On Tue, 1 Nov 2022 at 06:59, Nick Howitt via epel-devel <epel-devel@xxxxxxxxxxxxxxxxxxxxxxx> wrote:
Yesterday, ClamAV announced CVE-2022-37434 as critical (https://blog.clamav.net/2022/10/new-packages-for-clamav-01037-01044.html). Redhat only seem to classify the issue as Moderate in EL7 - https://access.redhat.com/security/cve/cve-2022-37434. It looks like that, unless Redhat classify it as Critical, zlib and zlib-devel won't get updated so ClamAV can't be rebuilt against the updated zlib-devel. What is the EPEL take on the issue?
Well if the EL7 in the base operating system is not getting updated, then any rebuild by EPEL is not going to see a 'fixed' version. It isn't just zlib-devel which would need to be fixed but the zlib libraries that clamav needs to link to on a system.
This problem isn't new and is common when any RHEL reaches its '2 years until expiration'. We usually see more software where the upstream vendor believes a problem is critical but the OS vendor does not in the oldest version. This being a volunteer organization, we generally have to go with what copious free time allows which is usually nil and nothing.
_______________________________________________
epel-devel mailing list -- epel-devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to epel-devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/epel-devel@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Stephen Smoogen, Red Hat Automotive
Let us be kind to one another, for most of us are fighting a hard battle. -- Ian MacClaren_______________________________________________ epel-devel mailing list -- epel-devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to epel-devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/epel-devel@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
