Tracking Security Updates and Errata Releases

Oracle releases important changes to the Oracle Linux software as individual package updates, known as errata.

Errata packages can contain the following:

Security advisories, which have names prefixed by ELSA-* (for Oracle Linux) and OVMSA-* (for Oracle VM).
Bug fix advisories, which have names prefixed by ELBA-* and OVMBA-*.
Feature enhancement advisories, which have names prefixed by ELEA-* and OVMEA-*.

To be notified when new errata packages are released, you can subscribe to the Oracle Linux and Oracle VM errata mailing lists at https://oss.oracle.com/mailman/listinfo/el-errata and https://oss.oracle.com/mailman/listinfo/oraclevm-errata.

You can track updates to Oracle Linux yum server repositories by visiting https://yum.oracle.com/whatsnew.html, where you can see which packages were updated within each repository for the previous six months.

Note:

Oracle doesn't comment on existing security vulnerabilities except through Errata announcements. To provide the best security posture to all Oracle customers, Oracle fixes significant security vulnerabilities in severity order. So, the most critical issues are always fixed first. Fixes for security vulnerabilities are produced in the following order:

Latest code line refers to the code being developed for the next major Oracle release of the product.
Next patch set for all non terminal releases

Using DNF to See Security Updates

DNF includes integrated options to handle any requirement for managing security and errata updates that are available for packages installed in Oracle Linux.

For more information, see the dnf(8) manual page.

List available errata and security updates.
List the errata that are available for a system as follows:
```
sudo dnf updateinfo list
```
The output from the command sorts the available errata in order of their IDs and identifies their types, which can be one of the following:
- Security patch (severity/Sec.)
- Bug fix (bugfix)
- Feature enhancement (enhancement)
Security patches are also listed according to their severity, which can be Critical, Important, Moderate, or Low.
- Use the --sec-severity option to filter the security errata by severity, for example:
```
sudo dnf updateinfo list --sec-severity=Critical
```
- To list the security errata by their Common Vulnerabilities and Exposures (CVE) IDs instead of their errata IDs, specify the keyword cves as an argument:
```
sudo dnf updateinfo list cves
```
  Similarly, the keywords bugfix, enhancement, and security filter the list for all bug fixes, enhancements, and security errata.
- You can use the --cve option to display the errata that correspond to a specific CVE ID, for example:
```
sudo dnf updateinfo list --cve CVE-2022-3545
```
Display more information about a security updated.
To display more information about a CVE, specify info instead of list, for example:
```
sudo dnf updateinfo info --cve CVE-ID
```
Perform security related updates on a system.
Use any of the following options:
- To update all the packages for which security-related errata are available to the latest versions of the packages, even if those packages that include bug fixes or new features but not security errata, use the following command:
```
sudo dnf --security update
```
- To update all packages to the latest versions that contain security errata, ignoring any newer packages that don't contain security errata, use the following command:
```
sudo dnf --security upgrade-minimal
```
- To update all kernel packages to the latest versions that contain security errata, use the following command:
```
sudo dnf --security upgrade-minimal kernel*
```
- To update only those packages that correspond to a CVE or erratum, use the dnf update --cve command. For Enterprise Linux Security Advisory (ELSA) patches, use dnf update --advisory.
```
sudo dnf update --cve CVE-ID
```
```
sudo dnf update --advisory ELSA-ID
```
Note:

Some updates might require that you reboot the system. By default, the boot manager automatically enables the most recent kernel version.