We have an audit system that, daily, tracks packages in need of a security update using:
yum list-security --security -q 2
For better or worse, some machines are not patched timely or missed, or are offline for some time. Many machines, to minimize possible issues, will just get security patches applied and this is where things go off the rails a bit.
It seems if there is a newer release of a package that is no longer attached to a security bulletin, packages are not getting updated, when doing a
yum update-minimal --security
clamav-0.99.4-1.el7 - installed clamav-0.100.2-2.el7 - yum list-security (around 11/2018): clam-0.101.1-1.el7 - current available (not shown in yum list-security)
Am I missing something, or should
yum list-security still show this as a package in need of a security update? Or is this just a limitation of how
yum list-security works and our auditing is more correct than the package manager?