Re: [CentOS] CentOS Security Advisories OVAL feed??

2020-08-05 Thread Carl George
> Q3) Does this indicate that only the latest CentOS (minor) release can > be considered "secure" or "patched"? Yes. Security errata for previous Enterprise Linux minor releases are a Red Hat product called Extended Update Support (EUS) [0]. CentOS doesn't build EUS updates. CentOS point releas

Re: [CentOS] CentOS Security Advisories OVAL feed??

2020-08-05 Thread Leon Fauster via CentOS
Am 05.08.20 um 17:55 schrieb Johnny Hughes: On 8/5/20 10:45 AM, cen...@niob.at wrote: On 05/08/2020 16:49, Johnny Hughes wrote: On 8/5/20 1:05 AM, cen...@niob.at wrote: On 04/08/2020 23:50, Jon Pruente wrote: On Tue, Aug 4, 2020 at 11:34 AM wrote: Q5) If the answer to the last question is

Re: [CentOS] CentOS Security Advisories OVAL feed??

2020-08-05 Thread centos
On 05/08/2020 17:55, Johnny Hughes wrote: Having said all this: maybe there is some deeper problem here, because of that pattern of missing announce e-mails that correspond with packages that differ in the final version number with respect to the upstream package. Or is this just a coincidence?

Re: [CentOS] CentOS Security Advisories OVAL feed??

2020-08-05 Thread Johnny Hughes
On 8/5/20 10:45 AM, cen...@niob.at wrote: > On 05/08/2020 16:49, Johnny Hughes wrote: >> On 8/5/20 1:05 AM, cen...@niob.at wrote: >>> On 04/08/2020 23:50, Jon Pruente wrote: On Tue, Aug 4, 2020 at 11:34 AM wrote: > Q5) If the answer to the last question is "no": shouldn't there be >>

Re: [CentOS] CentOS Security Advisories OVAL feed??

2020-08-05 Thread centos
On 05/08/2020 16:49, Johnny Hughes wrote: On 8/5/20 1:05 AM, cen...@niob.at wrote: On 04/08/2020 23:50, Jon Pruente wrote: On Tue, Aug 4, 2020 at 11:34 AM wrote: Q5) If the answer to the last question is "no": shouldn't there be such a resource? CentOS doesn't publish security errata. If y

Re: [CentOS] CentOS Security Advisories OVAL feed??

2020-08-05 Thread Johnny Hughes
On 8/5/20 1:05 AM, cen...@niob.at wrote: > On 04/08/2020 23:50, Jon Pruente wrote: >> On Tue, Aug 4, 2020 at 11:34 AM wrote: >> >>> Q5) If the answer to the last question is "no": shouldn't there be such >>> a resource? >>> >> CentOS doesn't publish security errata. If you need it then you should

Re: [CentOS] CentOS Security Advisories OVAL feed??

2020-08-04 Thread centos
On 04/08/2020 23:50, Jon Pruente wrote: On Tue, Aug 4, 2020 at 11:34 AM wrote: Q5) If the answer to the last question is "no": shouldn't there be such a resource? CentOS doesn't publish security errata. If you need it then you should either buy RHEL, or deal with putting together your own se

Re: [CentOS] CentOS Security Advisories OVAL feed??

2020-08-04 Thread Jon Pruente
On Tue, Aug 4, 2020 at 11:34 AM wrote: > Q5) If the answer to the last question is "no": shouldn't there be such > a resource? > CentOS doesn't publish security errata. If you need it then you should either buy RHEL, or deal with putting together your own set up with something like http://cefs.st

[CentOS] CentOS Security Advisories OVAL feed??

2020-08-04 Thread centos
Dear List, I have spent some time playing around with oscap and the RHEL OVAL feed (https://www.redhat.com/security/data/oval/v2/RHEL8/, also check Chapter 16 of the RHEL 8 Design Guide). Because I could not find an existing OVAL file for CentOS, I downloaded one of the RHEL8 files and managed