Bug 1320277

Summary: file-5.04-30 seems to be missing security information
Product: Red Hat Enterprise Linux 6 Reporter: Dave Love <dave.love>
Component: fileAssignee: Jan Kaluža <jkaluza>
Status: CLOSED ERRATA QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: high Docs Contact:
Priority: high    
Version: 6.7CC: coolseed, jorton, kshravag, pghadge, sengork, seniormachineuser, vdhande
Target Milestone: rcKeywords: Security
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-05-05 07:28:46 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Dave Love 2016-03-22 17:39:33 UTC
Description of problem:
The changelog for file 5.04-30 says it fixes CVEs since 5.04-21, which seems to have been the last release on RHEL6, but it isn't selected by yum --security:

# rpm -q file
file-5.04-21.el6.x86_64
# yum --quiet check-update --security file
# yum --quiet check-update file

file.x86_64                    5.04-30.el6                    rhel-6-server-rpms

(I don't know where the --security information comes from.)

Version-Release number of selected component (if applicable):
5.04-30.el6.x86_64

Comment 2 Marko Mäkiö 2016-04-06 08:57:49 UTC
This file version is not listed in https://rhn.redhat.com/errata/rhel-server-6-errata.html and no source rpm found from http://ftp.redhat.com/redhat/linux/enterprise/6Server/en/os/SRPMS/.

file-5.04-30.el6.x86_64
file-libs-5.04-30.el6.x86_64

$ rpm -qi file
Name        : file                         Relocations: (not relocatable)
Version     : 5.04                              Vendor: Red Hat, Inc.
Release     : 30.el6                        Build Date: Tue 16 Feb 2016 15:14:44 EET
Install Date: Wed 06 Apr 2016 11:00:33 EEST      Build Host: x86-027.build.eng.bos.redhat.com
Group       : Applications/File             Source RPM: file-5.04-30.el6.src.rpm
Size        : 56567                            License: BSD
Signature   : RSA/8, Thu 03 Mar 2016 12:50:29 EET, Key ID 199e2f91fd431d51
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
URL         : http://www.darwinsys.com/file/
Summary     : A utility for determining file types
Description :
The file command is used to identify a particular file according to the
type of data contained by the file.  File can identify many different
file types, including ELF binaries, system libraries, RPM packages, and
different graphics formats.

Comment 3 sengork 2016-05-04 02:57:45 UTC
Not sure whether this is directly related, but it's the only search hit on Bugzilla. Last week this update worked with the same version of packages. This week it no longer works:

# yum update --disablerepo="*" --enablerepo="rhel-6-server-rpms"
Loaded plugins: product-id, security, subscription-manager
Setting up Update Process
Resolving Dependencies
--> Running transaction check
---> Package file.x86_64 0:5.04-21.el6 will be updated
---> Package file.x86_64 0:5.04-30.el6 will be an update
--> Processing Dependency: file-libs = 5.04-30.el6 for package: file-5.04-30.el6.x86_64
---> Package initscripts.x86_64 0:9.03.49-1.el6_7.4 will be updated
---> Package initscripts.x86_64 0:9.03.49-1.el6_7.5 will be an update
---> Package kernel.x86_64 0:2.6.32-573.26.1.el6 will be installed
---> Package kernel-firmware.noarch 0:2.6.32-573.22.1.el6 will be updated
---> Package kernel-firmware.noarch 0:2.6.32-573.26.1.el6 will be an update
--> Finished Dependency Resolution
--> Running transaction check
---> Package file.x86_64 0:5.04-30.el6 will be an update
--> Processing Dependency: file-libs = 5.04-30.el6 for package: file-5.04-30.el6.x86_64
---> Package kernel.x86_64 0:2.6.32-504.16.2.el6 will be erased
--> Finished Dependency Resolution
Error: Package: file-5.04-30.el6.x86_64 (rhel-6-server-rpms)
           Requires: file-libs = 5.04-30.el6
           Installed: file-libs-5.04-21.el6.x86_64 (@anaconda-RedHatEnterpriseLinux-201409260744.x86_64/6.6)
               file-libs = 5.04-21.el6
           Available: file-libs-5.04-5.el6.i686 (rhel-6-server-rpms)
               file-libs = 5.04-5.el6
           Available: file-libs-5.04-6.el6.i686 (rhel-6-server-rpms)
               file-libs = 5.04-6.el6
           Available: file-libs-5.04-9.el6.i686 (rhel-6-server-rpms)
               file-libs = 5.04-9.el6
           Available: file-libs-5.04-11.el6.i686 (rhel-6-server-rpms)
               file-libs = 5.04-11.el6
           Available: file-libs-5.04-13.el6.i686 (rhel-6-server-rpms)
               file-libs = 5.04-13.el6
           Available: file-libs-5.04-15.el6.i686 (rhel-6-server-rpms)
               file-libs = 5.04-15.el6
 You could try using --skip-broken to work around the problem
 You could try running: rpm -Va --nofiles --nodigest
# uname -r
2.6.32-573.7.1.el6.x86_64
# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 6.7 (Santiago)
#

Comment 7 Joe Orton 2016-05-04 08:18:01 UTC
There appears to have been some issue with a forthcoming errata, we're looking into this, thanks.  Please contact Red Hat support if this is causing issue for you in production.

Comment 8 Joe Orton 2016-05-05 07:28:46 UTC
Apologies for any inconvenience, this should now be resolved.

You may need to run "yum clean all" to expire any cached repodata.  Please contact Red Hat support if you see further issues!