RedHat security update missing in CentOS

[pois]

Hi,

It seems that a lots of security updates are missing in CentOS 7 compared to RHEL7 recently :

Code: Select all

RHSA           | software    | RHEL           | CentOS
---------------+-------------+----------------+------------------
RHSA-2017:1865 | libXpm      | 3.5.12-1.el7   | 3.5.11-3.el7
RHSA-2017:1975 | libreoffice | 5.0.6.2-14.el7 | 5.0.6.2.5.el7_3.1
RHSA-2017:2459 | libsoup     | 2.56.0-4.el7_4 | 2.48.1.6.el7
RHSA-2017:2004 | git         | 1.8.3.1-11.el7 | 1.8.3.1.6.el7_2.1

As I use a local mirror for yum on my servers, I tried with a clean docker image :

Code: Select all

# docker pull centos
Using default tag: latest
Trying to pull repository docker.io/library/centos ... 
sha256:26f74cefad82967f97f3eeeef88c1b6262f9b42bc96f2ad61d6f3fdf544759b8: Pulling from docker.io/library/centos

Digest: sha256:26f74cefad82967f97f3eeeef88c1b6262f9b42bc96f2ad61d6f3fdf544759b8
Status: Image is up to date for docker.io/centos:latest

# docker run -ti centos bash -c "yum update; yum info git"
Loaded plugins: fastestmirror, ovl
base                                                                         | 3.6 kB  00:00:00     
extras                                                                       | 3.4 kB  00:00:00     
updates                                                                      | 3.4 kB  00:00:00     
(1/4): extras/7/x86_64/primary_db                                            | 191 kB  00:00:00     
(2/4): base/7/x86_64/group_gz                                                | 155 kB  00:00:00     
(3/4): base/7/x86_64/primary_db                                              | 5.6 MB  00:00:00     
(4/4): updates/7/x86_64/primary_db                                           | 7.8 MB  00:00:00     
Determining fastest mirrors
 * base: mirror.plusserver.com
 * extras: centos.mirror.fr.planethoster.net
 * updates: mirror.plusserver.com
No packages marked for update
Loaded plugins: fastestmirror, ovl
Loading mirror speeds from cached hostfile
 * base: mirror.plusserver.com
 * extras: centos.mirror.fr.planethoster.net
 * updates: mirror.plusserver.com
Available Packages
Name        : git
Arch        : x86_64
Version     : 1.8.3.1
Release     : 6.el7_2.1
Size        : 4.4 M
Repo        : base/7/x86_64
Summary     : Fast Version Control System
URL         : http://git-scm.com/
License     : GPLv2
Description : Git is a fast, scalable, distributed revision control system with an
            : unusually rich command set that provides both high-level operations
            : and full access to internals.
            : 
            : The git rpm installs the core tools with minimal dependencies.  To
            : install all git packages, including tools for integrating with other
            : SCMs, install the git-all meta-package.

I'm using CentOS for many years and never see something like that.
Is there any problem with the build mecanism ?

Thanks,
Julien

[avij]

Those updates were released as part of RHEL 7.4, and CentOS 7.4 hasn't been released yet. There's always a delay at point release times. Sometimes the delay is shorter, sometimes longer. The new packages will show up first in the Continuous Release repository, but that repo is still empty at the time of this writing.

[pois]

I miss the subrelease change, nice catch.
Thank you for your anwser.