SSLv2 (SSL version 2) is a data encryption protocol that encrypts data before transmitting it over a network.  On March 1, 2016, the US-CERT organization released an alert about a vulnerability in version 2 of the SSL encryption protocol. This vulnerability could allow an attacker to decrypt data if enough SSLv2 information was intercepted. SSLv2 is now considered obsolete.
Is CU*BASE GOLD vulnerable to the DROWN attack?
No.  If properly configured, CU*BASE GOLD uses two components to construct an encrypted connection to the IBM I computer: IBM Client Access and Rocket. Each of these support the more modern TLS 1.0 encryption standard.  Our online production IBM I computer will not accept SSLv2 connections. It forces all connections to use the stronger encryption standard of TLS 1.0.  CU*Answers has also verified other systems, such as ItsMe247.com will not support SSLv2 connections.

I’m a Self-Processor – am I vulnerable?
Self-processors are not vulnerable. If support for encrypted sessions has been enabled, support for SSLv2 has already been disabled on the IBM i.  If you are a self-processor interested in session encryption, please contact the Network Services Help Desk or the iSeries team directly to get a conversion project scheduled.

What do I need to do?
Review your network for systems that support SSLv2 and disable support for the protocol if necessary.  Microsoft has published a How To article for disabling the protocol on their servers: Network Services Complete Care clients receive quarterly vulnerability scan reports automatically for any externally available systems that support this protocol. We will work with clients as needed to disable this protocol if it has not already been disabled.If you have questions, please contact the Network Services Help Desk at extension 266.