This blog post is mainly about my practicing of managing security risk on a RHEL system, especially learning how to use the occasionally option passed to YUM command. It is probably not a good resource teaching how to properly manage security risks in general.

Identify all critical, important, and moderate security notices on this server.

[root@puppet2 ~]# yum updateinfo --security
Updating Subscription Management repositories.
Red Hat Enterprise Linux 8 for x86_64 - Supplementary (RPMs)                                  21 kB/s | 2.1 kB     00:00
Red Hat Enterprise Linux 8 for x86_64 - AppStream (RPMs)                                      27 kB/s | 2.8 kB     00:00
Red Hat Enterprise Linux 8 for x86_64 - BaseOS (RPMs)                                        475  B/s | 2.4 kB     00:05
EPEL8 x86_64                                                                                  28 kB/s | 2.8 kB     00:00
Updates Information Summary: available
    2 Security notice(s)
        2 Important Security notice(s)

Determine how many security-related packages are available for this machine.

[root@puppet2 ~]# yum --security list updates
...omitted...
Available Upgrades
gnutls.x86_64                                        3.6.8-11.el8_2                        rhel-8-for-x86_64-baseos-rpms
libnghttp2.x86_64                                    1.33.0-3.el8_2.1                      rhel-8-for-x86_64-baseos-rpms

Identify any RHSAs that are considered important, and available as updates for this machine.

[root@puppet2 ~]# yum updateinfo list updates --sec-severity Important
...omitted...
RHSA-2020:2637 Important/Sec. gnutls-3.6.8-11.el8_2.x86_64
RHSA-2020:2755 Important/Sec. libnghttp2-1.33.0-3.el8_2.1.x86_64

There are two RHSAs that meet the criteria: RHSA-2020:2637 and RHSA-2020:2755.

View the synopsis of one of the above important RHSAs (RHSA-2020:2637) to validate its content.

[root@puppet2 ~]# yum updateinfo --info RHSA-2020:2637
...omitted...
===============================================================================
  Important: gnutls security update
===============================================================================
  Update ID: RHSA-2020:2637
       Type: security
    Updated: 2020-06-22 16:26:44
       Bugs: 1843723 - CVE-2020-13777 gnutls: session resumption works without master key allowing MITM
       CVEs: CVE-2020-13777
Description: The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic
algorithms and protocols such as SSL, TLS, and DTLS.
           : 
           : Security Fix(es):
           : 
           : * gnutls: session resumption works without master key allowing MITM (CVE-2020-13777)
           : 
           : For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other
related information, refer to the CVE page(s) listed in the References section.
   Severity: Important
[root@puppet2 ~]# 
````

Use YUM and CVE code to list the packages required to update this system.

```console
[root@puppet2 ~]# yum updateinfo list --cve CVE-2020-13777
...omitted...
RHSA-2020:2637 Important/Sec. gnutls-3.6.8-11.el8_2.x86_64

This machine needs 1 package update to resolve CVE-2020-13777. Use YUM and the CVE code to update the system with necessary package that provides the security fixes.

[root@puppet2 ~]# yum update --cve CVE-2020-13777
Updating Subscription Management repositories.
Red Hat Enterprise Linux 8 for x86_64 - Supplementary (RPMs)                                  19 kB/s | 2.1 kB     00:00
Red Hat Enterprise Linux 8 for x86_64 - AppStream (RPMs)                                      28 kB/s | 2.8 kB     00:00
Red Hat Enterprise Linux 8 for x86_64 - BaseOS (RPMs)                                         22 kB/s | 2.4 kB     00:00
EPEL8 x86_64                                                                                  28 kB/s | 2.8 kB     00:00
Dependencies resolved.
========================================================================================================================
 Package                 Architecture            Version                    Repository                             Size
========================================================================================================================
Upgrading:
 gnutls                  x86_64                  3.6.8-11.el8_2             rhel-8-for-x86_64-baseos-rpms         915 k

Transaction Summary
========================================================================================================================
Upgrade  1 Package

Total download size: 915 k
Is this ok [y/N]: y
Downloading Packages:
gnutls-3.6.8-11.el8_2.x86_64.rpm                                                             3.1 MB/s | 915 kB     00:00
------------------------------------------------------------------------------------------------------------------------
Total                                                                                        3.1 MB/s | 915 kB     00:00
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing:                                                                                                         1/1
  Upgrading        : gnutls-3.6.8-11.el8_2 x86_64                                                                    1/2
  Cleanup          : gnutls-3.6.8-10.el8_2.x86_64                                                                    2/2
  Running scriptlet: gnutls-3.6.8-10.el8_2.x86_64                                                                    2/2
  Verifying        : gnutls-3.6.8-11.el8_2.x86_64                                                                    1/2
  Verifying        : gnutls-3.6.8-10.el8_2.x86_64                                                                    2/2
Installed products updated.

Upgraded:
  gnutls-3.6.8-11.el8_2.x86_64

Complete!

Now repeat the above step for another RHSA-2020:2755.