On Mon, 20 Feb 2017, Pat Riehecky wrote:
Synopsis: Moderate: openssl security update
Advisory ID: SLSA-2017:0286-1
Issue Date: 2017-02-20
CVE Numbers: CVE-2016-8610
CVE-2017-3731
--
... ...
SL6
x86_64
openssl-1.0.1e-48.el6_8.4.i686.rpm
openssl-1.0.1e-48.el6_8.4.x86_64.rpm
openssl-debuginfo-1.0.1e-48.el6_8.4.i686.rpm
openssl-debuginfo-1.0.1e-48.el6_8.4.x86_64.rpm
openssl-devel-1.0.1e-48.el6_8.4.i686.rpm
openssl-devel-1.0.1e-48.el6_8.4.x86_64.rpm
openssl-perl-1.0.1e-48.el6_8.4.x86_64.rpm
openssl-static-1.0.1e-48.el6_8.4.x86_64.rpm
i386
openssl-1.0.1e-48.el6_8.4.i686.rpm
openssl-debuginfo-1.0.1e-48.el6_8.4.i686.rpm
openssl-devel-1.0.1e-48.el6_8.4.i686.rpm
openssl-perl-1.0.1e-48.el6_8.4.i686.rpm
openssl-static-1.0.1e-48.el6_8.4.i686.rpm
This update hasn't arrived at my end yet, so I went poking:
# yum --enablerepo=sl-security --showduplicates list openssl
Loaded plugins: auto-update-debuginfo, fastestmirror, refresh-packagekit,
: security
Loading mirror speeds from cached hostfile
* elrepo: mirrors.coreix.net
* epel: www.mirrorservice.org
* epel-debuginfo: www.mirrorservice.org
* sl: ftp1.scientificlinux.org
* sl-debuginfo: ftp1.scientificlinux.org
* sl-fastbugs: ftp1.scientificlinux.org
* sl-security: ftp1.scientificlinux.org
* sl6x: ftp1.scientificlinux.org
* sl6x-fastbugs: ftp1.scientificlinux.org
* sl6x-security: ftp1.scientificlinux.org
Installed Packages
openssl.i686 1.0.1e-48.sl6_8.3 @sl-security
openssl.x86_64 1.0.1e-48.sl6_8.3 @sl-security
Available Packages
openssl.i686 1.0.1e-48.el6 sl
openssl.i686 1.0.1e-48.el6 sl6x
openssl.x86_64 1.0.1e-48.el6 sl
openssl.x86_64 1.0.1e-48.el6 sl6x
openssl.i686 1.0.1e-48.el6_8.1 sl-security
openssl.i686 1.0.1e-48.el6_8.1 sl6x-security
openssl.x86_64 1.0.1e-48.el6_8.1 sl-security
openssl.x86_64 1.0.1e-48.el6_8.1 sl6x-security
openssl.i686 1.0.1e-48.el6_8.4 sl-security
openssl.i686 1.0.1e-48.el6_8.4 sl6x-security
openssl.x86_64 1.0.1e-48.el6_8.4 sl-security
openssl.x86_64 1.0.1e-48.el6_8.4 sl6x-security
openssl.i686 1.0.1e-48.sl6_8.3 sl-security
openssl.i686 1.0.1e-48.sl6_8.3 sl6x-security
openssl.x86_64 1.0.1e-48.sl6_8.3 sl-security
openssl.x86_64 1.0.1e-48.sl6_8.3 sl6x-security
I note that the 6_8.3 versions are el..., whereas the 6_8.4 are all sl...
Of course sl6_8.3 comes after el6_8.4 so the updates are ignored :-(
I'm now confused, should they be el6... or sl6... ?
(I'm also confused about whether I should be using sl-security or
sl6-security, but that is less important).
Thanks,
--
Andrew C Aitchison
