Can one security advisory affect more than one RPM package?

Question

On RedHat and derived Linux distributions, vulnerability warnings are available in form of security advisories which are usually derived from CVEs.

The rules for the CVE numbering authorities state that

The CVE Program expects separate CVE IDs to be assigned to independently fixable vulnerabilities. If one vulnerability can be fixed without fixing the other, then the vulnerabilities should receive separate CVE IDs. The exception is when the vulnerabilities are independently fixable because they are in different products, but those products are affected because they share the same code, or the products are affected because they use the functionality of another product.

Considering that shared code is usually found in shared library RPMs, that would seem to imply that a single CVE (or RHSA) can only ever affect one specific RPM package (disregarding the existence of different versions of a package for different architectures).

My question is now: Are there examples where one RedHat Security Advisory has affected more than one package, or is there (by design or de facto) a one-to-one correspondence between a CVE/RHSA and one RPM package?

Answer 1

Yes.

A single CVE advisory can impact many packages.

There is not always a one-on-one mapping of a CVE to a Red Hat Security Advisory (RHSA).

There can be a one-to-many mapping from a specific CVE to different RHSA's in which the CVE is addressed. Some RHSA's also combine the fixes for two or more CVE's, bugs and/or enhancements in a single update.

A single Red Hat Security Advisory (RHSA) can consist many different RPM packages as well.

You will almost always see that a single RHSA includes at least two updated packages, an updated source RPM (SRPM) package and an updated binary RPM package and often (many) more:

• Some products are split up in several RPM packages, typically a main RPM and several optional components which are shipped in separate, but related RPM packages. When a vulnerability impacts such a product often there will be more than 2 new packages that have been released.

• Many RHSA's apply to several different architectures at once. The same bug applies and the fix is released by compiling the same updated SRPM package(s) to different binary RPM's for the different supported architectures (x86_64, IBM z Systems , Power and ARM).

For the inverse relationship: each updated RPM/SRPM package is only ever part of one Security/Enhancement/Bug-fix Advisory (RHSA, RHEA or RHBA).

---

As an example: CVE-2021-44228 ; the recent big log4j vulnerability.

A nice overview of all RHSA's that were created to address that is found on:
https://access.redhat.com/security/vulnerabilities/RHSB-2021-009

For the single product "Red Hat OpenShift 4" the following list of RHSA's was created :

• RHSA-2021:5106
• RHSA-2021:5107
• RHSA-2021:5108
• RHSA-2021:5183
• RHSA-2021:5184
• RHSA-2021:5184
• RHSA-2021:5148

---

RHSA-2022:5821 is an example that combines the fixes for several CVE's in a single update (4 CVE's, 4 bug fixes and a product enhancement). That results in 20 updated SRPM's and over updated 200 RPM packages.

---

Apache httpd is a good example of a single product that is split in several related RPM's and which released on several different architectures (x86_64, IBM z Systems , Power and ARM)

RHSA-2022:5163 shows for x86_64 RHEL 8 alone a whole host of updated packages (and many more when taking all other architectures into account):

3 new SRPM's:

• httpd-2.4.37-47.module+el8.6.0+15654+427eba2e.2.src.rpm
• mod_http2-1.15.7-5.module+el8.6.0+13996+01710940.src.rpm
• mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.src.rpm

20 new x86_64 RPM's:

• httpd-2.4.37-47.module+el8.6.0+15654+427eba2e.2.x86_64.rpm
• httpd-debuginfo-2.4.37-47.module+el8.6.0+15654+427eba2e.2.x86_64.rpm
• httpd-debugsource-2.4.37-47.module+el8.6.0+15654+427eba2e.2.x86_64.rpm
• httpd-devel-2.4.37-47.module+el8.6.0+15654+427eba2e.2.x86_64.rpm
• httpd-filesystem-2.4.37-47.module+el8.6.0+15654+427eba2e.2.noarch.rpm
• httpd-manual-2.4.37-47.module+el8.6.0+15654+427eba2e.2.noarch.rpm
• httpd-tools-2.4.37-47.module+el8.6.0+15654+427eba2e.2.x86_64.rpm
• httpd-tools-debuginfo-2.4.37-47.module+el8.6.0+15654+427eba2e.2.x86_64.rpm
• mod_http2-1.15.7-5.module+el8.6.0+13996+01710940.x86_64.rpm
• mod_http2-debuginfo-1.15.7-5.module+el8.6.0+13996+01710940.x86_64.rpm
• mod_http2-debugsource-1.15.7-5.module+el8.6.0+13996+01710940.x86_64.rpm
• mod_ldap-2.4.37-47.module+el8.6.0+15654+427eba2e.2.x86_64.rpm
• mod_ldap-debuginfo-2.4.37-47.module+el8.6.0+15654+427eba2e.2.x86_64.rpm
• mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64.rpm
• mod_md-debuginfo-2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64.rpm
• mod_md-debugsource-2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64.rpm
• mod_proxy_html-2.4.37-47.module+el8.6.0+15654+427eba2e.2.x86_64.rpm
• mod_proxy_html-debuginfo-2.4.37-47.module+el8.6.0+15654+427eba2e.2.x86_64.rpm
• mod_session-2.4.37-47.module+el8.6.0+15654+427eba2e.2.x86_64.rpm
• mod_session-debuginfo-2.4.37-47.module+el8.6.0+15654+427eba2e.2.x86_64.rpm
• mod_ssl-2.4.37-47.module+el8.6.0+15654+427eba2e.2.x86_64.rpm
• mod_ssl-debuginfo-2.4.37-47.module+el8.6.0+15654+427eba2e.2.x86_64.rpm

Most systems won't have all of those installed and the number RPM packages that actually needed to be installed/updated to address CVE-2020-13950 would have been quite a bit lower.