Thanks for the update! The Support Matrix (page 10) says:

OS for software version
6.11.0 Patch 1: RHEL 6.9 or CentOS 6.9
6.11.0 Patch 2: RHEL 7.4 or CentOS 7.4

Does this mean 6.11.0 Patch 2 no longer supports CentOS 6.9 and we should only Patch 2 after upgrading to CentOS 7.4? Please advise.

6.11 P2 actually supports both RHEL/CentOS 6.9 and RHEL/CentOS 7.4, the support matrix is unclear. I will make sure it is updated and reuploaded. Thanks for the good catch!

Where does one download patches from?

Hi,

ESM 6.11 - Patch 2 - https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/-/facetsearch/document/KM03162355

if you have an 7600 appliance then i am recomanding you to appy this OS patch first (

(RedHat7.3 RedHat7.4 - Spectre & Meltdown kernel patch)

https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/-/facetsearch/document/KM03162380

Best Regards,

Daniel

I have following environment:

B7500 appliance Exress, on OS: RHEL  2.6.32-696 (RHEL 6.9) (- this is supported based on matrix)., running ESM 6.11 Patch 1:

and

Software ESM 6.11 patch 1, Software ESM, OS: 2.6.32-696 (RHEL 6.9)

Would i to wait on this mircrocode on both software and appliance upgrade or go ahead an apply these patches before upgrading to 6.11 patch 2? as in 

https://community.softwaregrp.com/t5/ArcSight-User-Discussions/Spectre-Meltdown-Update/m-p/1632424

Would I have to consider to buy  a new appliance like B7600 G9 with OS Redhat 7.4  to take care of this the Spectre and

Meltdown vulnerabilities applied?

-Joe Ngo

Hi Joe, 

According to the ESM 6.11 Patch 2 documentation the microcode for the Spectre and Meltdown (which is on OS level) it is only on RHEL 7.4 (which as you know are the OS for B7600).

Due to long collaboration between T3 (Darren) and Dev. team we discovered indeed  we released the microcode / OS kernel that address the Spectre and Meltdown issue but this can be found in the update OS on ESM 7.0 for RHEL 6.9.

So if you want to fix the Spectre and Meltdown issue on B7500 you need to install the last update of RHEL 6.9 (esm_osupgrade_rhel69_20180309171845.tar.gz that can be download by any customer who as valid contract from https://h22255.www2.hpe.com/mysoftware/index , on  ESM 7.0 download section).

The archive contains kernel-2.6.32-696.20.1.el6.x86_64  ( where the bugs are fixed according to this link https://access.redhat.com/errata/RHSA-2018:0169) and firmware-system-p70-2018.01.22-1.1.i386.rpm - System ROM upgrade which fix the same issue on BIOS server. For more information please read https://support.hpe.com/hpsc/swd/public/detail?swItemId=MTX_6d17d71d391d43a1b9482e51ed#tab3

I hope that it is much clearer now.

Best Regards,

Ionut Daniel Mosoiu

Thanks IIonut Daniel Mosoiu on appliance ugprade to patch 2..  So with customers with software  ESM 6.11 patch 1 on RHEL 7.3 , they would need to apply esm_osupgrade_rhel73_20180306104731.tar.gz first before upgrading to patch 2?

-JN

Hi Joe,

Normally installing the Patch 2 of ESM should not be affected by the upgrade of OS and how it is going first. But in general it is recommended to apply the OS upgrade first and then the Patch for ESM.

Once again.

Patch 2 – fixing the ESM part;

OS upgrade and firmware-system-p70-2018.01.22-1.1.i386.rpm – fixing the Spectre and Meltdown issue since those are fixed on OS and BIOS server level.

For clarifications please read the document “ESM_ReleaseNotes6_11_0P2.pdf” .If you don’t have the document then you can download it from the following link: https://community.softwaregrp.com/t5/ESM-and-ESM-Express/ArcSight-ESM-Release-Notes-6-11-0-P2/ta-p/1647165 ”

Best Regards,

Daniel

Thank you so much Daniel.

Joe

The release notes for ESM 6.11 Patch 2 contain the following section:

"Important Prerequisite: Must Have Spectre and Meltdown Patches Applied
As a prerequisite to installing ESM 6.11.0 Patch 2, you must have the patches for the Spectre and
Meltdown vulnerabilities applied to your operating system."

Does this apply to appliances only to make sure the appliance as a whole is protected against Spectre and Meltdown? Or is there any functional impact on ESM if the underlying OS (customer-provided, not an appliance) is not patched yet?

 Regards,
Heiko