On Tue, Mar 03, 2020 at 07:02:40PM +0530, Kaushal Shriyan wrote:
> I have gone through the article
> https://access.redhat.com/security/updates/backporting/. I am having a
> follow up question. Do I need to wait for the OpenSSL version 1.1.1d to be
> available on CentOS 7.x once it is tested in the upstream RHEL 7.x
> version? Please correct me if I misunderstood anything. I look forward to
> hearing from you and thanks in advance.
To quote the article:
> We use the term backporting to describe the action of taking a fix
> for a security flaw out of the most recent version of an upstream
> software package and applying that fix to an older version of the
> package we distribute.
Basically, you'll likely never see version 1.1.1d in CentOS 7. Any
software fixes will be backported to the version in CentOS 7, 1.0.2k.
The release will be incremented as new updates in CentOS come out, but
it'll continue to be 1.0.2k until Red Hat decides to do a rebase.
That doesn't happen until there are features that are needed that are
too difficult to backport. There have been OpenSSL rebases
mid-release (in c5 and c6 I think), and I remember it caused a lot of
problems, so I don't look forward to it.
I think you need to back up and ask yourself *WHY* you are demanding
the latest release of OpenSSL. Do you need features that are not
available in the OpenSSL in CentOS 7? Is there an auditor saying you
must have some version to be secure?
If you must have versions of OpenSSL not in CentOS7, I suggest looking
at packaging your application that uses SSL in a docker container that
has that version available. Perhaps CentOS 8 will work for you.
--
Jonathan Billings <billings@xxxxxxxxxx>
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
https://lists.centos.org/mailman/listinfo/centos
