Re: Sendmail Patch

On Fri, 19 Sep 2003, Taylor, ForrestX wrote:

> [email protected] wrote:
> > Is the Sendmail patch (8.12.8) on the RH website
> > the most current? The Sendmail.org site has the most
> > current as 8.12.10.
> > 
> > Does the RH patch rpm of 8.12.8 include the latest
> > sendmail problem? I noticed the build date was
> > Sept 17 2003, lists two recent bug fixes, but doesn't
> > describe them, just gives the ref#, and sendmail.org
> > site doesn't xref the ref# to problem.
> 
> Yes, it is the most recent.  Here is a the information from the advisory:
> 
> -----

[major snippage]

> 
> All users are advised to update to these erratum packages containing a
> backported patch which corrects these vulnerabilities.
> -----
> 
> Notice the last paragraph, which talks about the backported patch

In the category of "teaching a man to fish"


I'm sure that Mr. Taylor is well aware of the site and hence this is more 
for the original poster's info.

All of the patching (errata in RedHat speak) that redhat does is well
documented at:

	https://rhn.redhat.com/errata/rh72-errata.html

(at least for RedHat 7.2)


This is the authority for any updating that RedHat puts out.  It would 
behoove anybody maintaining RedHat based systems to get familiar with 
this website as http://cve.mitre.org and others that track issues and 
notify the community as to their existence.


Yet another way is to download the packages in question and use rpm to 
view the changelog for that particular rpm.

	rpm -changelog -qip nameofrpm.rpm | more