2

So I've been compiling security advisories for various OSs, including both CentOS and RHEL. What I find confusing is CentOS should be a "similar but different" OS from RHEL counterpart, most notably from support for security patches.

When I searched for RHEL, it's quite obvious on where to find their security advisories and easy to find in their website, complete with its documentation. While the CentOS doesn't really have a dedicated place to put their latest security patch. (I found one for a certain month in their blog but they never updated since)

I found a source for CentOS. But for each patch there is a reference to RedHat security advisories. So the question is: is all security patches for RedHat will always apply for its CentOS counterpart? Or not all patches, but only certain patches of RedHat that is implemented to CentOS? Because from what I recall is that CentOS and RedHat has different development team.

1 Answer 1

5

CentOS automatically rebuilds RHEL source packages. For some RHEL packages specific CentOS patches are applied in order to remove/change branding or remove RHEL specific features like subscription.

There should be no other differences between these operating systems. CentOS security advisories must follow RHEL's exactly for packages they share (RHEL may contain additional ones, the other problem: CentOS 8 as a RHEL 8 clone doesn't exist any longer).

The primary source of CentOS 7 advisories is here - it more or less mirrors RHEL 7 security updates.

TLDR: For practical purposes and the same packages there must be none.

5
  • Historically, the difference between the CentOS and RHEL security patches is a few weeks. I don't know if that's currently the case.
    – user10489
    Sep 21, 2021 at 11:26
  • In my experience it was normally less than a few days. If you open advisories you'll see more or less the same dates. Sep 21, 2021 at 11:34
  • While it's correct for most of the patches, some of them are even way far a year behind. Check CESA-2020-1021 vs RHSA-2020:1021, the CentOS was released just now, the RedHat version issued a year ago
    – spitfire
    Sep 22, 2021 at 4:01
  • CentOS is heavily understuffed and underfunded, so slipups like these are bound to happen. I wonder why it's all not fully automated. But then it surely looks like CentOS is on a way out. Sep 22, 2021 at 6:01
  • 1
    There is quite a bit of automation but the debranding often requires manual intervention. In the future in CentOS Stream, rhel packages will be built from CentOS source so it will be a bit more automatic.
    – jsbillings
    Sep 25, 2021 at 13:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .