11.2. About Patching Mechanisms

JBoss patches are released in two forms.

Deciding whether a patch is released as part of a planned update or an asynchronous update depends on the severity of the issue being fixed. An issue of low impact is typically deferred, and is resolved in the next cumulative patch or minor release of the affected product. Issues of moderate or higher impact are typically addressed in order of importance as an asynchronous update to the affected product, and contain a fix for only a specific issue.

Cumulative and security patches for JBoss products are distributed in two forms: zip (for all products) and RPM (for a subset of products).

Security updates for JBoss products are provided by an erratum (for both zip and RPM methods). The erratum encapsulates a list of the resolved flaws, their severity ratings, the affected products, textual description of the flaws, and a reference to the patches. Bug fix updates are not announced via an erratum.

For more information on how Red Hat rates JBoss security flaws, refer to: Section 11.6, “Severity and Impact Rating of JBoss Security Patches”

Red Hat maintains a mailing list for notifying subscribers about security related flaws. See Section 11.3, “Subscribe to Patch Mailing Lists”