CentOS7 CVE Security Vulnerabilties

[mehmetmirac]

Hi ,

We are getting high CVSS_3 results in CentOS 7.9 Whitesource vulnerability scan results. I have attached a screenshot of the excel table I created.

RPMs-Security-Alerts-Report-31 March.PNG (203 KiB) Viewed 2952 times

In the table, you can see the actions of CentOS7 and Rhel 7 on rpms in various situations. According to my research CentOS fixed some CVE issues but not most. My question is why does CentOS 7.9 not fix these CVE vulnerabilities?Does CentOS have any plans to fix these vulnerabilities? Are there any methods I can use to fix these vulnerabilities?

I would be very grateful if you could reply
thanks

[TrevorH]

If it is fixed in RHEL 7 then it is also fixed in CentOS 7. Provided you are up to date that is. If you run yum update and there are no packages to be updated then you are up to date (assuming that you do not run your own CentOS mirror and then it depends on that being up to date too).

In most cases you can run rpm -q --changelog $package | less and see the rpm changelog which usually lists the CVE numbers as fixed though not always. You can also consult the Red Hat CVE pages like or example https://access.redhat.com/security/cve/CVE-YYYY-nnnnn and read about them there adn the packages tab lists the package version in which this was fixed. CentOS moslty uses the same package versions as RHEL does unless the package contains ".centos." in which case special rules apply but the numbers are still similar enough to be able to work out if you have the right one or not.

Please note that 'yum security' does not work on CentOS as the yum repos do not contain the security metadata necessary to allow that to function. Do not attempt to run e.g. yum update --security as it will always tell you there is nothing to do.

[TrevorH]

I did not understand that Whitesource was a vulnerability scanner and reporter. From the picture you posted it appears to be broken and you should report those results to them so that they can fix their tool.

[mehmetmirac]

Thank you for the information Trevor

Finally, I would like to ask the following: For example, Rhel7 "will not fix" for "gcc-4.8.5-44.el7.x86_64.rpm". So if this vulnerability is not fixed in Rhel7, does it mean that it is not fixed in Centos7?

[jlehtone]

CentOS is built from sources of RHEL. Red Hat updates those sources when they deem a need for it.
Therefore, CentOS gets a fix if RHEL gets a fix.

On very rare occasion has CentOS modified a source (to get a fix quicker).
The general rule is that if Red Hat does not release a fix, then there will be no fix.