Hello,
I appreciate your interest in the yum-security plugin!
For SL 5, we do not currently build the relevant yum metadata for the
yum-security plugin.
Pat
On 01/27/2015 09:03 AM, D Laff wrote:
I am working my way around a number of 5.x and 6.x systems to address
CVE-2014-9322:
https://www.scientificlinux.org/sl-errata/slsa-20142008-1/
https://www.scientificlinux.org/sl-errata/slsa-20141997-1/
In doing this, I have become a little more familiar with the security plugin
for yum.
On my systems, following a typical requirement for the installation of this
plugin, I query the requirement for patches for the given CVE:
---
(eg)
yum list updates --cve=CVE-2014-9322
Loaded plugins: refresh-packagekit, security
Limiting package lists to security relevant ones
5 package(s) needed for security, out of 164 available
Updated Packages
kernel.x86_64
2.6.32-504.3.3.el6 sl-security
....
....
---
This is what I expect as my kernel is below the "fixed by" release listed
against the given CVE for SL 6.x (-504).
However, when undertaking similar diagnostics on my 5.x systems I am being
informed that there are no patches applicable for the given CVE
---
(eg)
yum --cve CVE-2014-9322 info updates
Loaded plugins: kernel-module, security
Limiting package lists to security relevant ones
CVE "CVE-2014-9322" not found applicable for this system
No packages needed, for security, 323 available
---
(eg)
yum info-security SLSA-2014:2008-1
Argument "SLSA-2014:2008-1" not found applicable for this system
---
This isn't what I expect as my kernel version is below the "fixed by" release
listed against the given CVE for SL 5.x (-400).
I'm concerned that I'm using yum incorrectly, and missing out on important
security patches (in this instance for the given CVE).
However, it might be that the systems in question are actually patched / not
vulnerable, but in a way which I don't understand (and, if possible, I'd like
to!).
Any guidance or insight would be much appreciated.
Thanks in advance . . .
--
Pat Riehecky
Scientific Linux developer
Fermi National Accelerator Laboratory
www.fnal.gov
www.scientificlinux.org
