All Products
Search

This Product

    Alibaba Cloud Linux:Manage security updates with YUM

    Document Center

    Alibaba Cloud Linux:Manage security updates with YUM

    Last Updated:Jun 04, 2026

    Alibaba Cloud Linux releases regular updates to fix defects and patch security vulnerabilities. Use YUM to query, check, and install available security updates.

    Prerequisites

    An ECS instance running Alibaba Cloud Linux is created. Creation methods.

    Background information

    Alibaba Cloud Linux publishes security advisories at Alibaba Cloud Linux 3 Security Advisories and Alibaba Cloud Linux 2.1903 Security Advisories.

    Security updates are classified by CVSS3 severity:

    Severity level Description
    Critical High-risk vulnerabilities. Update required.
    Important Relatively high-risk vulnerabilities. Update strongly recommended.
    Moderate Medium-risk vulnerabilities. Update recommended.
    Low Low-risk vulnerabilities. Update optional.

    Query security updates

    The yum updateinfo command lists available package updates, including security fixes, bug fixes, and enhancements with CVE IDs.

    Syntax

    yum updateinfo <command> [option]

    Parameters

    <command>: The action to perform.

    Value Description
    list Lists available security updates.
    info <update_id> Displays details of a specific security update. Set <update_id> to an advisory ID from Alibaba Cloud Linux security advisories.

    [option]: Filter options.

    Option Description
    --sec-severity=<SEVS> Filters by severity level. Set <SEVS> to one or more severity levels.
    --cve=<CVE ID> Filters by CVE ID. Set <CVE ID> to one or more CVE IDs from Alibaba Cloud Linux security advisories.
    Important

    • Single severity level format: --sec-severity=<Severity level>. Example: --sec-severity=Moderate.

    • Multiple severity levels format: --sec-severity={<Severity level>,<Severity level>}. Example: --sec-severity={Moderate,Important}.

    View help information

    View help for yum updateinfo:

    yum updateinfo --help

    Get an overview of available updates

    List a summary of available updates:

    yum updateinfo

    Sample output:

    Alibaba Cloud Linux 3

    Last metadata expiration check: 0:06:42 ago on Wed 02 Jun 2021 03:05:30 AM EDT.
Updates Information Summary: available
    3 Security notice(s)
        2 Important Security notice(s)
        1 Moderate Security notice(s)

    Alibaba Cloud Linux 2

    Loaded plugins: fastestmirror
Determining fastest mirrors
base                                                                                                                                                  | 3.1 kB  00:00:00
extras                                                                                                                                                | 2.5 kB  00:00:00
plus                                                                                                                                                  | 2.5 kB  00:00:00
updates                                                                                                                                               | 2.9 kB  00:00:00
(1/6): extras/2.1903/x86_64/primary_db                                                                                                                | 149 kB  00:00:00
(2/6): base/2.1903/x86_64/group_gz                                                                                                                    | 101 kB  00:00:00
(3/6): updates/2.1903/x86_64/updateinfo                                                                                                               |  81 kB  00:00:00
(4/6): plus/2.1903/x86_64/primary_db                                                                                                                  | 1.5 MB  00:00:00
(5/6): base/2.1903/x86_64/primary_db                                                                                                                  | 4.9 MB  00:00:00
(6/6): updates/2.1903/x86_64/primary_db                                                                                                               | 6.1 MB  00:00:00
Updates Information Summary: updates
    17 Security notice(s)
         7 Important Security notice(s)
         6 Moderate Security notice(s)
         4 Low Security notice(s)
updateinfo summary done

    List available security updates

    List available security updates:

    yum updateinfo list

    Sample output:

    Alibaba Cloud Linux 3

    Last metadata expiration check: 0:09:05 ago on Wed 02 Jun 2021 03:05:30 AM EDT.
ALINUX3-SA-2021:0008 Moderate/Sec.  gnutls-3.6.14-7.1.al8.x86_64
ALINUX3-SA-2021:0029 Important/Sec. gnutls-3.6.14-8.1.al8.x86_64
ALINUX3-SA-2021:0028 Important/Sec. libldb-2.1.3-3.1.al8.x86_64
ALINUX3-SA-2021:0029 Important/Sec. nettle-3.4.1-4.1.al8.x86_64

    Alibaba Cloud Linux 2

    Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
ALINUX2-SA-2019:0055 Moderate/Sec.  binutils-2.27-41.base.1.al7.x86_64
ALINUX2-SA-2019:0058 Low/Sec.       curl-7.29.0-54.1.al7.x86_64
ALINUX2-SA-2019:0059 Low/Sec.       elfutils-default-yama-scope-0.176-2.1.al7.n
...

    View security update details

    View details of a specific advisory. Replace <update_id> with an advisory ID:

    yum updateinfo info <update_id>

    Alibaba Cloud Linux 3

    The following example queries the advisory ALINUX3-SA-2021:0008:

    yum updateinfo info ALINUX3-SA-2021:0008

    Sample output:

    Last metadata expiration check: 0:11:58 ago on Wed 02 Jun 2021 03:05:30 AM EDT.
===============================================================================
  ALINUX3-SA-2021:0008: gnutls security and bug fix update (Moderate)
===============================================================================
  Update ID: ALINUX3-SA-2021:0008
       Type: security
    Updated: 1969-12-31 19:00:00
       CVEs: CVE-2020-24659
Description: Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:
           :
           : CVE-2020-24659:
           : An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit function is called after detecting a handshake failure.
           :
   Severity: Moderate

    Alibaba Cloud Linux 2

    The following example queries the advisory ALINUX2-SA-2020:0005:

    yum updateinfo info ALINUX2-SA-2020:0005

    Sample output:

    Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile

===============================================================================
  ALINUX2-SA-2020:0005: nss, nss-softokn, nss-util security update (Important)
===============================================================================
  Update ID : ALINUX2-SA-2020:0005
    Release : Alibaba Cloud Linux 2.1903
       Type : security
     Status : stable
     Issued : 2020-01-03
       CVEs : CVE-2019-11729
            : CVE-2019-11745
Description : Package updates are available for Alibaba Cloud Linux 2.1903 that fix
            : the following vulnerabilities:
            :
            : CVE-2019-11729:
            : Empty or malformed p256-ECDH public keys may
            : trigger a segmentation fault due values being
            : improperly sanitized before being copied into
            : memory and used. This vulnerability affects
            : Firefox ESR < 60.8, Firefox < 68, and Thunderbird
            : < 60.8.
            :
            : CVE-2019-11745:
            : When encrypting with a block cipher, if a call to
            : NSC_EncryptUpdate was made with data smaller than
            : the block size, a small out of bounds write could
            : occur. This could have caused heap corruption and
            : a potentially exploitable crash. This
            : vulnerability affects Thunderbird < 68.3, Firefox
            : ESR < 68.3, and Firefox < 71.
            :
   Severity : Important
updateinfo info done

    Filter security updates by severity level

    List security updates of the Moderate severity level:

    yum updateinfo list --sec-severity=Moderate

    Sample output:

    Last metadata expiration check: 0:05:25 ago on Mon 07 Jun 2021 09:08:25 AM EDT.
ALINUX3-SA-2021:0008 Moderate/Sec. gnutls-3.6.14-7.1.al8.x86_64

    Check for security updates

    The update-motd service is installed and enabled by default on Alibaba Cloud Linux and notifies you of available security updates at login. Control the update-motd service with Manage the update-motd service.

    Run yum check-update --security to check for available security updates. Append --sec-severity=<SEVS> to filter by severity, where <SEVS> is one or more severity levels.

    Note

    If you specify multiple severity levels, separate them with commas (,). Severity levels are case-sensitive.

    Alibaba Cloud Linux 3

    Example 1: Check for all security updates:

    yum check-update --security

    Sample output:

    Last metadata expiration check: 0:08:41 ago on Wed 02 Jun 2021 05:24:55 PM CST.

nss.x86_64                        3.53.1-17.1.al8                 alinux3-updates
nss-softokn.x86_64                3.53.1-17.1.al8                 alinux3-updates
nss-softokn-freebl.x86_64         3.53.1-17.1.al8                 alinux3-updates
nss-sysinit.x86_64                3.53.1-17.1.al8                 alinux3-updates
nss-util.x86_64                   3.53.1-17.1.al8                 alinux3-updates
perl-Errno.x86_64                 1.28-417.2.al8                  alinux3-updates
perl-IO.x86_64                    1.38-417.2.al8                  alinux3-updates

    Example 2: Check for security updates with Critical and Important severity levels:

    yum check-update --security  --sec-severity={Critical,Important}

    Sample output:

    Last metadata expiration check: 0:10:23 ago on Wed 02 Jun 2021 05:24:55 PM CST.

gnutls.x86_64                      3.6.14-8.2.al8              alinux3-updates
nss.x86_64                         3.53.1-17.1.al8             alinux3-updates
nss-softokn.x86_64                 3.53.1-17.1.al8             alinux3-updates
nss-softokn-freebl.x86_64          3.53.1-17.1.al8             alinux3-updates
nss-sysinit.x86_64                 3.53.1-17.1.al8             alinux3-updates
nss-util.x86_64                    3.53.1-17.1.al8             alinux3-updates
perl-Errno.x86_64                  1.28-417.2.al8              alinux3-updates
perl-IO.x86_64                     1.38-417.2.al8              alinux3-updates

    Alibaba Cloud Linux 2

    Example 1: Check for all security updates:

    yum check-update --security |grep available

    Sample output:

    49 package(s) needed for security, out of 183 available

    Example 2: Check for security updates with Critical and Important severity levels:

    yum check-update --security --sec-severity=Critical,Important |grep available

    Sample output:

    30 package(s) needed for security, out of 183 available

    Install security updates

    Run yum upgrade to install security updates. You can filter by severity level or CVE ID.

    Warning

    yum upgrade forcefully removes outdated packages except kernel packages. This may stop your instance and interrupt running services. Install security updates during off-peak hours.

    Install by severity level

    Run yum upgrade --security to install security updates. Append --sec-severity=<SEVS> to filter by severity level.

    Note

    If you specify multiple severity levels, separate them with commas (,). Severity levels are case-sensitive.

    Install Critical and Important severity updates:

    sudo yum upgrade --security --sec-severity={Critical,Important}

    Sample output:

    Alibaba Cloud Linux 3

    Last metadata expiration check: 0:06:43 ago on Wed 02 Jun 2021 03:51:48 AM EDT.
Dependencies resolved.
================================================================================
 Package              Arch       Version              Repository           Size
================================================================================
Upgrading:
...
Transaction Summary
================================================================================
Upgrade  12 Packages

Total download size: 3.9 M
Is this ok [y/N]:

    Alibaba Cloud Linux 2

    Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
...
[snipped]
...
Transaction Summary
=============================================================================================================================================================================
Upgrade  30 Packages (+1 Dependent package)

Total download size: 91 M
Is this ok [y/d/N]:

    Install by CVE ID

    Run yum upgrade --cve=<CVE ID> to install updates for specific CVEs. Specify one or more CVE IDs.

    Note

    If you specify multiple CVE IDs, separate them with commas (,). CVE IDs are case-sensitive.

    Alibaba Cloud Linux 3

    Install the update for CVE-2020-24659:

    sudo yum upgrade --cve=CVE-2020-24659

    Sample output:

    Last metadata expiration check: 0:02:44 ago on Wed 02 Jun 2021 04:17:27 AM EDT.
Dependencies resolved.
=====================================================================================
 Package        Architecture   Version                 Repository               Size
=====================================================================================
Upgrading:
...
Transaction Summary
=====================================================================================
Upgrade  1 Package

Total download size: 1.0 M
Is this ok [y/N]

    Alibaba Cloud Linux 2

    Install updates for CVE-2019-11729 and CVE-2019-11745:

    sudo yum upgrade --cve=CVE-2019-11729,CVE-2019-11745

    Sample output:

    Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
...
[snipped]
...
Dependencies Resolved

=============================================================================================================================================================================
 Package                                         Arch                                Version                                      Repository                            Size
=============================================================================================================================================================================
Updating:
 nss                                             x86_64                              3.44.0-7.1.al7                               updates                              854 k
 nss-softokn                                     x86_64                              3.44.0-8.1.al7                               updates                              330 k
 nss-softokn-freebl                              x86_64                              3.44.0-8.1.al7                               updates                              225 k
 nss-sysinit                                     x86_64                              3.44.0-7.1.al7                               updates                               65 k
 nss-tools                                       x86_64                              3.44.0-7.1.al7                               updates                              528 k
 nss-util                                        x86_64                              3.44.0-4.1.al7                               updates                               79 k
Updating for dependencies:
 nspr                                            x86_64                              4.21.0-1.1.al7                               updates                              127 k

Transaction Summary
=============================================================================================================================================================================
Upgrade  6 Packages (+1 Dependent package)

Total download size: 2.2 M
Is this ok [y/d/N]:
    Note

    Per man yum, sudo yum upgrade is equivalent to sudo yum update --obsoletes. Because obsoletes is enabled by default in /etc/yum.conf, sudo yum upgrade is also equivalent to sudo yum update.

    Manage the update-motd service

    Manage the update-motd service with systemctl:

    Action Command
    Start the service sudo systemctl start update-motd
    Stop the service sudo systemctl stop update-motd
    Restart the service sudo systemctl restart update-motd
    Check the service status systemctl status update-motd