Where can I find updated repo of package 1.8.23-4.el7.x86_64

Support for security such as Firewalls and securing linux
Post Reply
CaptTechno
Posts: 4
Joined: 2020/05/04 20:35:08

Where can I find updated repo of package 1.8.23-4.el7.x86_64

Post by CaptTechno » 2020/05/04 20:59:43

While installing Qualys scan recommended package update, I am being diverted to RedHat site.
Package Installed Version Required Version | sudo 1.8.23-4.el7.x86_64 1.8.23-4.el7_7.1.

How can i update this package "sudo 1.8.23-4.el7.x86_64" so that I can remove security vulnerabilities.

User avatar
TrevorH
Forum Moderator
Posts: 29443
Joined: 2009/09/24 10:40:56
Location: Brighton, UK

Re: Where can I find updated repo of package 1.8.23-4.el7.x86_64

Post by TrevorH » 2020/05/04 21:06:54

You update on CentOS by running yum update. That will offer you all pending updates, any of which could be for security purposes. The current version of sudo is sudo-1.8.23-9.el7.x86_64
CentOS 6 will die in November 2020 - migrate sooner rather than later!
Info for USB installs on http://wiki.centos.org/HowTos/InstallFromUSBkey
CentOS 5 is dead, do not use it.
Full time Geek, part time moderator. Use the FAQ Luke

CaptTechno
Posts: 4
Joined: 2020/05/04 20:35:08

Re: Where can I find updated repo of package 1.8.23-4.el7.x86_64

Post by CaptTechno » 2020/05/05 14:13:13

Thanks for Reply @TrevorH

While resolving the vulnerability, I am being directed to CentOS link that is broken(Not exactly broken but takes me to RHEL Page)

###SOLUTION:
To resolve this issue, upgrade to the latest packages which contain a patch. Refer to CentOS advisory centos 7 for updates and patch information.(https://lists.centos.org/pipermail/cent ... 23499.html)

Patch:
Following are links for downloading patches to fix the vulnerabilities:

CESA-2019:3197: centos 7(https://lists.centos.org/pipermail/cent ... 23499.html)

Also the tool is advising to upgrade to wrong package.

Package
Installed Version
sudo
1.8.23-3.el7.x86_64

Required Version
1.8.23-4.el7_7.1

User avatar
TrevorH
Forum Moderator
Posts: 29443
Joined: 2009/09/24 10:40:56
Location: Brighton, UK

Re: Where can I find updated repo of package 1.8.23-4.el7.x86_64

Post by TrevorH » 2020/05/05 14:32:05

And that version has been superceded by a more recent one. If you just run yum update it will offer it to you. And if you're going through security scans then you should make sure you are entirely up to date before you start as it's just going to find things that are already fixed but not on your system. So yum update _then_ scan.
CentOS 6 will die in November 2020 - migrate sooner rather than later!
Info for USB installs on http://wiki.centos.org/HowTos/InstallFromUSBkey
CentOS 5 is dead, do not use it.
Full time Geek, part time moderator. Use the FAQ Luke

User avatar
jlehtone
Posts: 3033
Joined: 2007/12/11 08:17:33
Location: Finland

Re: Where can I find updated repo of package 1.8.23-4.el7.x86_64

Post by jlehtone » 2020/05/05 14:33:30

What "tool"? What "link"?

CaptTechno
Posts: 4
Joined: 2020/05/04 20:35:08

Re: Where can I find updated repo of package 1.8.23-4.el7.x86_64

Post by CaptTechno » 2020/05/05 14:42:51

Using Qualys tool for Vulnerability scans.

The problem persist as whatever recommendation I get is not "Actionable"
Landing to same Advisory page (https://lists.centos.org/pipermail/cent ... 35643.html)

Package Installed_Version Required_Version
sudo 1.8.23-4.el7__7.1.x86__64 1.8.23-4.el7__7.2

1.8.23-4.el7__7.2 this is not CentOS package.

User avatar
TrevorH
Forum Moderator
Posts: 29443
Joined: 2009/09/24 10:40:56
Location: Brighton, UK

Re: Where can I find updated repo of package 1.8.23-4.el7.x86_64

Post by TrevorH » 2020/05/05 14:59:54

Again, the latest and only supported version of sudo on CentOS 7 is sudo-1.8.23-9.el7.x86_64. It contains all security updates that have previously been released in lower numbered versions.

Code: Select all

[root@centos7 ~]# yum list sudo --enablerepo=C7.\*-{base,updates} --noplugins --showdupli
Installed Packages
sudo.x86_64                         1.8.23-9.el7                               @qa              
Available Packages
sudo.x86_64                         1.8.6p7-11.el7                             C7.0.1406-base   
sudo.x86_64                         1.8.6p7-13.el7                             C7.1.1503-base   
sudo.x86_64                         1.8.6p7-16.el7                             C7.2.1511-base   
sudo.x86_64                         1.8.6p7-17.el7_2                           C7.2.1511-updates
sudo.x86_64                         1.8.6p7-20.el7                             C7.3.1611-base   
sudo.x86_64                         1.8.6p7-21.el7_3                           C7.3.1611-updates
sudo.x86_64                         1.8.6p7-22.el7_3                           C7.3.1611-updates
sudo.x86_64                         1.8.6p7-23.el7_3                           C7.3.1611-updates
sudo.x86_64                         1.8.19p2-10.el7                            C7.4.1708-base   
sudo.x86_64                         1.8.19p2-11.el7_4                          C7.4.1708-updates
sudo.x86_64                         1.8.19p2-13.el7                            C7.5.1804-base   
sudo.x86_64                         1.8.19p2-14.el7_5                          C7.5.1804-updates
sudo.x86_64                         1.8.23-3.el7                               C7.6.1810-base   
sudo.x86_64                         1.8.23-4.el7                               C7.7.1908-base   
sudo.x86_64                         1.8.23-4.el7_7.1                           C7.7.1908-updates
sudo.x86_64                         1.8.23-4.el7_7.2                           C7.7.1908-updates
sudo.x86_64                         1.8.23-9.el7                               base 
CentOS 6 will die in November 2020 - migrate sooner rather than later!
Info for USB installs on http://wiki.centos.org/HowTos/InstallFromUSBkey
CentOS 5 is dead, do not use it.
Full time Geek, part time moderator. Use the FAQ Luke

CaptTechno
Posts: 4
Joined: 2020/05/04 20:35:08

Re: Where can I find updated repo of package 1.8.23-4.el7.x86_64

Post by CaptTechno » 2020/05/05 15:59:39

Thanks for your support and quick reply.
Will use your recommendations.

User avatar
jlehtone
Posts: 3033
Joined: 2007/12/11 08:17:33
Location: Finland

Re: Where can I find updated repo of package 1.8.23-4.el7.x86_64

Post by jlehtone » 2020/05/05 16:59:57

Your tool finds an email that did announce availability updated CentOS 7 sudo package.
The package and announcement were made after Red Hat had published that update for RHEL 7.7.
The email refers to Red Hat's announcement, as is proper.

Since then, Red Hat had published RHEL 7.8. Red Hat has announcements of packages that went into 7.8.
For example: https://access.redhat.com/errata/RHBA-2020:1048

CentOS has released CentOS 7 (2003) that is derived from RHEL 7.8. No announcement emails of individual packages have been generated. Your tool can't track that.

you update is and has been actionable the whole time.


There can be slight delay between RHEL release and CentOS release of an update. You are free to purchase RHEL, if that is not acceptable.

If a vulnerability is described and Red Hat has not released an update, then the rationale is on upstream (Red Hat's) documentation. (Won't fix, workaround, ...)

Post Reply

Return to “CentOS 7 - Security Support”