for IBM HTTP Server (z/OS only) PI84868 [http://www.ibm.com/support/docview.wss?uid=swg1PI84868] Disable the 3DES cipher by default in IBM HTTP Server. PI85478 [http://www.ibm.com/support/docview.wss?uid=swg1PI85478] Disable symmetric offload by default when IHS is configured to use a crypto card. PI85561 [http://www.ibm.com/support/docview.wss?uid=swg1PI85561] SSL Fallback Protection related errors with SSLProxyEngine ON PI85702 [http://www.ibm.com/support/docview.wss?uid=isg1PI85702] SAFRunAs %%CERTIF%% asks for basic auth credentials PI85804 [http://www.ibm.com/support/docview.wss?uid=isg1PI85804] Improve password failure error messages in authnz_saf PI88232 [http://www.ibm.com/support/docview.wss?uid=swg1PI88232] Allow the server to handle requests with obsolete folds containing only spaces and/or tabs after PI73984. PI88356 [http://www.ibm.com/support/docview.wss?uid=isg1PI88356] Default ciphers with SSLFIPSEnable are System SSL defaults instead of IHS defaults. PI88550 [http://www.ibm.com/support/docview.wss?uid=isg1PI88550] Allow IHS instance on z/OS to swing to an alternate read-only directory. PI88553 [http://www.ibm.com/support/docview.wss?uid=isg1PI88553] Print an error message that includes the errno and errno2 values if fail to find a specified saf-group. PI90141 [http://www.ibm.com/support/docview.wss?uid=swg1PI90141] IBM HTTP Server may hang at startup on z/Linux running on z14 hardware - upgrade GSKit to 8.0.50.84 PI90834 [http://www.ibm.com/support/docview.wss?uid=isg1PI90834] abendoc4 in apr_pstrcat using saf-change-pw handler (z/OS only) 
Note: IBM HTTP Server 8.5.5.13 contains all applicable security fixes in Apache HTTP Server versions up through 2.2.34.

Fix Pack 12 (8.5.5.12) Fix release date: 21 July 2017
Last modified: 21 July 2017
Status: Superseded

[https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/0.42FC.gif]Download Fix Pack 12 [http://www.ibm.com/support/docview.wss?uid=swg24043844]

This fixpack is delivered for IBM Ported Tools on z/OS using APAR/PTF: PI84253 [http://www.ibm.com/support/docview.wss?uid=isg1PI84253] / UI48698. Back to Top APAR Description PI73984 CVE-2016-8743 for IBM HTTP Server
http://www-01.ibm.com/support/docview.wss?&uid=swg21996847 [http://www-01.ibm.com/support/docview.wss?&uid=swg21996847] PI82260 CVE-2017-3167 for IBM HTTP Server
http://www-01.ibm.com/support/docview.wss?&uid=swg22005280 [http://www-01.ibm.com/support/docview.wss?&uid=swg22005280] PI82263 CVE-2017-7668 for IBM HTTP Server
http://www-01.ibm.com/support/docview.wss?&uid=swg22005280 [http://www-01.ibm.com/support/docview.wss?&uid=swg22005280] PI69182 [http://www.ibm.com/support/docview.wss?uid=isg1PI69182] IBM HTTP Server SSL cipher defaults may be displayed incorrectly on z/OS PI70947 [http://www.ibm.com/support/docview.wss?uid=isg1PI70947] Newlines are consumed when an MVSDS dataset's content type is not set to text/* or application/x-javascript. PI72027 [http://www.ibm.com/support/docview.wss?uid=swg1PI72027] IHS rewrite rule on IPV6 does not redirect correctly. PI72350 [http://www.ibm.com/support/docview.wss?uid=swg1PI72350] Fix potential crash in mod_mem_cache in IHS 8.5 and earlier. PI72989 [http://www.ibm.com/support/docview.wss?uid=swg1PI72989] Hangs related to mod_backtrace and mod_whatkilledus during a crash. PI73027 [http://www.ibm.com/support/docview.wss?uid=swg1PI73027] Crash with combination of mod_net_trace loaded and 'EnableSendfile ON' in httpd.conf. PI73043 [http://www.ibm.com/support/docview.wss?uid=swg1PI73043] Upgrade bundled GSKit security library PI73661 [http://www.ibm.com/support/docview.wss?uid=swg1PI73661] Session ID Daemon (sidd) memory leak PI73819 [http://www.ibm.com/support/docview.wss?uid=isg1PI73819] Allow an extended syntax for the SSLCipherSpec directive on z/OS (z/OS only) PI74119 [http://www.ibm.com/support/docview.wss?uid=isg1PI74119] Delayed closure of keepalive connections during graceful process termination on z/OS. (z/OS only) PI74200 [http://www.ibm.com/support/docview.wss?uid=isg1PI74200] Connection resets under heavy load when connecting to IHS on z/OS. (z/OS only) PI75341 [http://www.ibm.com/support/docview.wss?uid=swg1PI75341] /server-status doesn't display client IP until first request is read PI76757 [http://www.ibm.com/support/docview.wss?uid=swg1PI76757] Allow SSL handshake transcripts to be enabled or disabled PI76874 [http://www.ibm.com/support/docview.wss?uid=swg1PI76874] Further enhancements to PI50937 high cpu avoidance PI76918 [http://www.ibm.com/support/docview.wss?uid=isg1PI76918] 'Permission denied' errors after maintenance upgrade of IBM HTTP Server on z/OS (z/OS only) PI77304 [http://www.ibm.com/support/docview.wss?uid=swg1PI77304] VersionInfo shows Java 6 after install of IBM HTTP Server 8.5.5.11 with Java 8.0 PI78442 [http://www.ibm.com/support/docview.wss?uid=swg1PI78442] Some sequences of server-side includes mixing '#include virtual=' and '#include file=' result in a HTTP 400 error. PI78767 [http://www.ibm.com/support/docview.wss?uid=swg1PI78767] HttpProtocolOptions does not get merged from global to virtualhost scope in 8.5 and earlier. PI78967 [http://www.ibm.com/support/docview.wss?uid=isg1PI78967] Allow CEEDUMPS to be requested with kill -USR2 (z/OS only) PI80187 [http://www.ibm.com/support/docview.wss?uid=isg1PI80187] Redirect functionality not working as expected for MVSDS requests (z/OS only) PI80356 [http://www.ibm.com/support/docview.wss?uid=swg1PI80356] Upgrade bundled GSKit security library PI80447 [http://www.ibm.com/support/docview.wss?uid=isg1PI80447] Disable MMAP for static files by default on z/OS (z/OS only) PI81360 [http://www.ibm.com/support/docview.wss?uid=swg1PI81360] Allow SSL_/TLS_ prefixes to be used interchangeably for cipher long names PI81589 [http://www.ibm.com/support/docview.wss?uid=swg1PI81589] Use ECHDE_RSA ciphers by default under TLS1.2 in IBM HTTP Server 8.0 and 8.5 PI81602 [http://www.ibm.com/support/docview.wss?uid=isg1PI81602] Issues with updating SAF password when using Firefox or Chrome (z/OS only) 
Note: IBM HTTP Server 8.5.5.12 contains all applicable security fixes in Apache HTTP Server versions up through 2.2.32, plus some of the security fixes from 2.2.33.

Fix Pack 11 (8.5.5.11) Fix release date: 23 December 2016
Last modified: 23 December 2016
Status: Superseded

[https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/0.7338.gif]Download Fix Pack 11 [http://www.ibm.com/support/docview.wss?uid=swg24043005]

This fixpack is delivered for IBM Ported Tools on z/OS using APAR/PTF: PI73335 [http://www.ibm.com/support/docview.wss?uid=isg1PI73335] / UI43131. Back to Top APAR Description PI65855 CVE-2016-5387 for IBM HTTP Server
http://www-01.ibm.com/support/docview.wss?uid=swg21988019 [http://www-01.ibm.com/support/docview.wss?uid=swg21988019] PI66849 CVE-2012-0876, CVE-2012-1148, CVE-2016-4472
expat vulnerability fixes for IBM HTTP Server
http://www-01.ibm.com/support/docview.wss?uid=swg21988026 [http://www-01.ibm.com/support/docview.wss?uid=swg21988026] PI66153 [http://www.ibm.com/support/docview.wss?uid=isg1PI66153] XML datasets with no XML extension cause error under mod_mvsds (z/OS only) PI66183 [http://www.ibm.com/support/docview.wss?uid=isg1PI66183] When MFA is configured, SAFRunAs fails with a permission error (z/OS only) PI66695 [http://www.ibm.com/support/docview.wss?uid=swg1PI66695] mod_reqtimeout can cause 'java.io.IOException: Async IO operation failed' PI66787 [http://www.ibm.com/support/docview.wss?uid=swg1PI66787] Session cache daemon (sidd) memory leak PI66931 [http://www.ibm.com/support/docview.wss?uid=swg1PI66931] Upgrade bundled GSKit security library to resolve TLS > 1.2 negotiation intolerance. PI67595 [http://www.ibm.com/support/docview.wss?uid=isg1PI67595] AuthSAFExpiration and AuthSAFReenter do not work when using a 401 errordocument (z/OS only) PI68001 [http://www.ibm.com/support/docview.wss?uid=isg1PI68001] Add ability for the MVS stop command to do a graceful shutdown of the server (z/OS only) PI68803 [http://www.ibm.com/support/docview.wss?uid=isg1PI68803] IHS on Z/OS CPU usage increases in release 8.5.5.5 or beyond (z/OS only) PI70024 [http://www.ibm.com/support/docview.wss?uid=swg1PI70024] Lower message severity to Info for cache return error when connection is aborted for the IBM HTTP Server error logging PI70372 [http://www.ibm.com/support/docview.wss?uid=isg1PI70372] mod_mvsds serves a plain text file as an html page if it contains any string starting with a '<' and ending with a '>'. PI70496 [http://www.ibm.com/support/docview.wss?uid=swg1PI70496] Startup failures when 'SSLEnable' is specified globally instead of within a VirtualHost. PI70829 [http://www.ibm.com/support/docview.wss?uid=swg1PI70829] Provide additional message information for IBM HTTP Server TLS handshakes PI71340 [http://www.ibm.com/support/docview.wss?uid=swg1PI71340] Update ikeyman/gskcmd wrappers for IBM HTTP Server 8.5.5 and 9.0 with embedded Java 8. 
Note: IBM HTTP Server 8.5.5.11 contains all applicable security fixes in Apache HTTP Server versions up through 2.2.31.

Fix Pack 10 (8.5.5.10) Fix release date: 15 August 2016
Last modified: 15 August 2016
Status: Superseded

[https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/0.921A.gif]Download Fix Pack 10 [http://www.ibm.com/support/docview.wss?uid=swg24042150]

This fixpack is delivered for IBM Ported Tools on z/OS using APAR/PTF: PI66501 [http://www.ibm.com/support/docview.wss?uid=isg1PI66501] / UI39727. Back to Top APAR Description PI63098 CVE-2016-0718 for IBM HTTP Server (Distributed only)
http://www-01.ibm.com/support/docview.wss?&uid=swg21988026 [http://www-01.ibm.com/support/docview.wss?&uid=swg21988026] PI53754 [http://www.ibm.com/support/docview.wss?uid=isg1PI53754] Using MVSDS to retrieve a GDG(0) always returns the same file, even after a new generation is created. (z/OS only) PI54415 [http://www.ibm.com/support/docview.wss?uid=swg1PI54415] Requests with CONTENT-LENGTH: 0 and any LimitRequestBody may result in a 413 error PI54757 [http://www.ibm.com/support/docview.wss?uid=swg1PI54757] Delay allocating an IHS thread until data is available on a new inbound TCP connection. PI54808 [http://www.ibm.com/support/docview.wss?uid=isg1PI54808] RewriteRule sees un-decoded characters in URL when mod_authnz_saf loaded (z/OS only) PI56034 [http://www.ibm.com/support/docview.wss?uid=isg1PI56034] No equivalent functionality for DGW ALWAYSWELCOME directive in IHS on z/OS. PI57543 [http://www.ibm.com/support/docview.wss?uid=isg1PI57543] Allow one address space per rotatelogs process to be conserved. (z/OS only) PI57596 [http://www.ibm.com/support/docview.wss?uid=isg1PI57596] CRIHS0001I may contain garbage information or not pick up HTTPS port. (z/OS only) PI57657 [http://www.ibm.com/support/docview.wss?uid=swg1PI57657] INSTCONFPARTIALSUCCESS when the IBM HTTP Server installer cannot determine a local hostname. PI58218 [http://www.ibm.com/support/docview.wss?uid=swg1PI58218] IBM HTTP Server 'mod_cache' fixes. PI59374 [http://www.ibm.com/support/docview.wss?uid=swg1PI59374] Certificate expiration reporting for IBM HTTP Server. PI59561 [http://www.ibm.com/support/docview.wss?uid=isg1PI59561] Add pre/post password hooks to mod_authnz_saf. (z/OS only) PI60207 [http://www.ibm.com/support/docview.wss?uid=swg1PI60207] Upgrade bundled GSKit security library to 8.0.50.61 (Distributed only) PI60251 [http://www.ibm.com/support/docview.wss?uid=isg1PI60251] mod_mvsds writes content as binary instead of text/plain. (z/OS only) PI60784 [http://www.ibm.com/support/docview.wss?uid=swg1PI60784] IBM HTTP Server directives SSLCipherBan and SSLCipherRequire may crash when GSKit tracing is enabled. (Distributed only) PI62663 [http://www.ibm.com/support/docview.wss?uid=isg1PI62663] Some Server Side Includes (SSI) may not be translated as expected (z/OS only) PI63482 [http://www.ibm.com/support/docview.wss?uid=isg1PI63482] Add a private header with password change information for 401 response. PI63682 [http://www.ibm.com/support/docview.wss?uid=swg1PI63682] IHS mod_status displays many 'NULL' strings in request column. PI64346 [http://www.ibm.com/support/docview.wss?uid=isg1PI64346] SetEnvIf may be skipped with SAF auth enabled (z/OS only) PI64628 [http://www.ibm.com/support/docview.wss?uid=isg1PI64628] IBM HTTP Server on Z/OS is deleting the wrong IPC message queue (z/OS only) 
Note: IBM HTTP Server 8.5.5.10 contains all applicable security fixes in Apache HTTP Server versions up through 2.2.31.

Fix Pack 9 (8.5.5.9) Fix release date: 18 March 2016
Last modified: 18 March 2016
Status: Superseded

[https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/1.81E.gif]Download Fix Pack 9 [http://www.ibm.com/support/docview.wss?uid=swg24041819]

This fixpack is delivered for IBM Ported Tools on z/OS using APAR/PTF: PI58575 [http://www.ibm.com/support/docview.wss?uid=isg1PI58575] / UI35897. Back to Top APAR Description PI52395 CVE-2015-7420 for IBM HTTP Server (GSKit upgrade)
http://www-01.ibm.com/support/docview.wss?uid=swg21974507 [http://www-01.ibm.com/support/docview.wss?uid=swg21974507] PI54962 CVE-2016-0201 for IBM HTTP Server (GSKit upgrade)
http://www-01.ibm.com/support/docview.wss?uid=swg21974507 [http://www-01.ibm.com/support/docview.wss?uid=swg21974507] PI40885 [http://www.ibm.com/support/docview.wss?uid=isg1PI40885] The 'SAFRunAs' directive implicitly requires access to the "OMVSAPPL" class in some RACF configurations (z/OS only)
{The initial fix was in 8.5.5.7, but was not effective until additional updates in this fixpack.} PI47828 [http://www.ibm.com/support/docview.wss?uid=isg1PI47828] IBM HTTP Server on z/OS fails to start with CC=0137 and ABENDU4093 RC00000281 (z/OS only) PI48695 [http://www.ibm.com/support/docview.wss?uid=isg1PI48695] DGW compatibility for CGI query strings and syntax in server-side includes. (z/OS only) PI49165 [http://www.ibm.com/support/docview.wss?uid=swg1PI49165] Add new request time logging formats PI49473 [http://www.ibm.com/support/docview.wss?uid=swg1PI49473] IBM HTTP Server mod_filter is unable to process pages with error response codes returned from WebSphere Plugin PI49718 [http://www.ibm.com/support/docview.wss?uid=swg1PI49718] Improve error_log reporting for 'SSLProxyEngine' handshake errors PI49791 [http://www.ibm.com/support/docview.wss?uid=swg1PI49791] Add the IfFile directive to allow processing directives based on file existance. PI50376 [http://www.ibm.com/support/docview.wss?uid=isg1PI50376] DGW compatibility for DOCUMENT_* CGI variables. (z/OS only) PI50397 [http://www.ibm.com/support/docview.wss?uid=isg1PI50397] No error log entries for 'SAFRunAs %%CERTIF_REQ%%' failures. (z/OS only) PI50514 [http://www.ibm.com/support/docview.wss?uid=swg1PI50514] SSL session ID cache daemon (SIDD) creates unnecessary entries PI50937 [http://www.ibm.com/support/docview.wss?uid=swg1PI50937] Alleviate looping between SSL and GSKit (IBM Global Security Kit) PI51185 [http://www.ibm.com/support/docview.wss?uid=swg1PI51185] Enhancements allowing use of SAFRunAsEarly for certificate switching PI52299 [http://www.ibm.com/support/docview.wss?uid=swg1PI52299] TLS_FALLBACK_SCSV support for IBM HTTP Server 
Note: IBM HTTP Server 8.5.5.9 contains all applicable security fixes in Apache HTTP Server versions up through 2.2.31.

Fix Pack 8 (8.5.5.8) Fix release date: 11 December 2015
Last modified: 11 December 2015
Status: Superseded

[https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/1.260A.gif]Download Fix Pack 8 [http://www.ibm.com/support/docview.wss?uid=swg24041178]

This fixpack is delivered for IBM Ported Tools on z/OS using APAR/PTF: PI52859 [http://www.ibm.com/support/docview.wss?uid=isg1PI52859] / UI33171. Back to Top APAR Description PI45005 [http://www.ibm.com/support/docview.wss?uid=isg1PI45005] Use of SAFRunAs %%CLIENT%% can result in ICH408I messages to be issued against the HTTP Server userid PI45562 [http://www.ibm.com/support/docview.wss?uid=isg1PI45562] Add a message to indicate the IBM HTTP Server is ready PI45740 [http://www.ibm.com/support/docview.wss?uid=swg1PI45740] Encoding error on RewriteRule PI46559 [http://www.ibm.com/support/docview.wss?uid=swg1PI46559] The setupadm script on Linux fails to use an existing group without the -create parameter PI46616 [http://www.ibm.com/support/docview.wss?uid=swg1PI46616] Allow RewriteRule to use colon (':') in header names and values PI46868 [http://www.ibm.com/support/docview.wss?uid=isg1PI46868] REXX CGI'S may display as text in the browser PI47198 [http://www.ibm.com/support/docview.wss?uid=swg1PI47198] IHS caching partial response for chunked responses PI47605 [http://www.ibm.com/support/docview.wss?uid=swg1PI47605] Support -t -DDUMP_SSL_CONFIG and -t -DDUMP_SSL_CIPHERS on Microsoft Windows PI47642 [http://www.ibm.com/support/docview.wss?uid=swg1PI47642] Honor a global LogLevel specified after a virtual host definition that does not explicitly set LogLevel 
Note: IBM HTTP Server 8.5.5.8 contains all applicable security fixes in Apache HTTP Server versions up through 2.2.31.

Fix Pack 7 (8.5.5.7) Fix release date: 11 September 2015
Last modified: 11 September 2015
Status: Superseded

[https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/1.3AAC.gif]Download Fix Pack 7 [http://www.ibm.com/support/docview.wss?uid=swg24040533]

This fixpack is delivered for IBM Ported Tools on z/OS using APAR/PTF: PI47832 [http://www.ibm.com/support/docview.wss?uid=isg1PI47832] / UI30752. Back to Top APAR Description PI39833 CVE-2015-1829 for IBM HTTP Server on Windows
http://www-01.ibm.com/support/docview.wss?uid=swg21959081 [http://www-01.ibm.com/support/docview.wss?uid=swg21959081] PI42928 CVE-2015-3183 for IBM HTTP Server
http://www-01.ibm.com/support/docview.wss?uid=swg21963361 [http://www-01.ibm.com/support/docview.wss?uid=swg21963361] PI44793 CVE-2015-4947 for IBM HTTP Server Administration Server
http://www-01.ibm.com/support/docview.wss?uid=swg21965419 [http://www-01.ibm.com/support/docview.wss?uid=swg21965419] PI44809 CVE-2015-1788 for IBM HTTP Server
http://www-01.ibm.com/support/docview.wss?uid=swg21963362 [http://www-01.ibm.com/support/docview.wss?uid=swg21963362] PI45596 CVE-2015-1283 for IBM HTTP Server
http://www-01.ibm.com/support/docview.wss?uid=swg21964428 [http://www-01.ibm.com/support/docview.wss?uid=swg21964428] PI38322 [http://www.ibm.com/support/docview.wss?uid=swg1PI38322] Allow mod_cache to ignore an 'Authorization' HTTP request header PI38562 [http://www.ibm.com/support/docview.wss?uid=swg1PI38562] CGI resources are briefly unavailable just after a restart PI38828 [http://www.ibm.com/support/docview.wss?uid=swg1PI38828] Enable unified config dump PI38835 [http://www.ibm.com/support/docview.wss?uid=swg1PI38835] IBM HTTP Server cannot log time-to-first-byte (TTFB) PI39439 [http://www.ibm.com/support/docview.wss?uid=swg1PI39439] DGW-style SSL environment variables are not set PI40952 [http://www.ibm.com/support/docview.wss?uid=swg1PI40952] Preserve quoting in SSLServerCert directive 
Note: IBM HTTP Server 8.5.5.7 contains all applicable security fixes in Apache HTTP Server versions up through 2.2.31.

Fix Pack 6 (8.5.5.6) Fix release date: 26 June 2015
Last modified: 26 June 2015
Status: Superseded

[https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/2.512.gif]Download Fix Pack 6 [http://www.ibm.com/support/docview.wss?uid=swg24040035]

This fixpack is delivered for IBM Ported Tools on z/OS using APAR/PTF: PI43067 [http://www.ibm.com/support/docview.wss?uid=isg1PI43067] / UI28569. Back to Top APAR Description PI36417 CVE-2015-0138 for IBM HTTP Server
http://www-01.ibm.com/support/docview.wss?uid=swg21698959 [http://www-01.ibm.com/support/docview.wss?uid=swg21698959] PI34229 Disable RC4-based TLS ciphers by default in IBM HTTP Server.
http://www-01.ibm.com/support/docview.wss?uid=swg21701072 [http://www-01.ibm.com/support/docview.wss?uid=swg21701072] PI32452 [http://www.ibm.com/support/docview.wss?uid=isg1PI32452] Userid on 'require saf-user' statement doesn't work when specified as lower case (z/OS only) PI32841 [http://www.ibm.com/support/docview.wss?uid=swg1PI32841] Some cipher names and keysizes are not logged when using %(SSL_CIPHER)e in LogFormat for access log. PI33039 [http://www.ibm.com/support/docview.wss?uid=isg1PI33039] EDC5170I error happens when running CGI script in Apache server with WLM enabled on z/OS PI33527 [http://www.ibm.com/support/docview.wss?uid=swg1PI33527] SSLOCSPEnable directive always enables OCSP (Online Certificate Status Protocol) even if value is 'OFF'. PI34017 [http://www.ibm.com/support/docview.wss?uid=swg1PI34017] HTTP error 413 on static files results in a duplicate error message. PI35073 [http://www.ibm.com/support/docview.wss?uid=swg1PI35073] IBM HTTP Server always supplies its own HTTP 'DATE' header to responses generated by the WebSphere webserver plug-in. PI35219 [http://www.ibm.com/support/docview.wss?uid=isg1PI35219] ABEND0C1 when running install_ihs on z/OS PI35519 [http://www.ibm.com/support/docview.wss?uid=isg1PI35519] cgiparse incorrectly handles POST request bodies on z/OS PI39284 [http://www.ibm.com/support/docview.wss?uid=isg1PI39284] Error continues to appear in HAPALLO2 JCL after PI25264 (z/OS only) 
Note: IBM HTTP Server 8.5.5.6 contains all applicable security fixes in Apache HTTP Server versions up through 2.2.29.

Fix Pack 5 (8.5.5.5) Fix release date: 13 March 2015
Last modified: 13 March 2015
Status: Superseded

[https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/2.1D4A.gif]Download Fix Pack 5 [http://www.ibm.com/support/docview.wss?uid=swg24039425]

This fixpack is delivered for IBM Ported Tools on z/OS using APAR/PTF: PI36674 [http://www.ibm.com/support/docview.wss?uid=isg1PI36674] / UI25968. Back to Top APAR Description PI31516 CVE-2014-8730: Enable strict CBC padding checks on TLS connections
http://www-01.ibm.com/support/docview.wss?&uid=swg21697368 [http://www-01.ibm.com/support/docview.wss?&uid=swg21697368] PI28735 [http://www.ibm.com/support/docview.wss?uid=swg1PI28735] ErrorDocument redirection for status code 414 (Request URI too long) does not work PI30041 [http://www.ibm.com/support/docview.wss?uid=swg1PI30041] mod_deflate_z gives no indication if hardware offload was used (z/OS only) PI30093 [http://www.ibm.com/support/docview.wss?uid=swg1PI30093] Allow SSLProtocolDisable, SSLProtocolEnable, and SSLAttributeSet in the IBM HTTP Server configuration global PI30323 [http://www.ibm.com/support/docview.wss?uid=swg1PI30323] Add support for dual-mode ECDSA/RSA SSL virtual hosts PI31566 [http://www.ibm.com/support/docview.wss?uid=swg1PI31566] Allow IBM HTTP Server RLimit* directives to reduce hard limits PI31802 [http://www.ibm.com/support/docview.wss?uid=isg1PI31802] APR_POLLSET_ADD failure - ERRNO2=0X76650000 (z/OS only) 
Note: IBM HTTP Server 8.5.5.5 contains all applicable security fixes in Apache HTTP Server versions up through 2.2.29.

Fix Pack 4 (8.5.5.4) Fix release date: 08 December 2014
Last modified: 08 December 2014
Status: Superseded

[https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/2.2EE8.gif]Download Fix Pack 4 [http://www.ibm.com/support/docview.wss?uid=swg24038539]

This fixpack is delivered for IBM Ported Tools on z/OS using APAR/PTF: PI30622 [http://www.ibm.com/support/docview.wss?uid=isg1PI30622] / UI23545. Back to Top APAR Description PI22070 Multiple Apache web server vulnerabilities:
CVE-2014-0118 (mod_deflate), CVE-2014-0226 (mod_status), CVE-2014-0231 (mod_cgid), CVE-2013-5704 (core)
http://www-01.ibm.com/support/docview.wss?&uid=swg21690185 [http://www-01.ibm.com/support/docview.wss?&uid=swg21690185] PI27904 IBM HTTP Server should disable weak SSL protocols and ciphers by default PI19013 [http://www.ibm.com/support/docview.wss?uid=isg1PI19013] Missing version.signature file after the installation of Apache HTTP Server -FMID HHAP85P
(z/OS only) PI19580 [http://www.ibm.com/support/docview.wss?uid=isg1PI19580] mod_reqtimeout: Potential for unexpected timeouts in IBM HTTP Server 8.5.5 on z/OS when using RequestReadTimeout (z/OS only) PI19581 [http://www.ibm.com/support/docview.wss?uid=swg1PI19581] IBM HTTP Server modules specified without a path don't load PI21655 [http://www.ibm.com/support/docview.wss?uid=isg1PI21655] mod_mvsds: 404 returned when attempting to browse a member of a PDS dataset using MVSDS (z/OS only) PI23005 [http://www.ibm.com/support/docview.wss?uid=swg1PI23005] Allow logging of time taken during SSL handshake PI24257 [http://www.ibm.com/support/docview.wss?uid=swg1PI24257] 'Header edit* ...' directive not accepted by IBM HTTP Server PI24424 [http://www.ibm.com/support/docview.wss?uid=isg1PI24424] Add support for zEnterprise Data Compression (zEDC) offload for IBM HTTP Server. (z/OS only) PI24782 [http://www.ibm.com/support/docview.wss?uid=isg1PI24782] mod_smf module only writes smf type 103 subtype 14 records when debug is turned on. (z/OS only) PI24990 [http://www.ibm.com/support/docview.wss?uid=isg1PI24990] Add mpmstats info to console. (z/OS only) PI25124 [http://www.ibm.com/support/docview.wss?uid=isg1PI25124] Install of PTF UI20159 does not update product files 14/09/19 PTF PECHANGE (z/OS only) PI25264 [http://www.ibm.com/support/docview.wss?uid=isg1PI25264] Error appears in HAPALLO2 JCL (z/OS only) PI25783 [http://www.ibm.com/support/docview.wss?uid=isg1PI25783] Fatal getpwuid() error at IBM HTTP Server startup (z/OS only) PI26507 [http://www.ibm.com/support/docview.wss?uid=isg1PI26507] mod_proxy on z/OS doesn't try IPV4 addresses on systems where IPV6 connections fail (z/OS only) PI26894 [http://www.ibm.com/support/docview.wss?uid=swg1PI26894] Increase security libraries to resolve high CPU loop on 64bit Microsoft Windows
(GSKit upgrade to 8.0.50.34) 
Note: IBM HTTP Server 8.5.5.4 contains all applicable security fixes in Apache HTTP Server versions up through 2.2.29.

Fix Pack 3 (8.5.5.3) Fix release date: 18 August 2014
Last modified: 18 August 2014
Status: Superseded

[https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/3.134.gif]Download Fix Pack 3 

This fixpack is delivered for IBM Ported Tools on z/OS using APAR/PTF: PI21538 [http://www.ibm.com/support/docview.wss?uid=isg1PI21538] / UI20159. Back to Top APAR Description PI13028 CVE-2014-0098: mod_log_config - Potential denial of service vulnerability
http://www-01.ibm.com/support/docview.wss?&uid=swg21681249 [http://www-01.ibm.com/support/docview.wss?&uid=swg21681249] PI17025 CVE-2014-0963: IBM HTTP Server high CPU utilization with SSL (includes GSKit upgrade)
http://www-01.ibm.com/support/docview.wss?&uid=swg21681249 [http://www-01.ibm.com/support/docview.wss?&uid=swg21681249] PI19700 CVE-2014-0076: Local side-channel attack on ECDSA (GSKit upgrade)
http://www-01.ibm.com/support/docview.wss?&uid=swg21681249 [http://www-01.ibm.com/support/docview.wss?&uid=swg21681249] PI13422 [http://www.ibm.com/support/docview.wss?uid=swg1PI13422] Memory leak in GSKit 8.0.50 (GSKit upgrade) PI13949 [http://www.ibm.com/support/docview.wss?uid=isg1PI13949] MVSDS request does not release shared ENQ (z/OS only) PI14451 [http://www.ibm.com/support/docview.wss?uid=isg1PI14451] IHS with SSLFIPSENABLE reports error code 53817451 at startup (z/OS only) PI15344 [http://www.ibm.com/support/docview.wss?uid=swg1PI15344] IBM HTTP Server caching issues PI16599 [http://www.ibm.com/support/docview.wss?uid=swg1PI16599] Authentication failure gives LDAP error for non-LDAP configurations PI17434 [http://www.ibm.com/support/docview.wss?uid=isg1PI17434] SSLCACHE may fail due to SSLCACHEPORTFILENAME value being in use (z/OS only) 
Note: IBM HTTP Server 8.5.5.3 contains all applicable security fixes in Apache HTTP Server versions up through 2.2.27.

Fix Pack 2 (8.5.5.2) Fix release date: 28 April 2014
Last modified: 28 April 2014
Status: Superseded

[https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/3.144E.gif]Download Fix Pack 2 [http://www.ibm.com/support/docview.wss?uid=swg24037250]

This fixpack is delivered for IBM Ported Tools on z/OS using APAR/PTF: PI15962 [http://www.ibm.com/support/docview.wss?uid=isg1PI15962] / UI17041. Back to Top APAR Description PI05309 CVE-2013-6329: SSL session resumption vulnerability. (GSKit upgrade).
http://www-01.ibm.com/support/docview.wss?&uid=swg21669554 [http://www-01.ibm.com/support/docview.wss?&uid=swg21669554] PI09345 CVE-2013-6438: Potential Denial of Sevice in mod_dav for IBM HTTP Server.
http://www-01.ibm.com/support/docview.wss?&uid=swg21669554 [http://www-01.ibm.com/support/docview.wss?&uid=swg21669554] PI09443 CVE-2013-6747: GSKit Certificate Chain Vulnerability. (GSKit upgrade).
http://www-01.ibm.com/support/docview.wss?&uid=swg21669554 [http://www-01.ibm.com/support/docview.wss?&uid=swg21669554] PM94008 [http://www.ibm.com/support/docview.wss?uid=swg1PM94008] Timed-out ldap bind and search failures on reused connections are not retried. PM94143 [http://www.ibm.com/support/docview.wss?uid=isg1PM94143] Use of SAFRunAs results in ICH408I messages to be issued against the HTTP Server userid (z/OS only) PM94602 [http://www.ibm.com/support/docview.wss?uid=isg1PM94602] ProxyRemote fails to work with SSL requests PM96039 [http://www.ibm.com/support/docview.wss?uid=swg1PM96039] AcceptEx disablement notice should not appear in Microsoft Windows Event Viewer PM97650 [http://www.ibm.com/support/docview.wss?uid=swg1PM97650] IBM HTTP Server does not send SIGTERM to fastCGI application PI04922 [http://www.ibm.com/support/docview.wss?uid=swg1PI04922] IBM HTTP Server scaling/processing threads limited on 64-bit Microsoft Windows. PI06366 [http://www.ibm.com/support/docview.wss?uid=swg1PI06366] IBM HTTP Server thread creation failures when scaling up from default configuration on RHEL6 PI07665 [http://www.ibm.com/support/docview.wss?uid=isg1PI07665] IBM HTTP server 8.5 (Apache) on z/OS needs support of cgiparse and cgiutils from IHS 5.3 Domino Go Web Server. PI08502 [http://www.ibm.com/support/docview.wss?uid=swg1PI08502] Potential heap corruption under load for IBM HTTP Server with SSL enabled. (GSKit upgrade). PI08715 [http://www.ibm.com/support/docview.wss?uid=swg1PI08715] Potential mod_proxy crashes under load PI09344 [http://www.ibm.com/support/docview.wss?uid=isg1PI09344] Missing version.signature file for 31-bit IBM HTTP Server on z/OS breaks 8.5.5 post-update process. 
Note: IBM HTTP Server 8.5.5.2 contains all applicable security fixes in Apache HTTP Server versions up through 2.2.26.

Fix Pack 1 (8.5.5.1) Fix release date: 11 November 2013
Last modified: 11 November 2013
Status: Superseded

[https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/3.2EF8.gif]Download Fix Pack 1 [http://www.ibm.com/support/docview.wss?uid=swg24035935] Back to Top APAR Description PM87808 CVE-2013-1862: mod_rewrite vulnerability
http://www-01.ibm.com/support/docview.wss?&uid=swg21651880 [http://www-01.ibm.com/support/docview.wss?&uid=swg21651880] PM89996 CVE-2013-1896: mod_dav vulnerability
http://www-01.ibm.com/support/docview.wss?&uid=swg21651880 [http://www-01.ibm.com/support/docview.wss?&uid=swg21651880] PM84215 [http://www.ibm.com/support/docview.wss?uid=swg1PM84215] mod_mpmstats may report incorrect values during startup or shutdown PM87247 [http://www.ibm.com/support/docview.wss?uid=swg1PM87247] Additional certificate attributes are needed as fields accessible to the SSLClientAuthRequire directive PM89422 [http://www.ibm.com/support/docview.wss?uid=swg1PM89422] IHS WebDAV requests slow on Windows PM91704 [http://www.ibm.com/support/docview.wss?uid=swg1PM91704] Add mod_smf module for IBM HTTP Server (z/OS only) PM92105 [http://www.ibm.com/support/docview.wss?uid=isg1PM92105] wlm enclave support fails on a child process without a unique jobname (z/OS only) 
Note: IBM HTTP Server 8.5.5.1 contains all applicable security fixes in Apache HTTP Server versions up through 2.2.25.

Refresh Pack (8.5.5) Fix release date: 14 June 2013
Last modified: 14 June 2013
Status: Superseded

[https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/3.401C.gif]Download Refresh Pack 8.5.5 [http://www.ibm.com/support/docview.wss?uid=swg24034969] Back to Top APAR Description PM85211 CVE-2013-0169: TLS Vulnerability (The fix upgrades the bundled GSKit security library) 
https://exchange.xforce.ibmcloud.com/vulnerabilities/81902 [https://exchange.xforce.ibmcloud.com/vulnerabilities/81902] 
Note: IBM HTTP Server 8.5.5 contains all applicable security fixes in Apache HTTP Server versions up through 2.2.24.

Fix Pack 2 (8.5.0.2) Fix release date: 15 April 2013
Last modified: 15 April 2013
Status: Superseded

[https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/3.479A.gif]Download Fix Pack 2 [http://www.ibm.com/support/docview.wss?uid=swg24034672] Back to Top APAR Description PM76110 [http://www.ibm.com/support/docview.wss?uid=swg1PM76110] CVE-2012-4557: mod_proxy_ajp incorrectly marks backend WAS CE server down PM80058 [http://www.ibm.com/support/docview.wss?uid=swg1PM80058] CVE-2012-3499/CVE-2012-4558: Potential exposure in several IBM HTTP Server optional modules
https://exchange.xforce.ibmcloud.com/vulnerabilities/82359 [https://exchange.xforce.ibmcloud.com/vulnerabilities/82359]
https://exchange.xforce.ibmcloud.com/vulnerabilities/82360 [https://exchange.xforce.ibmcloud.com/vulnerabilities/82360] PM68347 [http://www.ibm.com/support/docview.wss?uid=isg1PM68347] Z/OS IHS config for versions prior to 8.5 may not migrate as expected to 8.5 PM69188 [http://www.ibm.com/support/docview.wss?uid=swg1PM69188] Installation of IBM HTTP Server V8.5 completes with a warning. Failure occurs because the system's hostname is not set. PM70591 [http://www.ibm.com/support/docview.wss?uid=swg1PM70591] IHS on Microsoft Windows startup failure with SSLv3Timeout or SSLv2Timeout in vhost: 'master_main: create child process failed.' PM70994 [http://www.ibm.com/support/docview.wss?uid=swg1PM70994] SSLFakeBasicAuth depends on LoadModule order PM71102 [http://www.ibm.com/support/docview.wss?uid=swg1PM71102] <Location> settings don't affect some mod_negotiation generated content PM73304 [http://www.ibm.com/support/docview.wss?uid=swg1PM73304] Add mod_ssl's SSLProxyCheckPeerCN to IBM HTTP Server PM75876 [http://www.ibm.com/support/docview.wss?uid=swg1PM75876] The 'Header' directive can't set a header only if the header is absent, even when using 'EDIT' mode or relying on other modules. PM77980 [http://www.ibm.com/support/docview.wss?uid=swg1PM77980] IBM HTTP Server should not add the Server: header by default PM78087 [http://www.ibm.com/support/docview.wss?uid=swg1PM78087] IBM HTTP Server high memory use when many hundreds of RewriteCond %{REQUEST_URI} PM78144 [http://www.ibm.com/support/docview.wss?uid=swg1PM78144] IBM HTTP Server large logformats cannot be correctly logged by piped loggers PM78434 [http://www.ibm.com/support/docview.wss?uid=isg1PM78434] Provide end-to-end timeouts for SSL handshakes PM79015 [http://www.ibm.com/support/docview.wss?uid=swg1PM79015] mod_disk_cache on Windows gives error: '(OS 5) Access is denied: disk_cache: Rename tempfile to datafile failed' PM80235 [http://www.ibm.com/support/docview.wss?uid=swg1PM80235] NIST SP800-131a support for IBM HTTP Server PM80260 [http://www.ibm.com/support/docview.wss?uid=isg1PM80260] apr_pollset_add failure -errno2=0X11780494, or growing CPU usage on the listener thread in IHS child processes (z/OS only) 
Note: IBM HTTP Server 8.5.0.2 contains all applicable security fixes in Apache HTTP Server versions up through 2.2.24.

Fix Pack 1 (8.5.0.1) Fix release date: 29 October 2012
Last modified: 29 October 2012
Status: Superseded

[https://www-prd-trops.events.ibm.com/sites/default/files/support/swg/swgdocs.nsf/0/88423a02b4f66c1385257a99006a3c24/Content/4.19D4.gif]Download Fix Pack 1 [http://www.ibm.com/support/docview.wss?uid=swg24033606] Back to Top APAR Description PM66218 Upgrade bundled GSKit security library
http://www-01.ibm.com/support/docview.wss?&uid=swg21614265 [http://www-01.ibm.com/support/docview.wss?&uid=swg21614265] PM66470 [http://www.ibm.com/support/docview.wss?uid=swg1PM66470] CVE-2012-2687: mod_negotiation - potential information disclosure on compromised site. PM72915 TLS compression should be disabled by default in IBM HTTP Server
http://www-01.ibm.com/support/docview.wss?uid=swg21611881 [http://www-01.ibm.com/support/docview.wss?uid=swg21611881] PM62011 [http://www.ibm.com/support/docview.wss?uid=swg1PM62011] mod_log_config: The wrong cookie can be logged PM63634 [http://www.ibm.com/support/docview.wss?uid=swg1PM63634] admin.passwd file was reset after installing fixpack PM68007 [http://www.ibm.com/support/docview.wss?uid=swg1PM68007] Non-root IBM HTTP Server install fails if primary group has no name PM71612 [http://www.ibm.com/support/docview.wss?uid=swg1PM71612] Additional non-serviceable files added for IBM HTTP Server 
Note: IBM HTTP Server 8.5.0.1 contains all applicable security fixes in Apache HTTP Server versions up through 2.2.23.

Question: Does ITCAM for HTTP Server 7.1 FP4 work with IBM HTTP Server (IHS) 8.5.5.10 on AIX 7.2.x ? Does ITCAM for HTTP Server 7.1 FP4 work with IBM HTTP Server (IHS) 8.5.5.10 on AIX 7.2.x ? 

Answer: IBM HTTP Server 8.5.5.9 contains all applicable security fixes in Apache HTTP Server versions up through 2.2.31.