We have an audit system that, daily, tracks packages in need of a security update using:

yum list-security --security -q 2

For better or worse, some machines are not patched timely or missed, or are offline for some time. Many machines, to minimize possible issues, will just get security patches applied and this is where things go off the rails a bit.

It seems if there is a newer release of a package that is no longer attached to a security bulletin, packages are not getting updated, when doing a yum update-minimal --security

clamav-0.99.4-1.el7 - installed
clamav-0.100.2-2.el7 - yum list-security (around 11/2018): 
clam-0.101.1-1.el7 - current available (not shown in yum list-security)

Am I missing something, or should yum list-security still show this as a package in need of a security update? Or is this just a limitation of how yum list-security works and our auditing is more correct than the package manager?

  • The man pages don't seem to have any info for list-security, but it does have info on --security which is what I have always used. Try yum check-update --security for a list of packages that report they are security-related updates. Be warned, the output is quite extensive, but the summary at the end is the number of updates that comply with the --security query, out of the total available, and a list of the actual security updates in question. – 0xSheepdog Feb 11 at 22:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.