Your suggestion for understanding and solve problem with vulnerabilities

[kajafarov]

Hi,


As i understood Centos does not support Security Metadata. ok
I have Qualys application which show Vulnerabilities in my current Cento7, which updated, but still show vulnerabilities.

information about status of update my system.
[root@centostemp user]# yum update
Loaded plugins: fastestmirror, langpacks
Loading mirror speeds from cached hostfile
* base: mirror.yer.az
* extras: mirror.yer.az
* updates: mirror.yer.az
No packages marked for update

---------------------------------------------------
Example of vulnerabilities
https://lists.centos.org/pipermail/cent ... 48398.html


My current kernel is Linux 3.10.0-1160.45.1.el7.x86_64 x86_64

My Kernel lists by RPM
[root@centostemp user ]# rpm -qa | grep kernel
kernel-tools-libs-3.10.0-1160.45.1.el7.x86_64
abrt-addon-kerneloops-2.1.11-60.el7.centos.x86_64
kernel-3.10.0-1160.45.1.el7.x86_64
kernel-tools-3.10.0-1160.45.1.el7.x86_64
kernel-headers-3.10.0-1160.45.1.el7.x86_64
------------------------------------------------------------------------------------------------

Can i use this command for resolve problem by advisory number (p.s Qualys app show advisory numbers)? yum update --advisory=CESA-2021:2314

Please i need your suggestions.

Thank you.

[jlehtone]

As i understood Centos does not support Security Metadata. ok
...
Can i use this command for resolve problem by advisory number (p.s Qualys app show advisory numbers)? yum update --advisory=CESA-2021:2314

No. There is no Security Metadata in CentOS repositories. That means that there is no data about "advisories" in CentOS repositories.


https://access.redhat.com/errata/RHSA-2021:2314 shows that Red Hat did release kernel-3.10.0-1160.31.1.el7 for RHEL 7 in June 2021.
You have already kernel-3.10.0-1160.45.1.el7, which is a successor of 3.10.0-1160.31.1.
You should therefore have the 2021:2314 fixed as well as RH deems it necessary to fix.

Ask yourself: How does "Qualys app" verify that target has a vulnerability?

[kajafarov]

Thank you for quick response. İ try open case in qualys.

Can you give some manual for solve CVE and security patching ?

Thank you.

[TrevorH]

yum update

[kajafarov]

Hi.

Now i faced with trouble after update, by information from DevopsEng after update kub-node not started.

Thank you.

[jlehtone]

... after update kub-node not started.

What is "kub-node"?

Is it a service? If yes, what is its status (usually seen with "systemctl status servicename")?
Does in write logs? Do they (or "sudo journalctl -xe") show what errors prevent the start?