Openshift unsecure versions of Apache httpd [closed]

Question

Closed. This question needs details or clarity. It is not currently accepting answers.

---

Want to improve this question? Add details and clarify the problem by editing this post.

Closed 9 years ago.

Improve this question

I am evaluating Openshift Online PaaS and found that Openahift Online is using quite old versions of libraries, which might bring issues.

Eg. Apache httpd - version 2.2.15 as of today (2014-04-27) vs published 2.2.27 with several SECURITY fixes in changelog

Can Redhat explain the difference?

Concrete issue for python cartridge and connectivity to PostgreSQL: psycopg2 - Openshift default is the older 2.0.4 version throwing errors, while the newest one is ==2.5.2

Answer 1

OpenShift Online runs based on RHEL 6, and the versions there need a little explanation. RHEL is based on the premise that if you run something on RHEL 6.0 GA, it should still run after years of updates to RHEL 6. There are still updates, but the version indicates where the original fork of the code was done. New features are introduced (only if they break nothing old), and security patches are added, but these are done with changes to the release number, not the version. If you look for security advisories from Red Hat, you will see this in action, e.g. https://rhn.redhat.com/errata/RHSA-2014-0370.html. It can be confusing to determine exactly what features are included; for instance RHEL 5 ships httpd 2.2.3, but includes a bunch of mod_proxy features that didn't land until 2.2.9 or later.

Recently, Red Hat, in recognition that people don't necessarily want to develop against years-old solutions, has begun supplying updated versions in completely separate packages as Software Collections Libraries (SCLs). For example, the postgresql that ships with RHEL 6 is version 8.4, but an SCL has been shipped with postgresql 9.2 (OpenShift Online supplies a cartridge for both). An SCL for httpd 2.4 should be coming soon.

Point is, the apparent version can be a little deceiving on RHEL; it basically indicates "compatible with behavior back to this version." To get to the root of your real problem, it's probably best to specify what you're doing and the actual errors you got.