This alert was originally published in Seiden Group’s July 2023 Support Bulletin.
Upgrade to Seiden PHP+ Server for full support of IBM i 7.5 and 7.6.
IBM i 7.5 includes OpenSSL 1.1.1, an upgrade that can disable older PASE applications that were tied to 1.0.2 or earlier.
Clients have asked me whether their IBM i servers may be vulnerable to hackers due to the widely publicized OpenSSL Heartbleed bug.
The answer is no. IBM i is safe from this bug, which is present only in specific OpenSSL versions: 1.0.1 through 1.0.1f (inclusive). IBM i’s latest version of OpenSSL, shipped with the “Portable Utilities for i” licensed program product 5733SC1, is 0.9.8, which does not contain the bug.
To make doubly certain, check what version of OpenSSL is installed on your IBM i. Run these two commands, which, respectively, start a PASE interactive terminal session and check the openssl version:
call qp2term
openssl version
For me, the above commands returned “OpenSSL 0.9.8m 25 Feb 2010,” confirming that I’m not affected.
Press F3 afterward to leave the PASE environment.
Thanks to Jim Oberholtzer of Agile Technology Architects for his contribution to this answer.
UPDATE from IBM: System SSL and IBMJSSE2 are also safe from the vulnerability on IBM i.