2

On my CentOS 7 server, when I run yum --security upgrade its not finding any security update rpm packages, but I know vim-minimal security update package available.

How can I make yum security update work on my CentOS 7 server?

# yum --security upgrade |tail
 --> hwdata-0.252-8.8.el7.x86_64 from @cr removed (updateinfo)
 --> cronie-1.4.11-19.el7.x86_64 from @cr removed (updateinfo)
 --> sssd-client-1.16.0-19.el7.x86_64 from @cr removed (updateinfo)
 --> glib2-2.54.2-2.el7.x86_64 from @cr removed (updateinfo)
 --> GeoIP-1.5.0-11.el7.x86_64 from @anaconda removed (updateinfo)
 --> 1:grub2-pc-modules-2.02-0.76.el7.centos.1.noarch from updates removed (updateinfo)
 --> 1:grub2-pc-modules-2.02-0.65.el7.centos.2.noarch from @updates removed (updateinfo)
 --> e2fsprogs-1.42.9-11.el7.x86_64 from @cr removed (updateinfo)
No packages needed for security; 254 packages available
Resolving Dependencies

vim package list

# yum list vim-minimal --showduplicates
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
Installed Packages
vim-minimal.x86_64                                                                          2:7.4.160-4.el7  
Available Packages
vim-minimal.x86_64                                                                          2:7.4.160-5.el7   
vim-minimal.x86_64                                                                          2:7.4.160-6.el7_6 

Thanks

0

2 Answers 2

1

The original question was "How do I make my CentOS 7 yum give me a list of security updates". The key point here is CentOS 7.

the --security flag requires the yum-plugin-security package and some metadata in order to generate the comparisons to give you a list of what is and isn't a security package. RHEL subscription creates this metadata for RHEL to pull from. CentOS does not (and there is no yum-plugin-security port in CentOS repos).

One suggestion in the past was to just pull the RHEL metadata and use that for your CentOS system. This doesn't work because RHEL always releases patches before CentOS gets them into their repo chain. This means that the metadata will never fully match the CentOS releases.

As the CentOS team has never (as far as I can tell) desired to create this metadata (it is a lot of work I'll admit), its unlikely that this option will ever work on the CentOS series.

The big clue in the above dump was the "removed (updateinfo)" string on each and every package.

0

I see two ways you could do this:

  1. You could try disabling all repos except the one that has the package you want, thus querying and installing from that repo alone. See the yum manpage for repolist, --disablerepo, and --enablerepo.
  2. The other option would be to download the RPMs for that package and its dependencies and install those: repoquery --requires --resolve --recursive <package_name> | xargs -r yumdownloader. repoquery also has options for enabling/disabling repos, see the manpage. This command will find the vim package you want and all dependencies, and download those RPMs. You can then install them with yum using the local installation/update utilities or with RPM.

Also, note what the manpage for yum says about the --security flag:

This option includes packages that say they fix a security issue, in updates.

It's possible those vim-minimal versions don't have security updates.

6
  • --secuirty flag didn't bring the update vim package, I know vim has the security update access.redhat.com/security/cve/cve-2019-12735
    – sfgroups
    Commented Jul 9, 2019 at 16:58
  • @sfgroups The mitigation section suggests that there might not need to be a package installed for this, just a change to configuration. There is a default vimrc config in /etc IIRC. Do the changelogs for the available vim packages mention those versions resolving that vulnerability? It might be the case that Red Hat is providing that update to subscribers only. In which case you wouldn't get it. I'm not sure.
    – Ungeheuer
    Commented Jul 9, 2019 at 17:18
  • There is update for package also. access.redhat.com/errata/RHSA-2019:1619, its available for CentOS 7 rpm now
    – sfgroups
    Commented Jul 9, 2019 at 17:49
  • @sfgroups Sounds like you're set then. If you can set up access to a repo with those RPMs then you can use either of the options, to get the installation done.
    – Ungeheuer
    Commented Jul 9, 2019 at 18:31
  • the answer I am looking for is why this command not listing this package yum --security upgrade
    – sfgroups
    Commented Jul 9, 2019 at 18:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .