CVE-2014-3512 and general guidelines

Support for security such as Firewalls and securing linux
Post Reply
hunsbea
Posts: 1
Joined: 2016/03/04 15:29:56

CVE-2014-3512 and general guidelines

Post by hunsbea » 2016/03/07 03:33:36

I'm running CentOS 7.1, and my openssl version is 1.0.1e. This CVE isn't fixed in this version, and there is also no update available in my repos that fixes this. I hunted around for an official CentOS rpm to install manually, but didn't find one.

I mention this CVE specifically, but my question is more general - what is the best practice procedure for addressing CVEs such as this? I contemplated building an updated RPM from source, but read that this is a bad practice since there can be dependency complications or instability.

Thoughts?

User avatar
avij
Retired Moderator
Posts: 3039
Joined: 2010/12/01 19:25:52
Location: Helsinki, Finland
Contact:

Re: CVE-2014-3512 and general guidelines

Post by avij » 2016/03/07 05:59:46

In general: keep it simple and run yum update every now and then to get the latest fixes. This means you should be running 7.2 now instead of 7.1. Recompiling the packages is not a good idea.

For CVE-2014-3512 in particular, CentOS 7 is not affected.

Post Reply

Return to “CentOS 7 - Security Support”