Environment
- Cb Response Server: 6.2.1
- RHEL: All supported versions
- CentOS: All supported versions
Question
A recent vulnerability scan found the following End of Life packages used by the Carbon Black Response server. Can I update or remove the packages without negatively affecting Cb Response functionality?
postgresql93.x86_64 9.3.11-1PGDG.rhel6 @CarbonBlack postgresql93-contrib.x86_64 9.3.11-1PGDG.rhel6 @CarbonBlack postgresql93-libs.x86_64 9.3.11-1PGDG.rhel6 @CarbonBlack postgresql93-server.x86_64 9.3.11-1PGDG.rhel6 @CarbonBlack java-1.5.0-gcj.x86_64 1.5.0.0-29.1.el6 java-1.6.0-openjdk.x86_64 1:1.6.0.41-1.13.13.1.el6_8 java-1.7.0-openjdk.x86_64 1:1.7.0.171-2.6.13.0.el6_9 java-1.7.0-openjdk-devel.x86_64 1:1.7.0.171-2.6.13.0.el6_9 java-1.8.0-openjdk.x86_64 1:1.8.0.161-3.b14.el6_9 java-1.8.0-openjdk-devel.x86_64 1:1.8.0.161-3.b14.el6_9 java-1.8.0-openjdk-headless.x86_64 1:1.8.0.161-3.b14.el6_9 |
Answer
Postgres packages 9.3.11 can NOT be removed in server version 6.2.1. Postgres 9.3.11 will be updated in the 6.2.2 server release. Cb Response 6.2.1 depends on openjdk >= 1.8.0.92. These packages can be updated to the latest 1.8.0.x version but NOT removed. There is no dependency on java versions 1.5.0/1.6.0/1.7.0 and can be safely removed.
Additional Notes
These packages are continuously monitored for End of Life and/or security considerations.
Related Content
Cb Response 6.2.2 Server Release Notes
Cb Response 6.2.2 User Guide
Cb Response 6.2.2 Server Cluster Management Guide
Cb Response 6.2.2 Server Configuration (cb.conf) Guide
