We have encountered a security threat in one of our RHEL servers which says the SSH server is configured to use Cipher Block Chaining.

As far as I know, the RHEL systems provide security updates through their RHN satellite which can be achieved just by running the yum update command. But, how can I know if the security patch is applied to my RHEL system?

P.S: I know the CVE number of the vulnerability/threat/issue.

So my question is, is it possible for me to verify that the RHEL yum update command has fixed the bug in my system?

2 Answers 2


You can check this with yum-plugin-security:

--cve  This option includes packages that say they fix a CVE - Common
       Vulnerabilities and Exposures ID (http://cve.mitre.org/about/),
       Eg. CVE-2201-0123.

So try:

yum --cve <Your CVE here> info updates

And you can check the changelog coressponding to the packages to check information about bug fixed:

$ rpm -q --changelog openssh | grep -i cve
- change default value of MaxStartups - CVE-2010-5107 - #908707
- merged cve-2007_3102 to audit patch
- fixed audit log injection problem (CVE-2007-3102)
- CVE-2006-5794 - properly detect failed key verify in monitor (#214641)
- CVE-2006-4924 - prevent DoS on deattack detector (#207957)
- CVE-2006-5051 - don't call cleanups from signal handler (#208459)
- use fork+exec instead of system in scp - CVE-2006-0225 (#168167)
  • Your option really seems good.
    – Ramesh
    May 16, 2014 at 18:50

Yes it is possible.

CVE is a dictionary of publicly known information security vulnerabilities and exposures. If we know the CVE number, we can check if RHEL has fixed the threat in our systems by checking the CVE number here.

So in my case, the CVE number was CVE-2008-5161. I checked for the CVE number in the above mentioned link and found that the fix for openssh was provided in the package provided by the update of this rpm.

So, I ran the query ssh -V which gives me the output as,


But the above query just returns the version.

However, I need to know if the patch openssh-4.3p2-36 is applied to my system. The RHEL updates are applied in patches which do not update the package numbers. So, for example, if RHEL 5 systems have the OpenSSH version of 4.3 installed, the updates will not make it to the next 4.4 version but rather fix the same version but in patches. This feature is known as backporting in RHEL. So, for the security threat that I had faced, I need to verify the patch 36 is installed in my system. I can check the same using the command,

rpm -qa | grep -i ssh

The above command returns me the output as,


This means I have the latest security patch provided by RHEL available in my system.

  • It's also worth mentioning that Red Hat provides an online CVE database that will tell you the specific versions of their software that resolve relevant CVE's.
    – Bratchley
    May 16, 2014 at 19:12
  • 1
    @JoelDavis, I have included the link that you have specified in my answer :)
    – Ramesh
    May 16, 2014 at 19:23
  • Damn. Having one of those days I guess. Sorry about that.
    – Bratchley
    May 16, 2014 at 19:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .