Clients have asked me whether their IBM i servers may be vulnerable to hackers due to the widely publicized OpenSSL Heartbleed bug.
The answer is no. IBM i is safe from this bug, which is present only in specific OpenSSL versions: 1.0.1 through 1.0.1f (inclusive). IBM i’s latest version of OpenSSL, shipped with the “Portable Utilities for i” licensed program product 5733SC1, is 0.9.8, which does not contain the bug.
To make doubly certain, check what version of OpenSSL is installed on your IBM i. Run these two commands, which, respectively, start a PASE interactive terminal session and check the openssl version:
call qp2term
openssl version
For me, the above commands returned “OpenSSL 0.9.8m 25 Feb 2010,” confirming that I’m not affected.
Press F3 afterward to leave the PASE environment.
Thanks to Jim Oberholtzer of Agile Technology Architects for his contribution to this answer.
UPDATE from IBM: System SSL and IBMJSSE2 are also safe from the vulnerability on IBM i.
Read the original at Alan Seiden Consulting: PHP and IBM i Expertise.