RSA Appliance 8.1 and 8.2 third-party software patch question

[JonathanMulsma1]

The RSA Appliance Third-party software patch 1.0 was released in October 2015 and the third-party software patch 2.0 was released in April 2016, and required 8.1 SP1 P14 or higher before installation. The Appliance 8.2 was released  June 2016 , and has patches similar to P12.

Does the Appliance 8.2 include all of the fixes in the Third-party Patch 2.0?  If not, is there an ETA for this?

[BrianTwomey]

Don't I know you 😉 The third party patch was for non-AM related fixes/updates. 8.2 comes with OS updates included. As for the AM related updates (p13-15) those will be included in 8.2p1 which is due out soon. 

[JonathanMulsma1]

The third-party patch also lists non-OS updates such as ClamAV and VMWare tools, but these are not listed in the SP2 release notes. Are these included in SP2?

[BrianTwomey]

They are included in 8.2. 

[EdwardDavis]

8.1.x = Suse 11.3

8.2.x = Suse 11.4

8.2 patch 1 will include some OS updates but it will not be a full 'TPP' patch

[JayGuillette]

I have AM 8.2 P3, but my openssl version shows as 0.9.8j-fips, same as un-TPP patched AM 8.1 SP1.

Did the TPP ever update openssl?  I've seen some screen shots from Mark 'down-under' showing his AM server at OpenSSL 1.0.2d, so wondered if that meant it was updated via TPP.

The reason I ask is OpenSSL 0.9.8j-fips is vulnerable to CVE-2014-0224, but it seems like the RSA responses obscure this fact because as long as your Read Only Database User uses a non-vulnerable openssl version, it cannot be exploited.  Anyone know for sure?