6

We have RHEL v6.9 server and OpenSSH v5.3p1 is installed on it (confirmed by rpm -q openssh which outputs openssh-5.3p1-123.el6_9.x86_64). After the security testing, we are asked to upgrade OpenSSH to v7.3, to avoid any vulnerabilities.

I have tried yum update openssh and it says

No Packages marked for Update

Any idea, how can I update openssh? Is it even possible to update it to 7.3 on RHEL 6.9?

0

1 Answer 1

5

You’re using the latest officially packaged version of OpenSSH on RHEL 6.9, which is still supported (and will be, without an extended support contract, until late 2020):

OpenSSH package information from the RHEL customer portal, including the list of versions

This means that all known vulnerabilities in your version of openssh are fixed, and newly-discovered vulnerabilities which are discovered in the future will be fixed — there’s no need to upgrade to the latest version of OpenSSH to avoid vulnerabilities.

That’s one of the points of using a supported distribution: you can rely on your distributor to take care of upstream vulnerabilities for you (as long as you keep your systems up-to-date).

To upgrade to OpenSSH 7.4 you’d have to upgrade to RHEL 7, or build it yourself for RHEL 6 (and take on support for future vulnerabilities).

2
  • Thanks for the detailed reply, however I can't access that officially packaged version of OpenSSH because I don't have a subscription there. Could you please share any screenshot of that page so I can use it as proof? Thanks in advance.
    – Jazzbot
    Commented Oct 31, 2017 at 5:28
  • Hopefully someone in your organisation has access to that page, since you’re running RHEL... I’ve added a screenshot with the dropdown. There’s a message in the background stating that a more recent version is available, but that’s referring to the RHEL 7 versions. Commented Oct 31, 2017 at 8:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .