I just logged into my new rented server and updated openssl because of the heartbleed-bug (http://heartbleed.com). I updated using
yum list openssl ... Installed Packages openssl.x86_64 1.0.1e-16.el6_5.4 @updates Available Packages openssl.i686 1.0.1e-16.el6_5.7 updates openssl.x86_64 1.0.1e-16.el6_5.7 updates yum update openssl ... --> Running transaction check ---> Package openssl.x86_64 0:1.0.1e-16.el6_5.4 will be updated ---> Package openssl.x86_64 0:1.0.1e-16.el6_5.7 will be an update --> Finished Dependency Resolution ... ... Running Transaction Updating : openssl-1.0.1e-16.el6_5.7.x86_64 1/2 Cleanup : openssl-1.0.1e-16.el6_5.4.x86_64 2/2 Verifying : openssl-1.0.1e-16.el6_5.7.x86_64 1/2 Verifying : openssl-1.0.1e-16.el6_5.4.x86_64 2/2 Updated: openssl.x86_64 0:1.0.1e-16.el6_5.7 Complete!
That way I got my openssl updated. But how do you know which bug was fixed in which version? I tried with
yum history package-info openssl
but that only tells me the history of the package on my machine. Do details about the package itself.
So I googled and found http://mirror.centos.org/centos/6.5/os/x86_64/Packages/ There I can see the openssl package my system had at installation (in March 2014): openssl-1.0.1e-15.el6.x86_64
The 1st update (same day in March) updated it the version from http://mirror.centos.org/centos/6.5/updates/x86_64/Packages/ current of that day (openssl-1.0.1e-16.el6_5.4.x86_64.rpm).
Today I updated to openssl-1.0.1e-16.el6_5.7.x86_64.rpm.
So I know the history of my system. My question is: Does CentOS/RedHat provide a changelog for the packages itself (e.g. "Heartbleed bug fixed, see ....")? Is there a page for this?