amzn2-core repository outdated

Question

The vast majority of the repository seems to be oudated directly from the source.

I am using amzn2-core.repo and amzn2-extras.repo, pushing a yum update does not update since the packages are already on their "latest" version available in the repo, which in some cases have been outdated since 2016.

Various security vulnerabilities are present and pushing yum update --security does not solve any issues whatsoever.

https://repology.org/repository/amazon_2 you can see here directly that these are not being maintained libssh2 for example is still on version 1.4.3 with the latest version being 1.11.0.

What can be done to update this repository? What alternatives can I use?

My servers are Amazon Linux 2, Centos rhel fedora.

Answer

When you have executed `yum update --security` and there are no updates that are returned, all the available security updates have been installed.

Working with the example you've provided: libssh2

Reviewing [Amazon Alas](https://explore.alas.aws.amazon.com/), we can see there was a vulnerability found on 2023-08-22 within the libssh2 package (CVE-2020-22218), this vulnerability was in function _libssh2_packet_add in libssh2 1.10.0 allows attackers to access out of bounds memory [1].

Even though the package may be listed as 2016, the Amazon Linux team has already patched [2] the package to prevent this vulnerability to be exploited.

Q. Does AWS backport security fixes for Amazon Linux 2?
"Yes. Amazon routinely takes fixes out of the most recent version of upstream software packages and applies it to the version of the package in Amazon Linux 2. During this process, Amazon isolates the fix from any other changes, ensures that the fixes do not introduce unwanted side effects, and then applies the fixes."

Please see the following FAQ: https://aws.amazon.com/amazon-linux-2/faqs/

Regarding Centos, RHEL and Fedora Operating Systems, these repositories are not managed by Amazon and therefore cannot comment on their security updates.

[1] https://alas.aws.amazon.com/AL2/ALAS-2023-2257.html

[2] https://explore.alas.aws.amazon.com/CVE-2020-22218.html

amzn2-core repository outdated

Relevant content