Vulnerabilities found after Tenable Scan in Rocky Linux 9.2

[HairulMisni]

Hi Support,

After i did a Tenable Scan on my rocky linux servers, there are findings of the following vulnerabilities.

Current Version: Rocky Linux 9.2 (Unable to upgrade to latest versiondue to company TA baseline)
Current Environment: Air Gap ( No Internet Connection )

Tenable Report:

Rocky Linux 9: libxml2 (RSLA-2024-2679) -High - libxml2-2.9.13-3.e19_1.x86_64
Rocky Linux 9: dbus (RSLA-2023-4569) - Medium - dbus-1.12.20-8.el9.x86_64
SSH Terrapin Prefix Truncation Weakness (CVE-2023-48795) - Medium openssh-8.7p1-29.e19_2.x86_64
Rocky Linux 9: file (RSLA-2024-2512) - Medium - file-5.39-12.e19.x86_64
Rocky Linux 9: OpenSSH (CVE-2024-6358) - Medium openssh-8.7p1-29.e19_2.x86_64

I would appreciate if you can point to me the packages that i can download to update to address the vulnerabilities found.

[jlehtone]

The “updates” would be the latest version. Your “company TA” forbids that …

@HairulMisni

Current Environment: Air Gap

Should you get rid of people in your company, because they are the only ones that can access the machine and exploit the vulnerabilities?

Besides, you can look at – for example – the

rpm -q --changelog openssh

The changelog tends to list the cve that are fixed. Some scanners report false positives when Red Hat has already backported fixes and scanner does not do real tests.

[iwalker]

No release prior to the current one 9.4 is not supported. As @jlehtone says, upgrade your system. If your company won’t let you do that, then they are stupid. Updates are what fix CVE issues.