I know that in order to fix CVE-2017-16939 we need to install patch version 3.10.0-862.2.3.el7 as shown in https://access.redhat.com/errata/RHSA-2018:1318.

We currently have 3.10.0-862.11.6.el7.x86_64 installed in the server.

But Red Hat does not list the above CVE on their list of fixes in version 3.10.0-862.11.6.el7.x86_64: https://www.redhat.com/archives/rhsa-announce/2018-August/msg00006.html

I'm wondering whether to downgrade to package version 3.10.0-862.2.3.el7 or to keep both installed; or does 862.11.6.el7.x86_64 fix the above CVE?

1 Answer 1


3.10.0-862.11.6.el7 is newer than 3.10.0-862.2.3.el7, and includes the fixes shipped in the latter version. So you don’t need to downgrade (and shouldn’t).

  • 1
    Further, you may want to try rpm -q --changelog against the RPM, and grep for the CVE ref.
    – steve
    Commented Aug 28, 2018 at 19:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .