News for hackers. Stuff that matters.

A comment on Google discloses CentOS Linux kernel vulnerabilities citing failure to fix. Parent comment

Re:Google discloses CentOS Linux kernel vulnerabilities citi... by fweimer on Friday March 24, 2023 @12:29PM (#35291474)
I'm not sure if such a promise ever existed. After all, before CentOS Stream, all security fixes went out with RHEL first and were imported into CentOS (non-Stream) only afterwards. And under the Stream development process, the fixes have to be merged into Stream eventually for the next minor RHEL release, otherwise they would be missing from that, too.

The CVE tracking pages are here:

https://access.redhat.com/security/cve/CVE-2023-0590

https://access.redhat.com/security/cve/CVE-2023-1249

https://access.redhat.com/security/cve/CVE-2023-1252

Based on these data, it seems that the commercially supported versions are still unfixed (if they were impacted in the first place).

Bugzilla records show that the corresponding security tracking bugs were filed publicly from the start:

https://bugzilla.redhat.com/show_bug.cgi?id=2165741 (CVE-2023-0590)

https://bugzilla.redhat.com/show_bug.cgi?id=2169719 (CVE-2023-1249)

https://bugzilla.redhat.com/show_bug.cgi?id=2176140 (CVE-2023-1252)

So the Neowin headline is a bit misleading because Red Hat disclosed these issues publicly (presumably after consultation with the reporters) even before the 90-day timer expired in the Google bug tracker.

(Disclaimer: I work for Red Hat, but are not involved in security anymore.)

[ Parent | on HN ]
Re:Google discloses CentOS Linux kernel vulnerabilities citi... by mogwire on Saturday March 25, 2023 @12:39AM (#35299476)
Additionally these are moderate CVEs and Red Hat, per their lifecycle page, patches them at their will.

During the Full Support Phase, Red Hat defined Critical and Important Security errata advisories (RHSAs) and Urgent and Selected (at Red Hat discretion) High Priority Bug Fix errata advisories (RHBAs) may be released as they become available. Other errata advisories may be delivered as appropriate.

[ Parent | on HN ]