systemd 219-67.el7 rpm release date

[cloud2020]

Hi,

current systemd rpm has "CVE-2018-15686" security issue. The fix is on version 219-67.el7. is there timeline when this rpm will be available for Centos OS?


Thanks

[TrevorH]

It'll be part of 7.7 and will be released when that's ready.

[WSLUser]

Trevor,

This is considered a critical vulnerability by MITRE as reported by Nessus. Unless the 7.7 release is this week, this needs to be backported to 7.6 asap.

[TrevorH]

It's not considered a critical vulnerability by Redhat. They say it is moderate. I suspect the difference may be that Redhat know that systemd-user is disabled in RHEL/CentOS so the vulnerability attack surface is considerably lower since you already have to be root to use systemd at all.

In any case, you can get the update already by enabling the CR repo - yum --enablerepo=cr update