AWS linux medium security documentation change
Summary
Updated advisory timestamp terminology and clarified release/update date definitions for security advisories
Security assessment
The changes clarify the timing of security updates availability and advisory updates, directly impacting how users track vulnerability patching. Specific security context includes references to security advisories, CVE associations, and repository update synchronization.
Diff
diff --git a/linux/al2023/ug/alas.md b/linux/al2023/ug/alas.md index a6a588cbc..44a76a5a3 100644 --- a//linux/al2023/ug/alas.md +++ b//linux/al2023/ug/alas.md @@ -5 +5 @@ -ALAS AnnouncementsALAS FAQsALAS AdvisoriesAdvisories and RPM repositoriesAdvisory IDsAdvisory Creation and Update timestampsAdvisory TypesAdvisory SeveritiesAdvisories and PackagesAdvisories and CVEsAdvisory TextKernel Live Patch Advisoriesupdateinfo.xml schema +ALAS AnnouncementsALAS FAQsALAS AdvisoriesAdvisories and RPM repositoriesAdvisory IDsAdvisory Released Date and Advisory Updated DateAdvisory TypesAdvisory SeveritiesAdvisories and PackagesAdvisories and CVEsAdvisory TextKernel Live Patch Advisoriesupdateinfo.xml schema @@ -57 +57 @@ As AL2023 does not use the Extras mechanism to package alternate versions of pac -## Advisory Creation and Update timestamps +## Advisory Released Date and Advisory Updated Date @@ -59 +59 @@ As AL2023 does not use the Extras mechanism to package alternate versions of pac -The creation timestamp for Amazon Linux Advisories will typically be close to when the Advisory was published, but this is not universally the case. The update timestamp is similar, and the package repositories and [Amazon Linux Security Center](https://alas.aws.amazon.com/alas2.html) web site may not be updated in sync as new information is available. +The Advisory Released Date for Amazon Linux Advisories indicates when the security update was first made publicly available in the RPM repository. Advisories are posted on the [Amazon Linux Security Center](https://alas.aws.amazon.com/alas2023.html) web site immediately after fixes are made available for installation through the RPM repository. @@ -61 +61 @@ The creation timestamp for Amazon Linux Advisories will typically be close to wh -A (relatively) common case where Advisory timestamps may not exactly match when the Advisory is issued is where there was a longer gap between the Advisories and RPM repository content being prepared and when they were made live. +The Advisory Updated Date indicates when new information was added to an advisory after it was previously published. @@ -63 +63 @@ A (relatively) common case where Advisory timestamps may not exactly match when -There should not be any assumptions made between the AL2023 version number (e.g. 2023.6.20241031) and the creation/update timestamps of Advisories published alongside that release. +There should not be any assumptions made between the AL2023 version number (e.g. 2023.6.20241031) and the Advisory Released Date of Advisories published alongside that release.