5

I understand that RedHat backport CVE fixes to Apache and PHP for CentOS as updates where the version number doesn't necessarily increase, and that I can get these fixes with yum update php etc, so whilst looking at the version number it may appear to be vulnerable to CVE xyz but it could actually have the fixes. Please correct me if this is wrong.

How can I verify which CVE numbers are patched in my current PHP and Apache on a CentOS box?

1 Answer 1

7

You can look at the changelog to see what the packagers say they did:

$ rpm -q --changelog httpd
* Sun Feb 12 2012 Johnny Hughes <[email protected]> - 2.2.15-15.1.el6.centos
- Roll in CentOS Branding

* Mon Feb 06 2012 Joe Orton <[email protected]> - 2.2.15-15.1
- add security fixes for CVE-2011-4317, CVE-2012-0053, CVE-2012-0031,
  CVE-2011-3607 (#787598)
- obviates fix for CVE-2011-3638, patch removed

and so on.

I suppose you can trust the packager to do what they said they did.

If not, you can grab the source RPM, unpack it, and look at the set of patches being applied to the source tarball as it builds.

3
  • thanks for the quick reply - works for me. Am I correct about the backporting? Will accept your answer... Mar 29, 2012 at 18:50
  • 1
    @John Yes, you're correct about the backporting. RHEL doesn't really change the version number of the packages for a release, as the primary goal is long term stability.
    – cjc
    Mar 29, 2012 at 19:21
  • @John SLES does the same.
    – Nils
    Mar 29, 2012 at 20:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .