5

http://www.samba.org/samba/security/CVE-2010-2063.html

How can I check to see if the Redhat (CentOS) repositories have backported a fix?

2

2 Answers 2

5

It's a combination of RedHat Bugzilla, RedHat Errata, and CentOS mirrors.
First, using the CVE-2010-XXXX visit https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-XXXX. When you see that the issue has been addressed follow that link to the RedHat errata.
Grab the rpm version and head to a CentOS mirror.

For example the latest sudo vulnerability (CVE-2010-1646):

bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-1646 (last comment->) rhn.redhat.com/errata/RHSA-2010-0475.html (copy sudo-1.7.2p1-7.el5_5.x86_64.rpm) mirror.cs.vt.edu/pub/CentOS/5/updates/x86_64/RPMS/ (it matches RedHat's errrata)

The samba vuln hasn't been packaged for CentOS and sent upstream as far as I can tell.

1
  • Link to redhat's offical CVE database: redhat.com/security/data/cve which gives a CVE orientated view, rather than a bug orientated one.
    – Coops
    Mar 8, 2011 at 7:49
6

rpm -q --changelog <package name> will show the package changelog, where vulnerabilities that have been patched in a package are enumerated. Additionally, the CentOS package announcement mailing list also gives the added portions of the changelog when the package is released.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .