View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0000291 | AlmaLinux-8 | -OTHER | public | 2022-08-06 12:57 | 2022-09-12 14:10 |
| Reporter | ap8 | Assigned To | |||
| Priority | normal | Severity | minor | Reproducibility | always |
| Status | new | Resolution | open | ||
| Platform | x86_64 | OS | AlmaLinux | OS Version | 8 |
| Summary | 0000291: Errata entry missing for httpd | ||||
| Description | Advisory https://access.redhat.com/errata/RHSA-2022:5163 for CVE-2020-13950 is missing from AlmaLinux errata, but it is present in RockyLinux (https://errata.rockylinux.org/RLSA-2022:5163) and Oracle Linux (https://linux.oracle.com/errata/ELSA-2022-5163.html). | ||||
| Steps To Reproduce | In RockyLinux: <code> [root@rocky8 ~]# dnf updateinfo --info --all --cve CVE-2020-13950 Last metadata expiration check: 1:23:17 ago on Sat 06 Aug 2022 11:23:52 UTC. =============================================================================== Low: httpd:2.4 security update =============================================================================== Update ID: RLSA-2022:5163 Type: security Updated: 2022-07-07 20:12:43 CVEs: CVE-2020-13950 Description: For more information visit https://errata.rockylinux.org/RLSA-2022:5163 Severity: Low Installed: true [root@rocky8 ~]# </code> In AlmaLimux: <code> [root@alma8 ~]# dnf updateinfo --info --all --cve CVE-2020-13950 Last metadata expiration check: 1:25:21 ago on Sat 06 Aug 2022 11:20:58 UTC. [root@alma8 ~]# </code> | ||||
| Tags | No tags attached. | ||||
| abrt_hash | |||||
| URL | |||||
|
|
Just an observation. The output on RHEL 8 looks similar to the one on Alma: $ sudo dnf updateinfo --info --all --cve CVE-2020-13950 Updating Subscription Management repositories. Last metadata expiration check: 0:26:50 ago on Mon 08 Aug 2022 03:35:41 PM PDT. |
|
|
Thanks @toracat. I do not have access to a RHEL8 instance so I could not check before reporting the bug. I tried OracleLinux8 and that also behaves like AlmaLinux8 and RHEL8 (i.e. no output). Nonetheless, I assume there may be something missing in AlmaLinux because if you search for `5163` in https://errata.almalinux.org/ you get nothing, but you get the advisory if you search for the same in RockyLinux (https://errata.rockylinux.org/) and RHEL (https://access.redhat.com/errata-search/#/?q=5163&p=1&sort=portal_publication_date%20desc&rows=10&portal_advisory_type=Security%20Advisory&portal_product=Red%20Hat%20Enterprise%20Linux&portal_product_version=8) errata pages. |
|
|
I see the same thing as the original reporter, CVE reported for RHEL updates, not ALMA On RHEL: [root@xxx]# dnf updateinfo --info --all --cve CVE-2020-13950 Updating Subscription Management repositories. Last metadata expiration check: 1:56:39 ago on Tue 06 Sep 2022 12:12:13 BST. =============================================================================== Low: httpd:2.4 security update =============================================================================== Update ID: RHSA-2022:5163 Type: security Updated: 2022-06-22 10:23:56 Bugs: 1966738 - CVE-2020-13950 httpd: mod_proxy NULL pointer dereference CVEs: CVE-2020-13950 Description: The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. : : Security Fix(es): : : * httpd: mod_proxy NULL pointer dereference (CVE-2020-13950) : : For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Severity: Low Installed: true On ALMA: [root@xxx]# dnf updateinfo --info --all --cve CVE-2020-13950 Last metadata expiration check: 2:37:16 ago on Tue 06 Sep 2022 11:32:38 BST. [root@xxx]# |
|
|
Error: Task /pulp/api/v3/tasks/7c9a2e55-d3cf-4e25-ac1b-941a40c9628a/ failed: 'duplicate key value violates unique constraint "rpm_updatecollection_name_update_record_id_6ef33bed_uniq" DETAIL: Key (name, update_record_id)=(almalinux-8-for-x86_64-appstream-rpms__8_1_subversion_0, 966da980-5314-419f-872a-3b5a480ba41c) already exists. This also appears to be breaking my Pulp 3 weekly sync. This is when syncing AlmaLinux 8 BaseOS |
