Security and Errata

After CentOS 7 reached end of life, upstream stopped publishing security fixes and advisory metadata. CIQ Bridge restores both: CIQ delivers signed package remediation for CentOS 7.9 and publishes machine-readable errata so that package managers and vulnerability scanners report accurate status.

Remediation scope and prioritization

CIQ Bridge remediation targets a curated set of priority packages for CentOS 7.9, prioritizing Critical and Important/High severity CVEs. Remediation is delivered through the Bridge repository you enable with the Depot Client (see Getting started).

Errata artifacts

For remediated CVEs, CIQ publishes:

• CSAF security advisories describing the vulnerability, affected packages, and fix.
• VEX files (Vulnerability Exploitability eXchange), one per CVE, communicating applicability and status. Pre-remediation VEX statements may be published when CIQ becomes aware of a relevant CVE, so status is available before a fix ships.
• updateinfo.xml metadata in the Bridge repository, so yum can associate updates with their advisories.

All published errata files are cryptographically signed (.asc) for trust verification.

Applying security updates

CIQ publishes updateinfo.xml in the Bridge repository, so yum can map updates to advisories and filter by severity. On CentOS 7, install the security plugin first:

sudo yum install -y yum-plugin-security

Apply only security-relevant updates:

sudo yum update --security

List the advisories that apply to your system:

sudo yum updateinfo list security

Vulnerability scanners

The CSAF advisories, VEX files, and updateinfo.xml feeds allow vulnerability scanners to recognize CIQ-remediated CentOS 7.9 packages and report accurate findings, rather than flagging every CentOS 7 package as unpatched. If your scanner does not yet recognize CIQ Bridge errata, contact CIQ Support.