Questions tagged [patch-management]
Patch Management refers to updating and patching systems, and particularly to tools and systems which automate this process for a large number of systems.
225
questions
0
votes
0
answers
126
views
How to confirm whether the packages in local mirror are updated and in sync with official repo for ubuntu-20/22
I have created a local repo using apt-mirror for ubuntu20 and 22. When I run the command apt-mirror the command is successfully run. I see some files like packages.gz is showing the latest timestamp. ...
1
vote
1
answer
139
views
Safely abort Ansible playbooks when server downtime runs out
Afaik ansible offers no possibility to safely exit a running playbook, so I am wondering which strategy would be wise to not leave hosts in inconstistent states:
Lets picture an infrastructure of ~300 ...
0
votes
0
answers
306
views
Does Kerberos OOB Patch Change RC4-HMAC Settings on DC
I have a very specific question before we deploy the November 2022 OOB patch to resolve the Kerberos deal on our DCs.
1st - I ran a klist command on a Windows box and it returns about 16 server ...
0
votes
1
answer
216
views
How to install Data Protector RPM patch in Linux?
Well, HPE Data Protector has a long tradition of doing odd things.
For example the way an rpm "patch" is installed is not via -U or -F, but differently, which brings me to my question:
In ...
0
votes
1
answer
157
views
Why MS Exchange Security Updates come in pair?
I need to install this security update: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24463 on Windows Server 2016.
Why there are two items for Windows Server 2016? Should I install ...
2
votes
1
answer
1k
views
Debian: Kernel update using APT - reboot required to take effect?
Suppose I update the kernel of a running Debian system using apt-get upgrade linux-image-amd64 to a higher minor version number (e.g., 5.10.10 to 5.10.11). Do I have to reboot the Debian server in ...
0
votes
1
answer
167
views
Does packages security patches are backported to older version?
I see on cve.mitre.org that OpenLDAP (slapd) package have plenty of vulnerabilities prior to 2.4.57.
If I want to install OpenLDAP from official repositories on my Debian 10, which version is slapd/...
1
vote
1
answer
2k
views
How to install security patches on CentOS 7.x
I need to install several security and apllication patches. An example of a patch considered critical is below:
Vulnerabilities
134087 - CentOS 7 : kernel (CESA-2020:0374)-
Synopsis
The remote CentOS ...
0
votes
1
answer
260
views
How to get patches for Java SE?
I have been struggling with this all day. Going on day 2.
I created a support.oracle.com account and can login, however I am redirected a page asking for a Support Identifier. I do not have one, ...
0
votes
1
answer
36
views
What is the best way to patch a server Win2012R2 that has not being patched for 2 years?
1-Native Windows Patch
2-Patch Management Software (Security Controls from Ivanti)?
Any other general advice on a sequence, timeline to perform this long patch?
0
votes
1
answer
7k
views
What firewall changes are required to download Windows updates?
I have a Windows 2019 server sitting behind a firewall and an Internet proxy.
What are the network ports and URLs that need to be whitelisted for this server to download Windows patches/updates from ...
-1
votes
1
answer
300
views
how to update entire server without changing server OS version
I am new to linux . I have to patch a new build server. The server is with hundreds of vulnerability thats why I am told to patch system . This server is 7.9 version and registered with
satellite ...
1
vote
1
answer
53
views
How to protect against/fix new vulnerability CVE-2021-36934?
The essence of this vulnerability is that if you perform a shadow copy of your important files with hashed passwords for all OS accounts, encryption key data, and other important information (the ...
0
votes
2
answers
552
views
How to patch vmware-esxi via vcenter
Our company is using a single vmware-esxi host (vmware-esxi v6.5) which hasn't been patched since installation. The VMs are a windows server and a vcenter appliance.
Using Update Manager I attached ...
1
vote
0
answers
82
views
How can I determine if Microsoft Patches are recommended or optional without using IUpdateSearcher?
On a single computer, it's simple enough to filter which updates Microsoft deems important by running a PS script such as the following:
$session = New-Object -ComObject Microsoft.Update.Session
$...
0
votes
2
answers
77
views
Patch for EOS Servers
My company have got a few Windows 2008 servers that have already reached end of support. We are delaying the decommissioning of the server and I am thinking of controls that can help to mitigate risks....
0
votes
1
answer
894
views
zypper lp command not working on Suse Linux
I'm trying to list patches in suse linux GCE using the zypper lp command, but I am getting the following error:
"Medium not attached: plugin:/susecloud?credentials=Basesystem_Module_x86_64&...
0
votes
1
answer
262
views
Periodically system security patches on K8s clusters?
We're trying to figure out a way to periodically have system security patches for our K8s cluster, to keep our system safe and meet the security requirements.
our K8s clusters are running in different ...
0
votes
2
answers
110
views
RHEL 7 security patch installation from tar
Novice Linux guy here
I have a huge (5G) linux-security-patches tar. Upon extracting, I see its got loads of rpms. What is the most efficient way to install them all ? Also, is it same as installing ...
0
votes
1
answer
1k
views
WSUS GPO - Specific week specified, but ignored
I have configured a GPO to force updates via GPO in a scheduled maintenance window since these boxes were previously getting updates and just rebooting outside of active hours. I would prefer that ...
0
votes
1
answer
374
views
How often to apply windows updates on High Availability servers?
We have a couple of windows servers (2019) that will be running High Availability services (redis, sql server, in-house software etc). Currently don't have the budget to go for clustering, so need to ...
1
vote
1
answer
160
views
How to update Windows 10 Pro Endpoints remotely?
Here is the scenario,
We have Windows 10 Pro (100 end points) all physical. It is a MS Windows AD environment. What is the best solution to update these end points remotely? Looking for something ...
1
vote
1
answer
141
views
How to have a reproducible security patching procedure on CentOS 7
TL;DR :
How to make sure a list of package updates can be made in a reproducible way on many servers, even if newer security updates are available before the patching campaign is over?
In a company ...
0
votes
1
answer
242
views
Unable to build initscripts package
I have some patches that I added in spec files and after adding those patches I am unable to build the rpm package.
Obsoletes: hotplug <= 3:2004_09_23-10.1
Processing files: debugmode-9.03.61-1.0....
1
vote
1
answer
881
views
CentOS: detailed history of patch updates
e.g. http://mirror.centos.org/centos/7/os/x86_64/Packages/
...
chrony-3.2-2.el7.x86_64.rpm
Any ways to know what made the -2 part in 3.2-2? I.e. deltas between 3.2 and 3.2-2. That's no-brainer ...
0
votes
1
answer
270
views
Still receiving "Message frozen" warnings after fixing Exim CVE-2019-10149 critical vulnerability
After upgrading Exim4 to an official patched version fixing CVE-2019-10149 vulnerability (i.e. exim4_4.89-2+deb9u4) on my Debian stable server, I still get the "Message frozen" warnings about ...
1
vote
2
answers
142
views
How to findout what pre-requisite MS patches are?
TL;DR: install MS patch requires previous patches, how to determine needed patches in an isolated network?
I have this Windows 2008R2 SP1 machine in a isolated network, the machine hasn't been ...
1
vote
3
answers
10k
views
Monthly Patch Releases for Linux CentOS/RedHat
Can somebody tell me when CentOS/RedHat release package updates monthly? Micrososft has patch Tuesday but I can't seem to find a day/week when CentOS/RedHat release monthly patches. I'd like to ...
0
votes
1
answer
259
views
Do we need to reboot RHEL Servers, after making changes for control-alt-delete override?
We are planning on disabling the RHEL Server reboot triggered by control-alt-delete.
for which we are going to follow the Steps mentioned here.
However, that link does not say whether we need to ...
2
votes
1
answer
1k
views
How do I upgrade/patch Java for Weblogic server 12 on RHEL7?
I have a RHEL7 server with Oracle Java 8 and Weblogic 12 installed.
Java 8 was installed using an rpm from RedHat. Weblogic was installed using the installation package and instructions from Oracle (...
1
vote
1
answer
567
views
Why is Windows Server 2012 not patchable for meltdown, when Windows Server 2008 R2 is?
Just curious, but does anyone know why Windows Server 2012 R1 server isn't patchable for meltdown/spectre? Windows 2008 R2 (2009) is patchable, but 2012 (2012) isn't?
What was added in the R2 ...
0
votes
2
answers
1k
views
OS patches list
How can I check installed list of patches on OS separately for critical security plugins and all other updates. I tried "rpm -qa --last" and "yum list installed" but didn't get the desired output.
0
votes
1
answer
404
views
Using salt-ssh for Ubuntu/Debian patching (dialog frontend is not usable)
I'm looking into replacing a Linux based home-grown patch management solution with salt-ssh.
The current system uses a shell script to iterate through a list of hosts and copies a script named apt-...
2
votes
2
answers
2k
views
Passing Remote Client IP to WSUS Server behind Reverse Proxy Server
We have an internet facing WSUS server for our remote windows clients (laptops, remote users, etc..). As an extra layer of protection, we have placed the WSUS server behind a Reverse Proxy server ...
1
vote
1
answer
507
views
XenServer 7.2 Hot Fix - Can only apply to Pool not Individual Hosts
I'm running xenserver 7.2 on a few M620 blade servers. I'm trying to apply XS72E004 and 005 patches. I go to the notification section and select Download/Install next to each patch. I have a pool ...
0
votes
0
answers
174
views
How to audit Windows patch level off-site?
I would like to audit different Windows servers and desktop machines off-site using configuration output generated previously on the machines (e.g. output of the systeminfo command).
Previously I ...
0
votes
2
answers
1k
views
Installing previous month's cumulative update
For some of our production systems we like to wait a few weeks to apply updates so that they've "baked" in the public a bit. We then wait a little longer after before patching backup systems lest we ...
0
votes
1
answer
221
views
.NET 3.5 SP 1 and Web Platform Installer
I manage a Windows Server 2008 R2 box which has a .NET Framework related security issue that showed up in a recent security scan. Below are the security scan results:
The following Microsoft .NET ...
0
votes
2
answers
1k
views
How To Patch Server running WSUS Without Shooting Yourself In The Foot
I'm starting to use WSUS for patch management and I'm a little light in the experience department. Our requirements are simple in that we want to make sure every server we have is up, on and ready ...
4
votes
1
answer
2k
views
How to download and install wannacry patch for small business windows 2011 standard
I have a small business windows 2011 standard server. The auto update is not working somehow. I want to download the patch and install manually. I have a look at this: https://technet.microsoft.com/en-...
1
vote
1
answer
229
views
rsync for software update / multiple clients
I'm building a game launcher / updater and need to make clients download the last game version if an update is avaiable or if there is a problem with files integrity.
I need something able to produce ...
5
votes
3
answers
1k
views
Replicating patch level from one server to another without WSUS/patch management
The scenario is: Server1 and Server2, both running Windows Server 2012 R2 at the same patch level, are currently in a load-balancing cluster. Server1 has application issues and advice is to replace ...
0
votes
1
answer
202
views
jails in zfs space in freebsd 11, gives mount descfs error
Good Night, I am trying to deply a multijail environment using freebsd 11 on a OVH dedicated server.
I created the cloned interfaces and created the jail , but as soon as I try to start it tells me ...
0
votes
1
answer
503
views
Remotly obtain an application's Windows Installer patches via WMI or Powershell
I'm working on a remote administration app which needs to be able to obtain a list of patches which have been applied to an application. This Support article suggests there are two ways they could be ...
1
vote
1
answer
420
views
XenServer 6.5 Patch Installed But Missing
I installed a few patches in my XenServer 6.5 environment. After I installed the 3 patches I noticed that in XenCenter that my server is saying it needs patch XS65ESP1021 installed.
I confirmed that ...
1
vote
1
answer
76
views
Doubtes in MS KB Numbers
I am having some doubtes in MS KB numbers, For Example MS16-103 (KB 3182332) - under this we have two different KB nos like 3176492, 3176493. My doubts is which one we should apply in the server.
in ...
1
vote
1
answer
314
views
Using WSUS to patch multiple environments
We set up Windows domains from scratch and then all servers (2003, 2008 R2, 2012, etc) sit offline (including DC's) for months before being used again. This causes a nightmare when trying to patch the ...
0
votes
1
answer
91
views
Show files to be patched on .diff file and determine if they are patched or not [closed]
Having a .diff patch file, I'm trying to take actions in a shell script depending on if files listed in .diff file are: 1) already patched, 2) not patched, 3) not patchable.
I found no way on GNU ...
2
votes
1
answer
3k
views
Confused on BigFix relevance - x64 files
I am using BigFix in an Enterprise Environment and noticed a recent round of Microsoft patches for 2016 have failed on a small group of assets. I was able to work around this by creating Custom Copy ...
0
votes
1
answer
109
views
linux + yum update - what this command covers?
we have red-hat version 6.x machine,
I verified what are the missing security patches as the following:
yum updateinfo list security available
Loaded plugins: product-id, rhnplugin, security, ...