RPMs and CVEs - Revision history

Hutch at 15:34, 4 September 2009

Hutch — Fri, 04 Sep 2009 15:34:09 GMT

←Older revision		Revision as of 15:34, 4 September 2009
Line 6:		Line 6:

	Note that starting on 2005/10/19, the ''CAN-'' prefix is no longer used for candidate CVE entries. It should be included in the above search for any 2005 or earlier CVE's.		Note that starting on 2005/10/19, the ''CAN-'' prefix is no longer used for candidate CVE entries. It should be included in the above search for any 2005 or earlier CVE's.
		+
		+	If the CVE's are not found in the package changelog, check the below ''Red Hat vulnerabilities by CVE name'' link for more information on how the CVE affects Red Hat products.

	== Links ==		== Links ==

Hutch: /* Links */

Hutch — Fri, 04 Sep 2009 15:33:06 GMT

Links

←Older revision		Revision as of 15:33, 4 September 2009
Line 12:		Line 12:
	* [http://www.redhat.com/security/transparent/cve/ Red Hat and CVE Compatibility]		* [http://www.redhat.com/security/transparent/cve/ Red Hat and CVE Compatibility]
	* [http://www.redhat.com/security/transparent/oval/ Red Hat and OVAL compatibility]		* [http://www.redhat.com/security/transparent/oval/ Red Hat and OVAL compatibility]
		+	* [https://www.redhat.com/security/data/cve/ Red Hat vulnerabilities by CVE name]

Hutch: New page: Vulnerability Assessment (VA) tools commonly flag services on our Red Hat systems as potentially vulnerable based on the services' versions alone. Since Red Hat [http://www.redhat.com/secu...

Hutch — Fri, 05 Oct 2007 19:33:10 GMT

New page: Vulnerability Assessment (VA) tools commonly flag services on our Red Hat systems as potentially vulnerable based on the services' versions alone. Since Red Hat [http://www.redhat.com/secu...

New page

Vulnerability Assessment (VA) tools commonly flag services on our Red Hat systems as potentially vulnerable based on the services' versions alone. Since Red Hat [http://www.redhat.com/security/updates/backporting/ backports] security fixes into its packages, the packages may already be patched to address the vulnerabilities. Note that VA tools that support the [http://www.redhat.com/security/transparent/oval/ Open Vulnerability and Assessment Language (OVAL)] can determine the status of vulnerabilities even with backported fixes.

VA tools often refererence vulnerabilities by their [http://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures Common Vulnerabilities and Exposures (CVE)] number. One of the easiest ways to determine if a Red Hat package is patched for a particular CVE is to examine the package's ''changelog''.

$ '''rpm -q ''package'' --changelog | egrep "(CAN|CVE)-"'''

Note that starting on 2005/10/19, the ''CAN-'' prefix is no longer used for candidate CVE entries. It should be included in the above search for any 2005 or earlier CVE's.

== Links ==

* [http://www.redhat.com/security/updates/backporting/ Backporting of Security Fixes]
* [http://www.redhat.com/security/transparent/cve/ Red Hat and CVE Compatibility]
* [http://www.redhat.com/security/transparent/oval/ Red Hat and OVAL compatibility]