Redhat security patch backport

This article will detail how Redhat manages security patches in backports. This article will focus on the Apache httpd package but may be relevant to other packages as well. You may notice or be alerted that a specific package version contains vulnerabilities and that the Redhat package manager (yum or dnf) doesn’t have the latest version available. The solution is that in some cases Redhat will backport security patches into the same version.

Apache backport

RedHat Enterprise Linux (RHEL) 8.x is currently shipped with httpd version 2.4.37. You may receive a Common Vulnerabilities and Exposure (CVE) report for this version of apache. When you attempt to install updates with your package manager, you find none.

dnf update httpd

When you check for updates with your package manager, you still find nothing.

dnf list available httpd

This means that the httpd version is based on the upstream version in the package manager but does not necessarily mean it doesn’t contain backported security patches.

To check the security patches for a given CVE, run the following command.

rpm -q --changelog httpd | grep CVE-2006-20001

If that CVE has been patches you should see this output.

- Resolves: #2162499 - CVE-2006-20001 httpd: mod_dav: out-of-bounds read/write

Now, obviously taking off the piped grep command will list all of the backported security patches.

Conclusion – Redhat security patch backport

This article has demonstrated how RedHat Enterprise Linux backports security patches into the installed upstream version of some packages, specifically Apache. Let us know in the comments if you have any questions. If you found this article helpful, consider reading more of our content on Redhat.