Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 8. Managing and monitoring security updates

Install security updates and display additional details about the updates to keep your Red Hat Enterprise Linux systems secured against newly discovered threats and vulnerabilities.

8.1. Identifying security updates
Copy link

Keeping enterprise systems secure from current and future threats requires regular security updates. Red Hat Product Security provides the guidance you need to confidently deploy and maintain enterprise solutions.

8.1.1. What are security advisories
Copy link

Red Hat Security Advisories (RHSA) document the information about security flaws being fixed in Red Hat products and services.

Each RHSA includes the following information:

  • Severity
  • Type and status
  • Affected products
  • Summary of fixed issues
  • Links to the tickets about the problem. Note that not all tickets are public.
  • Common Vulnerabilities and Exposures (CVE) numbers and links with additional details, such as attack complexity.

Red Hat Customer Portal provides a list of Red Hat Security Advisories published by Red Hat. You can display details of a specific advisory by navigating to the advisory’s ID from the list of Red Hat Security Advisories.

Figure 8.1. List of security advisories

Customer Portal: List of security advisories

Optionally, you can also filter the results by specific product, variant, version, and architecture. For example, to display only advisories for Red Hat Enterprise Linux 9, you can set the following filters:

  • Product: Red Hat Enterprise Linux
  • Variant: All Variants
  • Version: 9
  • Optionally, select a minor version.

Display all security updates that are currently not installed on your host system to identify critical packages that require immediate action or installation.

You can list all available security updates for your system by using the DNF utility.

Prerequisites

  • A Red Hat subscription is attached to the host.

Procedure

  • List all available security updates which have not been installed on the host: 

    # dnf updateinfo list updates security
…
RHSA-2019:0997 Important/Sec. platform-python-3.6.8-2.el8_0.x86_64
RHSA-2019:0997 Important/Sec. python3-libs-3.6.8-2.el8_0.x86_64
RHSA-2019:0990 Moderate/Sec.  systemd-239-13.el8_0.3.x86_64
…

Display security updates that are already installed on your host. This helps you verify that required fixes are applied and track your system’s current security posture.

You can list installed security updates for your system by using the DNF utility.

Procedure

  • List all security updates which are installed on the host: 

    # dnf updateinfo list security --installed
…
RHSA-2019:1234 Important/Sec. libssh2-1.8.0-7.module+el8+2833+c7d6d092
RHSA-2019:4567 Important/Sec. python3-libs-3.6.7.1.el8.x86_64
RHSA-2019:8901 Important/Sec. python3-libs-3.6.8-1.el8.x86_64
…

    If multiple updates of a single package are installed, dnf lists all advisories for the package. In the previous example, two security updates for the python3-libs package have been installed since the system installation.

8.1.4. Displaying a specific advisory by using DNF
Copy link

Use the DNF utility to display detailed information about a specific security advisory. This helps you understand the related bug, its severity, and which packages are included in the fix.

Prerequisites

  • A Red Hat subscription is attached to the host.
  • You know the ID of the security advisory.
  • The update provided by the advisory is not installed.

Procedure

  • Display a specific advisory, for example: 

    # dnf updateinfo info RHSA-2019:0997
====================================================================
  Important: python3 security update
====================================================================
  Update ID: RHSA-2019:0997
       Type: security
    Updated: 2019-05-07 05:41:52
       Bugs: 1688543 - CVE-2019-9636 python: Information Disclosure due to urlsplit improper NFKC normalization
       CVEs: CVE-2019-9636
Description: …

8.2. Installing security updates
Copy link

In Red Hat Enterprise Linux, you can install a specific security advisory and all available security updates. You can also configure the system to download and install security updates automatically.

8.2.1. Installing all available security updates
Copy link

Install all available Red Hat security updates by using the DNF utility. This helps patch all known vulnerabilities and quickly brings the system into full compliance.

Prerequisites

  • A Red Hat subscription is attached to the host.

Procedure

  1. Install security updates by using the DNF utility: 

    # dnf update --security

    Without the --security parameter, dnf update installs all updates, including bug fixes and enhancements.

  2. Confirm and start the installation by pressing y: 

    …
Transaction Summary
===========================================
Upgrade  … Packages

Total download size: … M
Is this ok [y/d/N]: y

  3. Optional: List processes that require a manual restart of the system after installing the updated packages: 

    # dnf needs-restarting
1107 : /usr/sbin/rsyslogd -n
1199 : -bash

    The previous command lists only processes that require a restart, and not services. That is, you cannot restart processes listed by using the systemctl command. For example, the bash process shown in the output terminates when the user who owns it logs out.

Install a security update associated with a specific advisory ID by using the DNF utility. This enables targeted patching of critical vulnerabilities without updating all packages.

In certain situations, you should install only specific updates. For example, if a specific service can be updated without scheduling downtime, you can install security updates for that service only and install the remaining updates later.

Prerequisites

Procedure

  1. Install a specific advisory, for example: 

    # dnf update --advisory=RHSA-2019:0997

  2. Alternatively, update to apply a specific advisory with a minimal version change by using the dnf upgrade-minimal command, for example: 

    # dnf upgrade-minimal --advisory=RHSA-2019:0997

  3. Confirm and start the installation by pressing y: 

    …
Transaction Summary
===========================================
Upgrade  … Packages

Total download size: … M
Is this ok [y/d/N]: y

  4. Optional: List the processes that require a manual restart of the system after installing the updated packages: 

    # dnf needs-restarting
1107 : /usr/sbin/rsyslogd -n
1199 : -bash

    The previous command lists only processes that require a restart, and not services. That is, you cannot restart processes listed by using the systemctl command. For example, the bash process shown in the output terminates when the user who owns it logs out.

8.2.3. Installing security updates automatically
Copy link

Configure the dnf-automatic tool to download and install security updates automatically. Automating this task helps ensure that your systems remain protected against newly discovered threats without manual intervention.

See the dnf-automatic(8) man page on your system for more information.

Prerequisites

  • A Red Hat subscription is attached to the host.
  • The dnf-automatic package is installed.

Procedure

  1. In the /etc/dnf/automatic.conf file, in the [commands] section, make sure the upgrade_type option is set to either default or security: 

    [commands]
#  What kind of upgrade to perform:
# default                            = all available upgrades
# security                           = only the security upgrades
upgrade_type = security

  2. Enable and start the systemd timer unit: 

    # systemctl enable --now dnf-automatic-install.timer

Verification

  1. Verify that the timer is enabled: 

    # systemctl status dnf-automatic-install.timer
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2026 Red HatBack to top