How do I download RPMs affected by security errata using the Red Hat Customer Portal?

When security advisories are released, they are published at our Security Advisories page. Click on the advisory number for more details.

It is also possible to view all errata for a given product by visiting Downloads. Browse to the product you are interested in and then select the 'Errata' tab. For example, errata for RHEL 7 Server

All Red Hat errata advisories can be browsed at Red Hat Product Errata

The advisory details page (example) describes the issue and any special instructions that must be performed in addition to updating the package to fix the vulnerability. You can also find information about what products are affected and the CVEs that are addressed.

From the advisory details page, click the 'Updated Packages' tab. To download the updated package(s), click on the package name(s) and save to the hard drive. It is highly recommended that you create a new directory, such as /tmp/updates, and save all the downloaded packages to it.

All Red Hat Enterprise Linux packages are signed with the Red Hat, Inc. GPG key. The RPM utility within Red Hat Enterprise Linux automatically tries to verify the GPG signature of an RPM package before installing it. If the Red Hat, Inc. GPG key is not installed, install it from a secure, static location such as an Red Hat Enterprise Linux installation CD-ROM.

Assuming the CD-ROM is mounted in /mnt/cdrom, use the following command to import it into the keyring:

rpm --import /mnt/cdrom/RPM-GPG-KEY

To display a list of all keys installed for RPM verification, execute the following command:

rpm -qa gpg-pubkey*

For the Red Hat, Inc. key, the output includes the following:

gpg-pubkey-db42a60e-37ea5438

To display details about a specific key, use the rpm -qi command followed by the output from the previous command, as in this example:

rpm -qi gpg-pubkey-db42a60e-37ea5438

It is extremely important to verify the signature of the RPM files before installing them to ensure that they have not been altered from the Red Hat, Inc. release of the packages. To verify all the downloaded packages at once, issue the following command:

rpm -K /tmp/updates/*.rpm

For each package, if the GPG key verifies successfully, the command returns gpg OK .

After verifying the GPG key and downloading all the packages associated with the errata report, install the packages as root at a shell prompt.

This can be done safely for most packages (except kernel packages) by issuing the following command:

rpm -Uvh /tmp/updates/*.rpm

For kernel packages it is advised that the following command be used:

rpm -ivh /tmp/updates/< kernel-package>

Replace <kernel-package> in the previous example with the name of the kernel RPM.

Once the machine has been safely rebooted using the new kernel, the old kernel may be removed using the following command:

rpm -e <old-kernel-package>

Replace < old-kernel-package> in the previous example with the name of the older kernel RPM.

Note: It is not a requirement that the old kernel be removed.

Important: Before installing any security errata, be sure to read any special instructions contained in the errata report and execute them accordingly.