Overview
Applying security updates in a timely manner is an effective measure to defend against known vulnerability risks. We recommend that you use the following commands to perform security remediation:
sudo yum update --security
Command Description
yum update --security installs only security patches, reducing unnecessary changes compared with a full update (yum update). This command has the following characteristics:
Precisely target security vulnerabilities
This command installs only software packages marked as "Security Advisory" to fix high-risk vulnerabilities, such as those with CVE numbers.
Lower risk than a full update
A full update updates all available packages, including feature improvements or non-critical patches, and may introduce compatibility issues or service interruptions. For example, non-security updates may cause Apache configuration changes or kernel module conflicts, whereas the --security option installs only security patches, reducing such risks.
Meet compliance requirements
Security standards such as Multi-Level Protection Scheme 2.0 and ISO 27001 require timely application of security patches. Using yum update --security enables rapid response to vulnerabilities, avoiding compliance or audit risks caused by unpatched vulnerabilities.
Reduce downtime
Security update packages are smaller in size and execute faster than full updates, which helps ensure business continuity.
Fixing a Specified Security Vulnerability
When you only need to fix specific vulnerabilities, use the following command to precisely install the affected software packages and avoid installing unnecessary updates:
Fixing by CVE Number
The following example uses CVE-2024-12087 (an rsync security vulnerability, corresponding to advisory TSSA-2025:1032) to demonstrate how to fix a single CVE:
sudo yum update --cve=CVE-2024-12087
To fix multiple CVEs at the same time, separate them with commas. The following example fixes CVE-2026-26955 and CVE-2026-26965 (freerdp security vulnerabilities, corresponding to advisory TSSA-2026:0754):
sudo yum update --cve=CVE-2026-26955,CVE-2026-26965
Note: The CVE numbers in the preceding examples are for demonstration only. Replace them with the actual CVE numbers you need to fix.
Fixing by Security Advisory
The following example uses security advisory TSSA-2025:1032 (an rsync security update, corresponding to CVE-2024-12087):
sudo yum update --advisory=TSSA-2025:1032
Related Information
Note:
You can first use yum updateinfo list security to preview available security advisories, or use yum updateinfo info TSSA-2025:1032 (for example, to view rsync vulnerability details) to view the details of a specific security advisory.