IBM® Sterling Connect:Direct® for Microsoft Windows 6.2.0
Fix List Document

This document describes maintenance updates for IBM® Sterling Connect:Direct® for Microsoft Windows 6.2.0. It includes information and instructions for all product features, including the Server, Requester, Common Utilities, Secure+, JRE, PostgreSQL, Integrated File Agent, Install Agent and the SDK. Maintenance updates are always cumulative and provided as fix packs or interim fixes (iFixes).

Contents
•	Important Notices
•	About Fix Packs and iFixes
•	Before running the Installer
•	Applying a Fix Pack or iFix to an existing Installation
•	Performing a new Installation or an Upgrade of an existing Installation
•	Description of iFixes and Updates

Important Notices
•	Important: Due to an issue with the installer component codes in IBM Sterling Connect:Direct for Microsoft Windows 6.2.0.0, it must not be used for new or upgrade installations. Instead, use IBM Sterling Connect:Direct for Microsoft Windows 6.2.0.1, or later, available on IBM Fix Central. The accompanying Fix List includes instructions on using a maintenance package to perform new and upgrade installations. The version of Connect:Direct Windows on Passport Advantage will soon be updated with 6.2.0.1. If version 6.2.0.0 is used, updating it will involve un-installation followed by re-installation of the newer version.
•	Before applying a fix pack or iFix to IBM Sterling Connect:Direct for Microsoft Windows installed in a failover cluster environment, see the instructions in the white paper Deploying IBM Connect:Direct for Microsoft Windows in a Failover Cluster at https://www.ibm.com/support/pages/deploying-ibm-connectdirect-microsoft-windows-failover-cluster.
•	Security updates are described in the iFixes and Updates section below using the following definitions:
•	Affected: The software product contains code, which has a documented vulnerability. Based on currently available information, however, we believe that the issue is likely not exploitable. However, as a best practice and from an abundance of caution, we recommend customers update their systems as soon as practical. Vulnerabilities evolve, and a means of exploiting any issue may emerge at any time.
•	Vulnerable: The software product contains code, which has a documented vulnerability. Our analysis shows that the issue may be exploitable.

About Fix Packs and iFixes

Fix packs and interim fixes (iFixes) deliver maintenance and updates to an existing product version of IBM Sterling Connect:Direct for Microsoft Windows. They are cumulative and include iFixes as well as updates added since the previous fix pack and in any earlier fix pack. You only need to apply the latest one available. 

Fix packs and critical iFixes can be downloaded from the IBM Fix Central website at https://www.ibm.com/support/fixcentral/. Non-critical iFixes are typically provided by IBM Support in response to a customer PMR to address the reported issue. They can also be requested though IBM Support on demand. 

Fix packs and iFixes are provided as a single installer executable (.exe). File naming conventions refer to the product name, version, fix pack (fp) and iFix (if) if applicable. Here are some examples:

•	Connect:Direct 6.2.0.0_iFix001
6.2.0.0-IBMConnectDirectforMicrosoftWindows-x64-fp0000-if001.exe
•	Stand-alone Connect:Direct Requester 6.2.0.0_iFix001
6.2.0.0-IBMConnectDirectRequesterStandAlone-x86-fp0000-if001.exe
•	Connect:Direct SDK/SDK.Net 6.2.0.0_iFix001
6.2.0.0-IBMConnectDirectSDK-x64-fp0000-if001.exe

Before running the Installer

•	Review the fix list document (CDWin620FixList.rtf) carefully. It provides details on individual fixes, updates and changes included in a fix pack. It includes information on all features including Server, Requester, Common Utilities, Secure+, JRE, PostgreSQL and SDK. 
•	Log on with an account that has appropriate permissions to install software, typically an administrator account. When performing a silent mode installation, make sure the command prompt or batch file already has this permission prior to executing the actual command, for example by using 'Run as administrator' (RAA).
•	It is recommended to have a backup.
•	Close all other applications.

Applying a Fix Pack or iFix to an existing Installation

Use the installer to apply a fix pack or iFix to an existing installation of IBM Sterling Connect:Direct for Microsoft Windows 6.2.0. Update mode is enabled by specifying SEPATCH_ONLY_FLAG=1 on the command line (default).
Interactive Mode
To apply a fix pack or iFix interactively, simply double-click the installer in Windows Explorer or run it from the command line. When no arguments are specified, the default command will be equivalent to:
<InstallerExe> /v"SEPATCH_ONLY_FLAG=1 /l*v CDWinPatch.log"
Silent Mode
To apply a fix pack or iFix in silent mode, enter the following command line:
<InstallerExe> /v"SEPATCH_ONLY_FLAG=1 /l*v CDWinPatch.log /qn" /s /w /clone_wait
The command will wait for completion (/w /clone_wait) and return 0 if the operation was successful. Review the log file in case of a failure. Provide this log file when reporting an installation problem to IBM Support.

Performing a new Installation or an Upgrade of an existing Installation

Use the iFix / Fix Pack installer to perform a fresh installation of IBM Sterling Connect:Direct for Microsoft Windows 6.2.0 or to upgrade from an existing older release. Be sure to first review the release notes in the 6.2.0 product documentation.
Interactive Mode
To install or upgrade interactively, enter the following command line and choose install or upgrade during the installation:
<InstallerExe> /v"/l*v CDWinInst.log"
Silent Mode
To install or upgrade in silent mode, configure your server property file (cd_srvr.ini) accordingly and enter the following command line:
<InstallerExe> /v"CD_SRVR_INI_FILE=C:\cd_srvr.ini /l*v CDWinInst.log /qn" /s /w /clone_wait
The command will wait for completion (/w /clone_wait) and return 0 if the operation was successful. Review the log file in case of a failure. Provide this log file when reporting an installation problem to IBM Support.
See the product documentation for further details on automating the installation.

Description of iFixes and Updates

iFixes after 6.2.0.0

6.2.0.0_iFix001:  CDWA-1842
Description of Issue:  During separate installation of components i.e. Standalone Requester alert message is displaying.
Description of Fix:  Added a condition to check for existence of registry key before copying it.
Fix Availability Date:  22 September 2021
High Impact:  N
Reported Severity:  4

6.2.0.0_iFix002:  CDWA-1912
Description of Issue:  When CD Windows 6.1 and 6.2 are both installed, even during an upgrade, either version does not uninstall correctly, leaving files, services and registry settings behind.
Description of Fix:  Updated the CD Windows 6.2 installer to address this issue.
Important: Starting with this iFix, any maintenance will be incompatible with the base version 6.2.0.0. To move forward, uninstall the base version 6.2.0.0 first and then reinstall using the latest iFix installer.
Fix Availability Date:  22 September 2021
High Impact:  N
Reported Severity:  4

All iFixes and fix packs listed above are accumulated in fix pack 1 (6.2.0.1).

iFixes after 6.2.0.1

6.2.0.1_iFix001:  CDWA-1940
Description of Issue:  Support for enabling functional authority to set the permission for recording external statistics from external source like Integrated File Agent.
Description of Fix:  Permissions setting enabled in function authority to enable the user to set the permissions of external statistics logging.
Fix Availability Date:  06 October 2021

6.2.0.1_iFix002:  MFT-12411 / APAR IT38274
Description of Issue:  Snode maximum sessions allowed can exceed the configured max value in Initparms by one.
Description of Fix:  The maximum number of Snode sessions allowed will be the Initparms configured value.
Fix Availability Date:  07 October 2021
High Impact:  N
Reported Severity:  3

6.2.0.1_iFix003:  CDWA-1933
Description of Issue:  Uninstallation of Connect Direct Windows 6.1 leaves behind Registry entry for agent.enable.
Description of Fix:  Once installation without SecurePlus, we are disabling agent.enable value. Restricted this action to execute on uninstall.
Fix Availability Date:  08 October 2021
High Impact:  N
Reported Severity:  4

6.2.0.1_iFix004:  MFT-12330 / APAR IT38351
Description of Issue:  Upgrade of Connect:Direct fails when the source version has disabled SecurePlus.
Description of Fix:  Addition of check to enable non-SecurePlus upgrades and InstallAgent is disabled when non-SecurePlus installation or upgrade is done.
Fix Availability Date:  08 October 2021
High Impact:  N
Reported Severity:  2

6.2.0.1_iFix005: MFT-12425 / APAR IT38296
Description of Issue:  Unable to apply maintenance on Standalone Requester as well as the SDK.
Description of Fix:  Fixed a condition that was incorrectly trying to start Install Agent, which should only happen for Server installations.
Fix Availability Date:  08 October 2021
High Impact:  N
Reported Severity:  2

6.2.0.1_iFix006:  CDWA-1619
Description of Issue:  Importing of Initparms.cfg with junk or invalid values in password.exit.dll and password.exit.hash doesn't prompt an error.
Description of Fix:  Improved error messages by making them more descriptive while importing config file.
Fix Availability Date:  08 October 2021
High Impact:  N
Reported Severity:  4

6.2.0.1_iFix007:  CDWA-1620
Description of Issue:  Able to install CDW in silent mode with invalid value in Password Exit hash field.
Description of Fix:  Installation fails with invalid hash value during silent install.
Fix Availability Date:  08 October 2021
High Impact:  N
Reported Severity:  3

6.2.0.1_iFix008:  FLAG-253
Description of Issue:  Logging configuration refresh is not working for Integrated File Agent.
Description of Fix:  Added new property monitorInterval=nn (nn in seconds) in log4j2.properties file.
Fix Availability Date:  11 October 2021
High Impact:  N
Reported Severity:  3

6.2.0.1_iFix009:  FLAG-256
Description of Issue:  Integrated File Agent failed to connect to the Connect:Direct server: com.stercomm.csg.SPAdmin.JavaCDSP (initialization failure
Description of Fix:  Updated Integrated File Agent to version 2.0.0.0_iFix006.
Fix Availability Date:  18 October 2021
High Impact:  N
Reported Severity:  2

6.2.0.1_iFix010:  MFT-12623 / APAR IT38765
Description of Issue:  Submitting an inline process in Direct.exe fails with a parser error, such as  LAPP013I or LAPP041I.
Description of Fix:  Fixed an issue with reading non-printable characters from standard input.
Fix Availability Date:  22 October 2021
High Impact:  N
Reported Severity:  2

6.2.0.1_iFix011:  CDWA-1947
Description of Issue:  Silent installation fails when Password Exit DLL and Password Exit Hash is provided.
Description of Fix:  Execution sequence of calculating the hash of the DLL in order to verify the hash provided in silent installation is correct.
Fix Availability Date:  26 October 2021
High Impact:  N
Reported Severity:  2

6.2.0.1_iFix012:  MFT-11822
Description of Issue:  File transfer fails when proxy is used at SNODE and local user (in proxy) is a part of Group Authority but not functional authority-
Description of Fix:  Added logic to check group authority as well if local user is not present in user authority and proxy enabled at SNODE.
Fix Availability Date:  26 October 2021
High Impact:  N
Reported Severity:  2

6.2.0.1_iFix013:  MFT-12584 / APAR IT38768
Description of Issue:  InstallAgent dependencies gets deleted upon upgrade followed by reboot.
Description of Fix: Shifted the logic of Upgrade pre-installation step of deleting the old dependencies in InstallAgent to Windows installer. 
Fix Availability Date:  27 October 2021
High Impact:  N
Reported Severity:  2

6.2.0.1_iFix014:  MFT-12638
Description of Issue:  External statistics not logged for invalid process submission from Integrated File Agent.
Description of Fix: Updated Integrated File Agent to version 2.0.0.0_iFix007.
Fix Availability Date:  27 October 2021
High Impact:  N
Reported Severity:  3

6.2.0.1_iFix015:  CDWA-1918
Description of Issue:  Connect Direct Windows services start up fails post reboot as reading of node name from services fails.
Description of Fix: Retry to read the node name from services due to slow loading of service.
Fix Availability Date:  28 October 2021
High Impact:  N
Reported Severity:  2

6.2.0.1_iFix016:  CDWA-1961
Description of Issue:  Server crashes when invalid/non-existent local userid is found in proxy.
Description of Fix: Added missing logic to return failure if user defined in proxy is not present in group authority.
Fix Availability Date:  29 October 2021
High Impact:  N
Reported Severity:  1

6.2.0.1_iFix017:  FLAG-230
Description of Issue:  A console window pops up during the installation when Integrated File Agent has been selected.
Description of Fix: Updated Integrated File Agent to version 2.0.0.0_iFix008.
Fix Availability Date:  03 November 2021
High Impact:  N
Reported Severity:  3

6.2.0.1_iFix018:  MFT-12651
Description of Issue:  Error "Could not find a JVM to load" can occur during an uninstallation, leaving Integrated File Agent installed.
Description of Fix: Updated Integrated File Agent to version 2.0.0.0_iFix009.
Fix Availability Date:  03 November 2021
High Impact:  N
Reported Severity:  3

All iFixes and fix packs listed above are accumulated in fix pack 2 (6.2.0.2).

iFixes after 6.2.0.2

6.2.0.2_iFix001:  CDUA-2754
Description of Issue:  Support option to use TLS Hello when TLSv1.0 is chosen.
Description of Fix:  The SSLV2 hello has been disabled. Note that TLS 1.0 is deprecated by the IETF since March 2021.
Fix Availability Date:  07 November 2021
High Impact:  N
Reported Severity:  2

6.2.0.2_iFix002:  CDWA-1966
Description of Issue:  On upgrade, unknown reason of failure in uninstallation of base version.
Description of Fix:  Introduced a new command line argument "CD_UNINSTALL_LOGS" to generate the uninstall logs specified.
Fix Availability Date:  09 November 2021
High Impact:  N
Reported Severity:  2

6.2.0.2_iFix003:  CDWA-1731
Description of Issue:  At the time of  interactive Installation: import a File Agent JSON cfg file.
Description of Fix:  Introduced a new UI parameter that will accept the import of JSON cfg file at the time of installation.
Fix Availability Date:  01 December 2021
High Impact:  N
Reported Severity:  3

6.2.0.2_iFix004:  FLAG-249
Description of Issue:  Update Integrated File Agent installer.
Description of Fix:  Updated Integrated File Agent to version 2.0.0.0_iFix010, which is using InstallAnywhere 2021 now.
Fix Availability Date:  06 December 2021
High Impact:  N
Reported Severity:  3

6.2.0.2_iFix005:  CDWA-709
Description of Issue:  When upgrading from version 4.8, a registry key does not get removed during the uninstallation.
Description of Fix:  Fixed the 4.8 registry path for CD_ACTIVEDIR_FLAG in the upgrade.
Fix Availability Date:  06 December 2021
High Impact:  N
Reported Severity:  4

6.2.0.2_iFix006:  CDUA-2698
Description of Issue:  spcli display node commands should not show BaseName parameter left over from deprecated STS feature.
Description of Fix:  Resolved.
Fix Availability Date:  07 December 2021
High Impact:  N
Reported Severity:  5

6.2.0.2_iFix007:  MFT-12770 / APAR IT39370 / CVE-2021-44228
Description of Issue:  There is a vulnerability in Apache Log4j used by Install Agent and Integrated File Agent in IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVE.
Description of Fix:  Updated log4j to version 2.15.0 in Install Agent and Integrated File Agent 2.0.0.0_iFix011.
Fix Availability Date:  14 December 2021
High Impact:  Y
Reported Severity:  1

6.2.0.2_iFix008:  CDWA-2005
Description of Issue:  Roll back upon fresh installation fails with missing JRE configuration file.
Description of Fix:  Upon rollback, the uninstallation of JRE is now executed before File Agent and Install Agent uninstallation.
Fix Availability Date:  16 December 2021
High Impact:  Y
Reported Severity:  2

6.2.0.2_iFix009:  MFT-12789 / APAR IT39414 / CVE-2021-45046
Description of Issue:  There is a vulnerability in Apache Log4j used by Install Agent and Integrated File Agent in IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVE.
Description of Fix:  Updated log4j to version 2.16.0 in Install Agent and Integrated File Agent 2.0.0.0_iFix012.
Fix Availability Date:  17 December 2021
High Impact:  Y
Reported Severity:  1

6.2.0.2_iFix010:  MFT-12792
Description of Issue:  No Password Local Connections from Integrated File Agent failing with a logon error.
Description of Fix:  Set allow.local.connection=true in cdjai.properties in Integrated File Agent 2.0.0.0_iFix013. 
Fix Availability Date:  17 December 2021
High Impact:  Y
Reported Severity:  1

6.2.0.2_iFix011:  MFT-12804 / APAR IT39464 / CVE-2021-45105
Description of Issue:  There is a vulnerability in Apache Log4j version 2.16 used by Install Agent and Integrated File Agent in IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVE.
Description of Fix:  Updated log4j to version 2.17.0 in Install Agent and Integrated File Agent 2.0.0.0_iFix014.
Fix Availability Date:  21 December 2021
High Impact:  Y
Reported Severity:  1

6.2.0.2_iFix012:  CDWA-1965
Description of Issue:  In some scenarios, IBM Control Center may incorrectly conclude that multiple C:D Windows nodes are running on the same system.
Description of Fix:  Add a UUID instance.id to the Initparms and KQV sign-on response. 
Fix Availability Date:  28 December 2021
High Impact:  N
Reported Severity:  2

6.2.0.2_iFix013:  MFT-12864 / APAR IT39949 / CVE-2021-44832
Description of Issue:  Apache Log4j is used by IBM Sterling Connect:Direct for Microsoft Windows as part of its logging infrastructure. There are vulnerabilities in the Apache Log4j open source library versions used by IBM Sterling Connect:Direct for Microsoft Windows. Based on current information and analysis, IBM Sterling Connect:Direct for Microsoft Windows is not impacted by CVE-2021-44832. However, out of an abundance of caution, IBM Sterling Connect:Direct for Microsoft Windows has upgraded Log4j to 2.17.1.
Description of Fix:  Updated log4j to version 2.17.1 in Install Agent and Integrated File Agent 2.0.0.0_iFix015.
Fix Availability Date:  12 January 2022
High Impact:  N
Reported Severity:  2

6.2.0.2_iFix014:  CDWA-2027
Description of Issue:  Memory leak occurring when checking if a user account has adminstrator level privilege.
Description of Fix:  Updated a condition to check if it is not null before freeing the memory.
Fix Availability Date:  14 January 2022
High Impact:  Y
Reported Severity:  2

All iFixes and fix packs listed above are accumulated in fix pack 3 (6.2.0.3).

iFixes after 6.2.0.3

6.2.0.3_iFix001:  CDWA-2080
Description of Issue:  Server crashes while retrieving big File Agent Configuration file.
Description of Fix:  Updated logic to prevent buffer overflow.
Fix Availability Date:  24 February 2022
High Impact:  N
Reported Severity:  3

6.2.0.3_iFix002:  MFT-12840, MFT-13009
Description of Issue:  Logging issues with Integrated File Agent:
(a) An IOError is logged during a watched directory scan when a folder, sub folder or file does not exist or is not readable. 
(b) The cdfastart/stop/monitor cmd scripts do not write log files when installed on a drive other than the system drive. 
Description of Fix:  Updated Integrated File Agent to version 2.0.0.0_iFix019, which logs detailed messages for 'does not exist' and 'not readable'.
Fix Availability Date:  08 March 2022
High Impact:  N
Reported Severity:  2

6.2.0.3_iFix003:  CDWA-2080
Description of Issue:  Improved logging in CD Database Wizard (DbWiz) for install and upgrade.
Description of Fix:  Added logs in DbWiz for install and upgrade.
Fix Availability Date:  27 April 2022
High Impact:  N
Reported Severity:  3

6.2.0.3_iFix004:  CDWA-2047
Description of Issue:  Destination file can become corrupted if Checkpoint offset is beyond the file's EOF. 
Description of Fix:  Added check to ensure Checkpoint offset doesn't exceed the file's EOF.
Fix Availability Date:  18 March 2022
High Impact:  N
Reported Severity:  2

6.2.0.3_iFix005:  CDWA-2106
Description of Issue:  Password Exit Message overwrites previous message ID: LIPF022F.
Description of Fix:  Updated message ID: LIPF022F to previous message and created new message ID: LIPF035F for Password Exit Message.
Fix Availability Date:  23 March 2022
High Impact:  N
Reported Severity:  3

6.2.0.3_iFix006: CDWA-2067
Description of Issue:  The server returns success when trying to delete a non-existing functional authority or proxy.
Description of Fix:  Return a warning (MSG ID : LCCA048I and LCCA088I) when the specified entry does not exist.
Fix Availability Date:  29 March 2022
High Impact:  N
Reported Severity:  3

6.2.0.3_iFix007:  MFT-13005, FLAG-267
Description of Issue:  Integrated File Agent startup can take a long time before the first directory scan gets started, especially when many directories are located on slow or remote file systems.
Description of Fix:  Updated Integrated File Agent to version 2.0.0.0_iFix021, also which removes any Spring Boot references.
Fix Availability Date:  21 April 2022
High Impact:  N
Reported Severity:  2

6.2.0.3_iFix007b:  CDWA-1973
Description of Issue:  On Upgrade, agent.enable value set to 'Y', although Install Agent was not running in source version.
Description of Fix: On upgrade, set agent.enable to 'N' in case Install Agent was not running in source version.
Fix Availability Date:  18 November 2021
High Impact:  N
Reported Severity:  2

6.2.0.3_iFix008:  CDWA-1985
Description of Issue:  Logging improvement when setting agent.enable to 'N' during Installation/Upgrade
Description of Fix:  Different logs are added when setting agent.enable to 'N' in case if Secure+ is not present or Install Agent was not running in source version.
Fix Availability Date:  07 December 2021
High Impact:  N
Reported Severity:  4

6.2.0.3_iFix009:  CDWA-1978
Description of Issue:  Default value of agent.enable during silent installation without Secure+ set as 'Y'.
Description of Fix:  Added condition to set agent.enable value to 'N' if Secure+ is not installed during silent installation. 
Fix Availability Date:  11 January 2022
High Impact:  N
Reported Severity:  3

6.2.0.3_iFix010:  CDWA-2062
Description of Issue:  Disabling Install Agent services if agent.enable is set to 'N'.
Description of Fix:  Updated the Change Install Agent service Type value to 'Disabled' when agent.enable is 'N'.
Fix Availability Date:  20 February 2022
High Impact:  N
Reported Severity:  2

6.2.0.3_iFix011:  CDWA-1948
Description of Issue:  Add support for Data Collector.
Description of Fix:  Data Collector will gather complete configuration information of Connect:Direct server. It will eliminate the need to generate multiple configuration report manually.
Fix Availability Date:  03 February 2022
High Impact:  N
Reported Severity:  5

6.2.0.3_iFix012:  CDWA-1970
Description of Issue:  A new Connect:Direct for Windows Password Exit supports accessing authorized passwords from a CyberArk password vault. 
Description of Fix:  For more information, see the documentation.
Fix Availability Date:  27 April 2022
High Impact:  N
Reported Severity:  5

All iFixes and fix packs listed above are accumulated in fix pack 4 (6.2.0.4).

iFixes after 6.2.0.4

6.2.0.4_iFix001:  MFT-13286
Description of Issue:  Unable to configure Integrated File Agent using Connect:Direct WebServices (CDWS).
Description of Fix:  The location for all File Agent configuration files changed to FileAgent\config.
Fix Availability Date:  20 May 2022
High Impact:  N
Reported Severity:  2

6.2.0.4_iFix002:  CDWA-2225
Description of Issue: Improve diagnostics when checking if a user account is an administrator.
Description of Fix:  Added more detailed tracing. Also resolved a potential memory leak when retrieving information about a particular user account on a server failed.
Fix Availability Date:  23 May 2022
High Impact:  N
Reported Severity:  3

6.2.0.4_iFix003:  MFT-13201
Description of Issue: Need diagnostics when creating a default configuration for Integrated File Agent during the installation fails. Also, the console window may still pop up during the installation.
Description of Fix:  Updated Integrated File Agent to version 2.0.0.0_iFix024, which adds a new log file cdfacreatecfg.log when creating a default configuration during its installation.
Fix Availability Date:  08 June 2022
High Impact:  N
Reported Severity:  3

6.2.0.4_iFix004:  MFT-13309 / APAR IT40963 / CVE-2018-25032
Description of Issue: There is a vulnerability in the zlib library used in IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVE.
Description of Fix:  Updated zlib library to version 1.2.12.
Fix Availability Date:  08 June 2022
High Impact:  Y
Reported Severity:  2

6.2.0.4_iFix005:  MFT-13321 / APAR IT40971 / CVE-2021-35550, CVE-2021-35603
Description of Issue:  Vulnerabilities have been found in the IBM Runtime Environment Java Technology Edition, Version 8 used by Install Agent and Integrated File Agent in IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVEs.
Description of Fix:  Updated the IBM Runtime Environment Java.
Fix Availability Date:  09 June 2022
High Impact:  Y
Reported Severity:  2

6.2.0.4_iFix006:  MFT-13154 / APAR IT41285
Description of Issue: When Connect Direct Windows is installed in custom directory,upgrade through Control Center Directory makes folder in default location.
Description of Fix:  In command to trigger upgrade introduced install directory as an argument.
Fix Availability Date:  21 June 2022
High Impact:  Y
Reported Severity:  2

6.2.0.4_iFix007:  CDWA-2266
Description of Issue: Make configuration parameters reflect the feature's new name: Port Check Ignore List
Description of Fix:  Configuration parameters have been changed to reflect the new name Port Check Ignore List
Fix Availability Date:  23 June 2022
High Impact:  N
Reported Severity:  5

6.2.0.4_iFix008: MFT-13298 / APAR IT41129 / CVE-2021-3677, CVE-2022-1552
Description of Issue: Multiple vulnerabilities have been found in PostgreSQL 13 used by IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVEs.
Description of Fix: Updated PostgreSQL to version 13.7.
Fix Availability Date: 27 June 2022
High Impact: Y
Reported Severity: 2

6.2.0.4_iFix009: CDWA-2257
Description of Issue: Upgrade failing as DBWiz crashes while importing TCQ
Description of Fix: Fixed.
Fix Availability Date: 01 July 2022
High Impact: Y
Reported Severity: 2

6.2.0.4_iFix010: MFT-13401 / APAR IT41489
Description of Issue: While submitting within a process to Connect:Direct UNIX, this will fail with XSQF009I fdbk=2 as double quotes get added to the process filename while submitting to the Connect:Direct UNIX server.
Description of Fix: Removal of double quotes in process filename before sending to the server.
Fix Availability Date: 28 July 2022
High Impact: Y
Reported Severity: 2

6.2.0.4_iFix011:  MFT-13493 / APAR IT41520
Description of Issue:  Looking up an account name on the system finally fails with LSDS002E during user authentication on the SNODE. More diagnostics are needed to capture the system error.
Description of Fix:  Imporved error reporting in traces.
Fix Availability Date:  29 July 2022 
High Impact:  N
Reported Severity:  2

6.2.0.4_iFix012:  MFT-13547 / APAR IT41528 / CVE-2022-25647
Description of Issue:  A vulnerability has been found in Google Gson used by Integrated File Agent in IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVE.
Description of Fix:  Updated Integrated File Agent to version 2.0.0.0_iFix029.
Fix Availability Date:  03 August 2022
High Impact:  Y
Reported Severity:  2

6.2.0.4_iFix013:  MFT-13491 / APAR IT41533 / CVE-2022-33980
Description of Issue:  A vulnerability has been found in Apache Commons Configuration used by Install Agent and Integrated File Agent in IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVE.
Description of Fix:  Resolved.
Fix Availability Date:  03 August 2022
High Impact:  Y
Reported Severity:  2

6.2.0.4_iFix014:  MFT-13581
Description of Issue:  Applying a new Integrated File Agent configuration through Connect:Direct WebServices fails with LCCA111E: FileAgent config file length either 0 or greater in size.
Description of Fix:  Updated Integrated File Agent to version 2.0.0.0_iFix031.
Fix Availability Date:  09 August 2022
High Impact:  N
Reported Severity:  2

6.2.0.4_iFix015:  MFT-13273 / APAR IT41614
Description of Issue:  Sysopts parameter strip.oneable(yes) strips all ^Z (0x1A) characters from old DOS files instead of just from the end.
Description of Fix:  Updated the logic to only strip ^Z from the end of old DOS files.
Fix Availability Date:  29 August 2022
High Impact:  N
Reported Severity:  2

6.2.0.4_iFix016:  CDWA-2452
Description of Issue:  CDW crashing when certificate common name validation fails for SEA server record.
Description of Fix: Corrected error logging to prevent crash.
Fix Availability Date:  31 October 2022
High Impact:  N
Reported Severity:  1

6.2.0.4_iFix017:  MFT-13781 / APAR IT42066 / CVE-2022-42889
Description of Issue:  A vulnerability has been found in Apache Commons Text used by Install Agent and Integrated File Agent in IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVE.
Description of Fix:  Updated Apache Commons Text in Install Agent and Integrated File Agent 2.0.0.0_iFix034.
Fix Availability Date:  8 November 2022
High Impact:  N
Reported Severity:  1

6.2.0.4_iFix018:  MFT-13858 / APAR IT42542
Description of Issue:  The CLI (Direct.exe) ignores German umlaut characters in commands and removes them from the input. This occurs when manually entering the command as well as when redirecting input from a file.  
Description of Fix:  Updated the logic which was skipping non-printable characters from input.
Fix Availability Date:  7 December 2022
High Impact:  N
Reported Severity:  1

6.2.0.4_iFix019:  CDWA-2388
Description of Issue:  Password exit is not enabled for a user associated in group authority after a client using the Application Interface for Java (AIJ) has created a bad group authority with domain=*local.
Description of Fix:  Added code to ignore any *local domain entries.
Fix Availability Date:  12 December 2022
High Impact:  Y
Reported Severity:  2

6.2.0.4_iFix020:  MFT-13995, MFT-13996 / APAR IT42997 / CVE-2022-41915, CVE-2022-42003, CVE-2022-42004, 217968
Description of Issue:  Vulnerabilities have been found in FasterXML jackson-databind and Netty used by Install Agent and/or Integrated File Agent in IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVEs.
Description of Fix:  Updated FasterXML jackson and Netty in Install Agent and Integrated File Agent 2.0.0.0_iFix038.
Fix Availability Date:  31 January 2023
High Impact:  Y
Reported Severity:  2

6.2.0.4_iFix021:  MFT-13997 / APAR IT42991 / CVE-2022-3676, CVE-2022-21626
Description of Issue:  Vulnerabilities have been found in the IBM Runtime Environment Java Technology Edition, Version 8 and in Eclipse OpenJ9 used by IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVEs.
Description of Fix:  Updated the IBM Runtime Environment Java to version 8.0.7.20.
Fix Availability Date:  31 January 2023
High Impact:  Y
Reported Severity:  2

6.2.0.4_iFix022:  MFT-13656
Description of Issue:  Remove Microsoft Visual C++ 2012 (x64) Redistributable Package from the installer.
Description of Fix:  Removed the redistributable package from setup prerequisites in the installer, so that it will no longer be installed for updates, upgrades or new installations. 
Fix Availability Date:  31 January 2023
High Impact:  N
Reported Severity:  4

6.2.0.4_iFix023:  MFT-13891 / APAR IT43205
Description of Issue:  Server crashes.
Description of Fix:  Added handling for unexpected conditions while deleting timer entries, checking Install Agent status or calling the parser for a submit within a process.
Fix Availability Date:  28 February 2023
High Impact:  Y
Reported Severity:  2

6.2.0.4_iFix024:  MFT-14025 / APAR IT43272
Description of Issue:  Integrated File Agent may not uninstall properly. LaunchAnywhere Error: Could not find a valid Java virtual machine to load.
Description of Fix:  Updated Integrated File Agent to version 2.0.0.0_iFix044.
Fix Availability Date:  06 March 2023
High Impact:  N
Reported Severity:  3

6.2.0.4_iFix025:  CDWA-2797
Description of Issue:  Cipher suites are not showing in the Connect:Direct Webservices main page when we set cipher suites to "Default to Local"..
Description of Fix:  Sending cipher suites with "DefaultToLN" as we were sending blank earlier
Fix Availability Date:  15 March 2023
High Impact:  Y
Reported Severity:  3

6.2.0.4_iFix026:  CDWA-2798
Description of Issue:  Secure+ commands from API client failing in case the username has spaces.
Description of Fix:  Quotes for username added when Secure+ command is executed.
Fix Availability Date:  20 March 2023
High Impact:  Y
Reported Severity:  3

6.2.0.4_iFix027:  MFT-14234 / APAR IT46016
Description of Issue:  Web Services showing encrypted texts if process file contains tilde (~) character.
Description of Fix:  Tilde (~) should not get replaced by double quote (") in response to Get Process. 
Fix Availability Date:  04 April 2023
High Impact:  N
Reported Severity:  2

6.2.0.4_iFix028:  MFT-14255
Description of Issue:  Integrated File Agent throwns a FileAgentCfgException (Method not found). In addition, some 3rd-party libraries require an update.
Description of Fix:  Updated Integrated File Agent to version 2.0.0.0_iFix048.
Fix Availability Date:  11 April 2023
High Impact:  N
Reported Severity:  3

6.2.0.4_iFix029:  MFT-14265 / APAR IT43548 / CVE-2022-21426, CVE-2023-21830, CVE-2023-21843
Description of Issue:  Vulnerabilities found in IBM Runtime Environment Java Technology Edition, Version 8 affect IBM Sterling Connect:Direct for Microsoft Windows.
Description of Fix:  Updated the IBM Runtime Environment Java to version 8.0.8.0.
Fix Availability Date:  13 April 2023
High Impact:  Y
Reported Severity:  2

6.2.0.4_iFix030:  MFT-14278 / APAR IT43556 / CVE-2022-41862
Description of Issue:  A vulnerability found in PostgreSQL affects IBM Connect:Direct for Microsoft Windows.
Description of Fix:  Updated PostgreSQL to version 13.10.
Fix Availability Date:  14 April 2023
High Impact:  N
Reported Severity:  2

6.2.0.4_iFix031:  CDWA-2236
Description of Issue:  The server returns completion message and an additional ERRC message with completion code 0 when trying to delete a non-existing functional authority or proxy causing CDJAI to not display any output.
Description of Fix:  Server now returns only completion message with no proxy/functional authority found for given entry.
Fix Availability Date:  18 April 2023
High Impact:  N
Reported Severity:  3

6.2.0.4_iFix032:  CDWA-2867
Description of Issue:  Self-signed key certificates are not displayed under Trusted Certificates in CD Secure+ Admin Tool (spadmin).
Description of Fix:  Updated spadmin.
Fix Availability Date:  19 April 2023
High Impact:  N
Reported Severity:  3

6.2.0.4_iFix033:  MFT-14291 / APAR IT43598 / CVE-2023-20860, CVE-2023-20861
Description of Issue:  Vulnerabilities found in Spring Framework affect Integrated File Agent.
Description of Fix:  Updated Integrated File Agent to version 2.0.0.0_iFix049.
Fix Availability Date:  20 April 2023
High Impact:  N
Reported Severity:  2

6.2.0.4_iFix034:  CDWA-2885
Description of Issue:  Update Install Agent to latest version.
Description of Fix:  Updated Install Agent.
Fix Availability Date:  27 April 2023
High Impact:  N
Reported Severity:  2

6.2.0.4_iFix035:  MFT-14254, FLAG-292
Description of Issue:  Integrated File Agent issues:
(a) Match criteria for Watch Directory (WATCH_FILEPATH) does not match for Object Store path.
(b) Error logging statistics when the process number is greater than 999. 
Description of Fix:  Updated Integrated File Agent to version 2.0.0.0_iFix053.
Fix Availability Date:  27 April 2023
High Impact:  N
Reported Severity:  2

6.2.0.4_iFix036:  MFT-14451 / APAR IT43876 / CVE-2023-32342
Description of Issue:  IBM Sterling Connect:Direct for Microsoft Windows is vulnerable to a timing oracle in RSA decryption due to IBM GSKit.
Description of Fix:  Updated GSKit to version 8.0.55.31.
Fix Availability Date:  02 June 2023
High Impact:  Y
Reported Severity:  2

6.2.0.4_iFix037:  MFT-14448 / APAR IT43877 / CVE-2023-2454, CVE-2023-2455
Description of Issue:  IBM Sterling Connect:Direct for Microsoft Windows is vulnerable to arbitrary code execution (CVE-2023-2454) and is affected to a policy issue (CVE-2023-2455) due to PostgreSQL.
Description of Fix:  Updated PostgreSQL to version 13.11.
Fix Availability Date:  02 June 2023
High Impact:  Y
Reported Severity:  2

6.2.0.4_iFix038:  MFT-14482 / APAR IT43953
Description of Issue:  Password Exit parameters for Application ID and Policy get reset when modifying user functional authority using CD Web Services.
Description of Fix:  Server now does not reset Password Exit parameters if it does not receive these parameters in change request.
Fix Availability Date:  13 June 2023
High Impact:  N
Reported Severity:  2

6.2.0.4_iFix039:  CDWA-2985, MFT-14538 / APAR IT44069 / CVE-2023-2597, CVE-2023-21930, CVE-2023-21937, CVE-2023-21938, CVE-2023-21939, CVE-2023-21954, CVE-2023-21967, CVE-2023-21968, CVE-2022-40609
Description of Issue:  Vulnerabilities found in IBM Runtime Environment Java Technology Edition, Version 8 apply to IBM Sterling Connect:Direct for Microsoft Windows.
Vulnerable: CVE-2023-21930, CVE-2023-21967 and CVE-2023-21968.
Affected: CVE-2023-2597, CVE-2023-21937, CVE-2023-21938, CVE-2023-21939, CVE-2023-21954.
Description of Fix:  Updated the IBM Runtime Environment Java to version 8.0.8.5.
Fix Availability Date:  28 June 2023
High Impact:  Y
Reported Severity:  2

6.2.0.4_iFix040:  MFT-14410, MFT-14452, MFT-14571, MFT-14572, MFT-14576 / APAR IT44054 / CVE-2023-20863, 256137, CVE-2023-35116, CVE-2023-33201, CVE-2023-34462
Description of Issue: Vulnerabilities found in Spring Framework (CVE-2023-20863), FasterJackson (256137, CVE-2023-35116), Bouncy Castle (CVE-2023-33201), Netty (CVE-2023-34462) used by Integrated File Agent and Install Agent are affecting IBM Sterling Connect:Direct for Microsoft Windows.
Description of Fix:  Updated Install Agent and Integrated File Agent to version 2.0.0.0_iFix057.
Fix Availability Date:  29 June 2023
High Impact:  N
Reported Severity:  2

6.2.0.4_iFix041:  CDWA-3011
Description of Issue:  LCCA083I and LCCA084I are defined twice with very different meaning.
Description of Fix:  Updated LCCA083I and LCCA084I with new id and messages.
Fix Availability Date:  25 July 2023
High Impact:  N
Reported Severity:  3

6.2.0.4_iFix042:  CDWA-2991
Description of Issue:  Some Secure+ errors get logged in statistics without an underlying error code, for example SSL receive failure like CSPA204E.
Description of Fix:  Fixed substitution for Secure+ error messages. 
Fix Availability Date:  31 July 2023
High Impact:  N
Reported Severity:  4

6.2.0.4_iFix043:  CDWA-2539
Description of Issue:  When executing Run Task or Run Job without sysopts, the error message was not appropriate.
Description of Fix:  Introduced new error code incase sysopts is not present in Run Task or Run Job.
Fix Availability Date:  04 August 2023
High Impact:  N
Reported Severity:  3

6.2.0.4_iFix044:  MFT-14702 / APAR IT44321
Description of Issue:  Requester crashes when opening a translation table file and the user has not connected to a CD node.
Description of Fix:  Resolved.
Fix Availability Date:  07 August 2023
High Impact:  N
Reported Severity:  3

6.2.0.4_iFix045:  MFT-14618 / APAR IT44374
Description of Issue:  Upon minor upgrade Integrated File Agent was getting installed when the base version of Connect:Direct Windows installed does not have Integrated File Agent installed.
Description of Fix:  Fixed the sequence of installation and upgrade.
Fix Availability Date:  16 August 2023
High Impact:  N
Reported Severity:  4

6.2.0.4_iFix046:  MFT-14355 / APAR IT44426
Description of Issue:  When user installs using Microsoft SQL, latest version of drivers for initialisation was not being used.
Description of Fix:  SQL driver selection criteria changed.
Fix Availability Date:  23 August 2023
High Impact:  N
Reported Severity:  3

6.2.0.4_iFix047:  CDWA-2653
Description of Issue:  Some Secure+ errors get logged in statistics without an underlying error code, for example SSL handshake failure like CSPA202E.
Description of Fix: Fixed substitution for Secure+ error messages. 
Fix Availability Date:  28 August 2023
High Impact:  N
Reported Severity:  4

6.2.0.4_iFix048:  CDWA-2992
Description of Issue:  Some Secure+ errors get logged in statistics without an underlying error code, for example TCP Read failure like LIPT027I.
Description of Fix:  Fixed substitution for error messages. 
Fix Availability Date:  04 September 2023
High Impact:  N
Reported Severity:  4

6.2.0.4_iFix049:  MFT-14709
Description of Issue:  Shortcut of SPCli/SPAdmin  in start menu does not appear for latest version if more than one version of Connect:Direct is installed on the system.
Description of Fix:  Corrected target path of SPCli/SPAdmin shortcuts.
Fix Availability Date:  06 September 2023
High Impact:  N
Reported Severity:  3

6.2.0.4_iFix050:  MFT-14468 / APAR IT44488
Description of Issue:  When a user has password exit enabled, the password exit does not get called for proxy mapping or PNODEID/SNODEID when they contain a password.
Description of Fix:  When enabled, the password exit is always called for proxy mapping and PNODEID/SNODEID. Any specified password will be ignored and the new password will be retrieved from the exit.
Fix Availability Date:  07 September 2023
High Impact:  N
Reported Severity:  2

6.2.0.4_iFix051:  CDWA-3039
Description of Issue:  Silent installation of Connect:Direct for Windows with Secure+ disabled is creating Secure+ files.
Description of Fix:  Silent installation of Connect:Direct for Windows with Secure+ disabled now not creating any files for Secure+.
Fix Availability Date:  13 September 2023
High Impact:  N
Reported Severity:  3

6.2.0.4_iFix052:  CDWA-1349
Description of Issue:  Upload/Download/Process/Program directory for a proxy is not getting reset to blank once it is set.
Description of Fix:  Server now reset Upload/Download/Process/Program directory to blank, if it is reset to blank in change request.
Fix Availability Date:  15 September 2023
High Impact:  N
Reported Severity:  2

6.2.0.4_iFix053:  MFT-14816, MFT-14870
Description of Issue:  Multiple issues in Integrated File Agent:
- After running for an extended time, Integrated File Agent may fail and generate java core dumps.
- Integrated File Agenrt fails with a NullPointerException when using certificated-based authentication. 
Description of Fix:  Updated Integrated File Agent to version 2.0.0.0_iFix063.
Fix Availability Date:  11 October 2023
High Impact:  N
Reported Severity:  2

All iFixes and fix packs listed above are accumulated in fix pack 5 (6.2.0.5).

iFixes after 6.2.0.5

6.2.0.5_iFix001:  CDWA-2687
Description of Issue:  Configuration utility is throwing an error while extracting Map.cfg file for Description key.
Description of Fix:  Fixed error popup for empty Description key in configuration utility.
Fix Availability Date:  19 October 2023
High Impact:  N
Reported Severity:  3

6.2.0.5_iFix002:  MFT-14934 / APAR IT44835 / CVE-2023-4586
Description of Issue:  A vulnerability found in Netty (CVE-2023-4586) used by Integrated File Agent is affecting IBM Sterling Connect:Direct for Microsoft Windows.
Description of Fix:  Updated Integrated File Agent to version 2.0.0.0_iFix064.
Fix Availability Date:  27 October 2023
High Impact:  N
Reported Severity:  2

6.2.0.5_iFix003:  CDWA-3183
Description of Issue:  The Command Line Interface (CLI) displays column headings for Select Process and Select Statistics commands when detail=yes was specified.
Description of Fix:  Removed the column heading from detail=yes output.
Fix Availability Date:  06 November 2023
High Impact:  N
Reported Severity:  3

6.2.0.5_iFix004:  CDWA-3172
Description of Issue:  Data Collector was not collecting Integrated File Agent configuration.
Description of Fix:  Updated Data Collector to collect Integrated File Agent configuration.
Fix Availability Date:  16 November 2023
High Impact:  N
Reported Severity:  3

All iFixes and fix packs listed above are accumulated in fix pack 6 (6.2.0.6).

iFixes after 6.2.0.6

6.2.0.6_iFix001:  MFT-15083 / APAR IT45015 / CVE-2023-5868, CVE-2023-5869, CVE-2023-5870
Description of Issue:  Multiple vulnerabilities found in PostgreSQL affect IBM Sterling Connect:Direct for Microsoft Windows.
Description of Fix:  Updated PostgreSQL to version 13.13.
Fix Availability Date:  27 Nov 2023
High Impact:  Y
Reported Severity:  2

6.2.0.6_iFix002:  MFT-15100 / APAR IT45088
Description of Issue:  Enhance the Logon Configuration Utility (LCU.bat) to support batch mode operation with reading values from a file or another command's output (pipe).
Description of Fix:  Added batch mode (-b) with reading input from stdin.
Fix Availability Date:  07 December 2023
High Impact:  N
Reported Severity:  5

6.2.0.6_iFix003:  MFT-15191 / APAR IT45130 / CVE-2023-4785, CVE-2023-33953, CVE-2023-34054, CVE-2023-34055, CVE-2023-34062, CVE-2023-36414, CVE-2023-36415, CVE-2023-44487
Description of Issue:  Vulnerabilities found in azure-identity (CVE-2023-36414, CVE-2023-36415), grpc-core and grps-protobuf (CVE-2023-4785, CVE-2023-33953, CVE-2023-44487), Netty (CVE-2023-34054, CVE-2023-34062) and Spring Boot (CVE-2023-34055) used by Integrated File Agent are affecting IBM Sterling Connect:Direct for Microsoft Windows.
Description of Fix:  Updated Integrated File Agent to version 2.0.0.0_iFix065.
Fix Availability Date:  13 December 2023
High Impact:  N
Reported Severity:  2

6.2.0.6_iFix004:  MFT-15197
Description of Issue:  Integrated File Agent doesn't get updated on Connect Direct Windows update.
Description of Fix:  Fixed the update condition for Integrated File Agent.
Fix Availability Date:  15 December 2023
High Impact:  N
Reported Severity:  2

6.2.0.6_iFix005:  MFT-15173 / APAR IT45232
Description of Issue:  Secure+\Lib directory doesn't get updated on Connect Direct Windows minor upgrade, causing SPCli or SPAdmin to fail with a java.lang.NoClassDefFoundError.
Description of Fix:  Updated the installer to properly update the Secure+\Lib folder.
Fix Availability Date:  08 January 2024
High Impact:  N
Reported Severity:  3

6.2.0.6_iFix006:  CDWA-3319, MFT-14807, MFT-15089 / APAR IT45251 / CVE-2023-22081, CVE-2023-22067, CVE-2023-5676, CVE-2023-22045, CVE-2023-22049
Description of Issue:  Vulnerabilities found in IBM Runtime Environment Java Technology Edition, Version 8 apply to IBM Sterling Connect:Direct for Microsoft Windows.
Vulnerable: CVE-2023-22081, CVE-2023-5676, CVE-2023-22045, CVE-2023-22049
Affected: CVE-2023-22067
Description of Fix:  Updated the IBM Runtime Environment Java to version 8.0.8.15.
Fix Availability Date:  10 January 2024
High Impact:  Y
Reported Severity:  2

6.2.0.6_iFix007:  MFT-15209 / APAR IT45252 / CVE-2023-36478, CVE-2023-44487, CVE-2023-40167, CVE-2023-36479, CVE-2023-41900
Description of Issue:  Vulnerabilities found in jetty-io and jetty-server used by Install Agent are apply to IBM Sterling Connect:Direct for Microsoft Windows.
Vulnerable: CVE-2023-36478, CVE-2023-44487, CVE-2023-40167
Affected: CVE-2023-36479, CVE-2023-41900
Description of Fix:  Updated Install Agent.
Fix Availability Date:  10 January 2024
High Impact:  N
Reported Severity:  2

6.2.0.6_iFix008:  MFT-15201 / APAR IT45333, 
Description of Issue:  More diagnostics needed for startup failures occurring during SPE rekey.
Description of Fix:  Improved error reporting and tracing.
Fix Availability Date:  29 January 2024
High Impact:  N
Reported Severity:  3

6.2.0.6_iFix009:  CDWA-3351 / MFT-15209 / APAR IT45484 / CVE-2019-15052, CVE-2023-35947, CVE-2021-29428, CVE-2020-11979, CVE-2021-32751, CVE-2023-44387, CVE-2019-11065, CVE-2019-16370, CVE-2021-29429, CVE-2023-35946, CVE-2023-42445, CVE-2022-24329
Description of Issue:  Vulnerabilities found in gradle-buildconfig-plugin and kotlin-stdlib used by Install Agent affecting IBM Sterling Connect:Direct for Microsoft Windows.
Affected: CVE-2019-15052, CVE-2023-35947, CVE-2021-29428, CVE-2020-11979, CVE-2021-32751, CVE-2023-44387,CVE-2019-11065, CVE-2019-16370, CVE-2021-29429, CVE-2023-35946, CVE-2023-42445, CVE-2022-24329
Description of Fix:  Updated Install Agent.
Fix Availability Date:  01 February 2024
High Impact:  N
Reported Severity:  2

6.2.0.6_iFix010:  MFT-15195 / APAR IT45564
Description of Issue:  When viewing statistics, garbage characters may get displayed in some short message text with substitution, for example LCPS002I.
Description of Fix:  Fixed substitution in message text.
Fix Availability Date:  26 February 2024
High Impact:  N
Reported Severity:  3

6.2.0.6_iFix011:  MFT-15194 / APAR IT45615
Description of Issue:  Upon extracting the User configuration using Connect Direct Configuration Utility, decryption of password in proxy fails without error reporting.
Description of Fix: Introduced creation of log file on extract of configuration.
Fix Availability Date:  05 March 2024
High Impact:  N
Reported Severity:  3

6.2.0.6_iFix012:  MFT-15463, FLAG-311, MFT-15293 / APAR IT45614, IT45613 / CVE-2023-52428
Description of Issue:  Integrated File Agent updates and enhancements:  
- Vulnerability found in Connect2id Nimbus JOSE+JWT used by Integrated File Agent applies to IBM Sterling Connect:Direct for Microsoft Windows.
  Vulnerable: CVE-2023-52428
- Add more File Agent variables for Cloud Object Store:
   %FA_CONTAINER. The container/bucket name without scheme
   %FA_OBJECTKEY. The object key
- When Integrated File Agent failed to submit a process with a ConnectionException, then the related file was incorrectly added to the ckpt and not retried.
Description of Fix:  Updated Integrated File Agent to version 2.0.0.0_iFix069.
Fix Availability Date:  01 March 2024
High Impact:  N
Reported Severity:  2

6.2.0.6_iFix013:  MFT-15409 , CDWA-3391 / APAR IT45652 / CVE-2024-0985
Description of Issue:  Vulnerability found in PostgreSQL affects IBM Sterling Connect:Direct for Microsoft Windows
Affected: CVE-2024-0985
Description of Fix:  Updated PostgreSQL to version 13.14.
Fix Availability Date:  07 March 2024
High Impact:  Y
Reported Severity:  2

6.2.0.6_iFix014:  MFT-15410, CDWA-3429 / APAR IT45651 / CVE-2024-20952, CVE-2024-20918, CVE-2024-20921, CVE-2024-20919, CVE-2024-20926, CVE-2024-20945, CVE-2023-33850
Description of Issue:  Vulnerabilities found in IBM Runtime Environment Java Technology Edition, Version 8 used by Integrated File Agent in IBM Sterling Connect:Direct for Microsoft Windows.
Vulnerable: CVE-2024-20952, CVE-2024-20918, CVE-2024-20921, CVE-2024-20919, CVE-2024-20926, CVE-2024-20945, CVE-2023-33850
Description of Fix:  Updated the IBM Runtime Environment Java to version 8.0.8.20.
Fix Availability Date:  08 March 2024
High Impact:  Y
Reported Severity:  2

6.2.0.6_iFix015:  MFT-15565
Description of Issue:  Integrated File Agent started failing with IBM Runtime Environment Java version 8.0.8.20+ when using password-based authentication:
- Integrated File Agent fails to connect to the Connect:Direct node with a FileAgentCfgException:
    Method not found: getApiPassword
- cdfacreatecfg fails with an EncryptionOperationNotPossibleException when importing a properties file that specifies apiPassword.
- Integrated Web Services fails to set a new password for Integrated File Agent 
Description of Fix:  Updated Integrated File Agent to version 2.0.0.0_iFix072.
Fix Availability Date:  22 March 2024
High Impact:  Y
Reported Severity:  2

6.2.0.6_iFix016:  MFT-15579 / APAR IT46017 / CVE-2024-29025
Description of Issue:  Vulnerability found in netty-codec-http used by Integrated File Agent applies to IBM Sterling Connect:Direct for Microsoft Windows.
Affected: CVE-2024-29025
Description of Fix:  Updated Integrated File Agent to version 2.0.0.0_iFix078.
Fix Availability Date:  25 April 2024
High Impact:  N
Reported Severity:  2

6.2.0.6_iFix017:  MFT-15696 / APAR IT46049
Description of Issue:  Creating password-less proxy fails with LCCA083I, even though the user is a member of the local administrators group.
Description of Fix:  Fixed an issue determining the group name.
Fix Availability Date:  29 April 2024
High Impact:  N
Reported Severity: 2

6.2.0.6_iFix018:   MFT-15634 / APAR IT46153
Description of Issue:  A rare timing issue has been detected causing an incorrect SNODE to be used after submitting a process. When the error is detected, LSMG645I is logged to statistics and the process is placed in hold error queue.
Description of Fix:  Added SNODE consistency checking to submit process.
Fix Availability Date:  14 May 2024
High Impact:  Y
Reported Severity: 1

6.2.0.6_iFix019:  MFT-15756 / APAR IT46171 / CVE-2024-21094, CVE-2024-21085, CVE-2024-21011, CVE-2023-38264
Description of Issue:  Vulnerabilities found in IBM Runtime Environment Java Technology Edition, Version 8 apply to IBM Sterling Connect:Direct for Microsoft Windows.
Affected: CVE-2024-21094, CVE-2024-21085, CVE-2024-21011, CVE-2023-38264
Description of Fix:  Updated the IBM Runtime Environment Java to version 8.0.8.25.
Fix Availability Date:  16 May 2024
High Impact:  N
Reported Severity:  2

6.2.0.6_iFix020:  MFT-15651 / APAR IT46218 / CVE-2024-29133, CVE-2024-29131, CVE-2023-35116
Description of Issue:  Vulnerabilities found in commons-configuration and jackson-databind used by Install Agent, Integrated File Agent and Integrated Web Services apply to IBM Sterling Connect:Direct for Microsoft Windows.
Affected: CVE-2024-29133, CVE-2024-29131, CVE-2023-35116
Description of Fix:  Updated Install Agent and Integrated File Agent.
Fix Availability Date:  27 May 2024
High Impact:  N
Reported Severity:  2

6.2.0.6_iFix021:  MFT-15783 / APAR IT46222 / CVE-2024-30171, CVE-2024-34447, CVE-2024-30172, CVE-2024-29857
Description of Issue:  Vulnerabilities found in Bouncy Castle used by Install Agent and Integrated File Agent apply to IBM Sterling Connect:Direct for Microsoft Windows.
Affected: CVE-2024-30171, CVE-2024-34447, CVE-2024-30172, CVE-2024-29857
Description of Fix:  Updated Install Agent and Integrated File Agent 2.0.0.0_iFix079. 
Fix Availability Date:  27 May 2024
High Impact:  N
Reported Severity:  2

6.2.0.6_iFix022:  MFT-15793
Description of Issue:  Integrated File Agent fails with NullPointerException when a cloud object store is configured and store.configFromCD property is not set in stores.properties.
Description of Fix:  Updated Integrated File Agent to version 2.0.0.0_iFix081.
Workaround:  Set store.configFromCD=No in stores.properties.
Fix Availability Date:  27 May 2024
High Impact:  N
Reported Severity:  2

6.2.0.6_iFix023:  CDWA-3697 / APAR IT46510 / CVE-2024-35255
Description of Issue:  A vulnerability found in azure-identity and msal4j used by Integrated File Agent applies to IBM Sterling Connect:Direct for Microsoft Windows.
Affected: CVE-2024-35255
Description of Fix:  Updated Integrated File Agent to version 2.0.0.0_iFix082.
Fix Availability Date:  10 July 2024
High Impact:  N
Reported Severity:  3

6.2.0.6_iFix024:  MFT-15873 / APAR IT46713
Description of Issue:  CDConfig is crashing during configuration export.
Description of Fix:  Incorrect length of buffer that was being read from the registry.
Fix Availability Date:  12 August 2024
High Impact:  N
Reported Severity:  3

6.2.0.6_iFix025:  MFT-16198 / APAR IT46903
Description of Issue:  Failed logons by CD Requester cause sockets to accumulate in TIME_WAIT and are slow to close.
Description of Fix:  CD Server now force closes CD Requester connections after logon failures.
Fix Availability Date:  14 September 2024
High Impact:  N
Reported Severity:  1

6.2.0.6_iFix026:  MFT-16228, CDWA-3429 / APAR IT46926 / CVE-2024-21147, CVE-2024-21145, CVE-2024-21140, CVE-2024-21144, CVE-2024-21138, CVE-2024-21131, CVE-2024-27267
Description of Issue:  Vulnerabilities found in IBM Runtime Environment Java Technology Edition, Version 8 used in IBM Sterling Connect:Direct for Microsoft Windows.
Affected: CVE-2024-21147, CVE-2024-21145, CVE-2024-21140, CVE-2024-21144, CVE-2024-21138, CVE-2024-21131, CVE-2024-27267
Description of Fix:  Updated the IBM Runtime Environment Java to version 8.0.8.30.
Fix Availability Date:  20 September 2024
High Impact:  Y
Reported Severity:  2

6.2.0.6_iFix027:  MFT-16248 / APAR IT46938 / CVE-2024-7246, CVE-2024-7254
Description of Issue:  Vulnerabilities found in Integrated File Agent apply to IBM Sterling Connect:Direct for Microsoft Windows.
Affected: CVE-2024-7246, CVE-2024-7254
Description of Fix:  Updated Integrated File Agent to version 2.0.0.0_iFix088.
Fix Availability Date:  26 September 2024
High Impact:  N
Reported Severity:  2

6.2.0.6_iFix028:  MFT-16185, CDWA-3908 / APAR IT46960 / CVE-2024-7348
Description of Issue:  IBM Sterling Connect:Direct for Microsoft Windows is affected by a vulnerability in PostgreSQL.
Affected: CVE-2024-7348 
Description of Fix: Updated PostgreSQL to version 13.16. 
Fix Availability Date:  07 October 2024
High Impact:  N
Reported Severity:  2