CentOS And CVE-2017-1000117

Home » CentOS » CentOS And CVE-2017-1000117
CentOS 6 Comments

hi CentOS community,

as many of you probably have been following along, a few days ago CVE
2017-1000117 was identified and redhat was prompt to release patches to fedora 25/26. I
haven’t seen any chatter thus far from CentOS, so was wondering if anyone knew the status of the patches landing in CentOS, and more specifically, for CentOS 6 and git 1.7.x that’s currently latest in the repos.


6 thoughts on - CentOS And CVE-2017-1000117

  • I’ve seen the announcement and update(s) for CentOS-6
    (CESA-2017:2485), but I don’t find anything for CentOS-7 yet. It looks like RH announced them both at about the same time wednesday and the update for CentOS-6 came out thursday. Is there some reason that the update(s) for -7 haven’t been pushed out?

  • Am 19.08.2017 um 14:45 schrieb Richard:

    Updates for CentOS 7 are hold back until the 7.4 update gets released. It will start by populating the CR repo.


  • Updates build upon each other. If an update is built against 7.4 and links against the 7.4 libraries, we can not instead build it against 7.3
    .. everything has to be done in a specific order to get the correct build requirements and link against the proper shared libraries. So while it would be great to just build and release the security updates first, life does not allow it to work like that.

    CR should be out in a few hours .. initially it will contain only the the RPMs that were part of the 7.4 actual release.

    Within 24 hours of that CR release, CR will be updated to contain all the updates that actually needed to be built against 7.4 (those are building now and the initial CR is in the final QA stages).