Ensure yum Removes Previous Package Versions

An XCCDF Rule

Description

yum should be configured to remove previous software components after new versions have been installed. To configure yum to remove the previous software components after updating, set the clean_requirements_on_remove to 1 in /etc/yum.conf.

Rationale

Previous versions of software components that are not removed from the information system after updates have been installed may be exploited by some adversaries.

ID: xccdf_org.ssgproject.content_rule_clean_components_post_updating
Severity: Low
References: 18 20 4

APO12.01 APO12.02 APO12.03 APO12.04 BAI03.10 DSS05.01 DSS05.02

3.4.8

CCI-002617

4.2.3 4.2.3.12 4.2.3.7 4.2.3.9

A.12.6.1 A.14.2.3 A.16.1.3 A.18.2.2 A.18.2.3

CM-11(a) CM-11(b) CM-6(a) SI-2(6)

ID.RA-1 PR.IP-12

SRG-OS-000437-GPOS-00194

SV-204452r853894_rule
Updated: about 1 year ago

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-RHEL-07-020200
  - NIST-800-171-3.4.8  - NIST-800-53-CM-11(a)
  - NIST-800-53-CM-11(b)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-2(6)
  - clean_components_post_updating
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure yum Removes Previous Package Versions - Ensure YUM Removes Previous
    Package Versions
  ansible.builtin.lineinfile:
    dest: /etc/yum.conf
    regexp: ^#?clean_requirements_on_remove
    line: clean_requirements_on_remove=1
    insertafter: \[main\]
    create: true
  when: '"yum" in ansible_facts.packages'
  tags:
  - DISA-STIG-RHEL-07-020200
  - NIST-800-171-3.4.8
  - NIST-800-53-CM-11(a)
  - NIST-800-53-CM-11(b)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-2(6)
  - clean_components_post_updating
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy

# Remediation is applicable only in certain platforms
if rpm --quiet -q yum; then

if grep --silent ^clean_requirements_on_remove /etc/yum.conf ; then
        sed -i "s/^clean_requirements_on_remove.*/clean_requirements_on_remove=1/g" /etc/yum.conf
else        echo -e "\n# Set clean_requirements_on_remove to 1 per security requirements" >> /etc/yum.conf
        echo "clean_requirements_on_remove=1" >> /etc/yum.conf
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Ensure yum Removes Previous Package Versions

Description

Rationale

Remediation - Ansible

Remediation - Shell Script