The RSA Appliance Third-party software patch 1.0 was released in October 2015 and the third-party software patch 2.0 was released in April 2016, and required 8.1 SP1 P14 or higher before installation. The Appliance 8.2 was released June 2016 , and has patches similar to P12.
Does the Appliance 8.2 include all of the fixes in the Third-party Patch 2.0? If not, is there an ETA for this?
The third-party patch also lists non-OS updates such as ClamAV and VMWare tools, but these are not listed in the SP2 release notes. Are these included in SP2?
They are included in 8.2.
8.1.x = Suse 11.3
8.2.x = Suse 11.4
8.2 patch 1 will include some OS updates but it will not be a full 'TPP' patch
I have AM 8.2 P3, but my openssl version shows as 0.9.8j-fips, same as un-TPP patched AM 8.1 SP1.
Did the TPP ever update openssl? I've seen some screen shots from Mark 'down-under' showing his AM server at OpenSSL 1.0.2d, so wondered if that meant it was updated via TPP.
The reason I ask is OpenSSL 0.9.8j-fips is vulnerable to CVE-2014-0224, but it seems like the RSA responses obscure this fact because as long as your Read Only Database User uses a non-vulnerable openssl version, it cannot be exploited. Anyone know for sure?
Don't I know you ;-) The third party patch was for non-AM related fixes/updates. 8.2 comes with OS updates included. As for the AM related updates (p13-15) those will be included in 8.2p1 which is due out soon.