Hi Tiffany,

A couple of things first

It’s really important to understand how enterprise-level hosting works.
Just some context for folks who aren’t aware of how Enterprise Linux works.

This sounds like we are going to descend into an appeal to authority, certainly has sniff of it...

Many of us are also well acquainted with the technical aspects behind this level of hosting, and some of us even provide environments that regularly receive Top-Tier in the Review Signal WP Hosting Benchmarks.

But since you chose to focus on this, let us expand that a little, to give a wider context.

Enterprise level hosting plans are also the biggest ticket hosting plans that a hosting company sells. Anyone who works within this industry also understands that it is also the highest margin plan. Let's keep that in mind as we unpack your reply.

Prior to this we weren't really focusing on a single sector of (Enterprise), but we can because that just leads to some more interesting questions.

It’s a lot easier (and better for customers) to mitigate things like older packages needing patches than it is to mitigate the instability inherent to the latest-and-greatest.

This is a fantastic combination of a straw man and a false dichotomy, outstanding effort!

No one spoke of the latest and greatest.

CentOS 7 and RHEL 7 are in their dying throws.

But since you speak of Enterprise Linux RHEL 8 was released over 4 years ago, with 8.1 (4 years) and 8.2 (3.5) released shortly after. Since then there have been multiple multiple versions...

And RHEL 9 was released a year and a half ago with 9.1 a year ago, and two more releases since then.

However, the one of the benefits of Enterprise Linux distros is, among other things, active support for and backported patches to those packages. Just because a package version is no longer being patched by its own maintainers doesn’t mean it isn’t being patched at all

From the bug ticket, it was not just cURL 7.29 that was affected, all versions prior to 7.45 were (any version that did not default to http2).

cURL 7.45 is still ancient, but what is of note is that 7.29 is the package that CentOS and RHEL7 come with, and yes these are long term support environments, but they are so close to complete EOL, and even though you say they are still supported with patches we can see that they are not really/fully supported.

Now with CentOS 7, and the people hosting on this non-enterprise Linux distro. In may ways I do understand their plight... They were dumped on by RedHat from a great height, they have nowhere to go... for those unaware the project was killed, and the follow up version centOS 8 actually EOLed in December 2021 almost 2 years ago. They have a tough choice, where to go, what to do, especially those using CloudLinux, given its currently in Beta.

However, it is 3 years since CentOS accounced they would discontinue CentOS... three years is a long time to get yourself together and get a plan in action, and leaving it to the last 6-8 months is a poor management.

For those smaller outfits, its especially tough... but for massive hosting companies with entire teams, massive hosting companies that sell... checks notes... Enterprise Level high margin plans... it could be considered a dereliction of duty. CentOS supposedly is receiving updates, but we can see from the comment below that the cURL package for CentOS has had 0 updates/patches in the past 2 years, despite multiple vulnerabilities since then.

But you spoke of Enterprise Linux, so that is not your point.

RHEL7 (Enterprise Linux) and CentOS (Community Linux) have a shared codebase, but maybe things are different for RHEL 7 - the common enterprise level hosting environment that may be using this version of cURL 7.29?

Here are some of the CVE's that came up in a quick search for RHEL 7 cURL 7.29 that they have deemed out of support scope or won't fix in maintenance phase 2:

https://www.cve.org/CVERecord?id=CVE-2023-27535
https://access.redhat.com/security/cve/cve-2023-27535

https://www.cve.org/CVERecord?id=CVE-2022-35252
https://access.redhat.com/security/cve/cve-2022-35252

https://www.cve.org/CVERecord?id=CVE-2022-43552
https://access.redhat.com/security/cve/cve-2022-43552

I stopped there, but I am sure there are more for many more packages.

And here are their words re this phase of support:

"During the ... Maintenance Support 2 Phase for Red Hat Enterprise Linux version 7, Red Hat defined Critical and Importantix impact Security Advisories (RHSAs) and selected (at Red Hat discretion) Urgent Priority Bug Fix Advisories (RHBAs) will be released as they become available."

So they define what is Critial and Important, and only provide backports for those fixes.

Now people can argue about severity, but even medium severity flaws can by their own admission be escalated to critical, and at scale the chances of this happening increase with scale.

Furthermore this clearly shows that they do not want to patch things unless they absolutely have to... they want you to upgrade to RHEL 8/9... because... profit (of course).

So when you speak of these things being maintained and things being backported, either that is very selective or are you suggesting to have people on your team doing this? Because as we know this is very difficult, and many hosting panels are unable to support servers with packages from outside the distro repositories.

But if companies have the resources to fill the gap where RHEL is failing them, then surely they could have migrated to a more modern version of RHEL, there are several available that are stable and not "the latest and greatest"?

So the question has to be asked, with regards to these enterprise level environments where there was a newer supported OS, why have these companies not migrated sites from RHEL 7 servers to RHEL 8.x or 9.x servers?

Everyone should remember, these are the most profitable hosting plans with the highest margins, those that the providers swell in interviews about providing resources for dynamic workloads, yet within a ten year cycle you can't migrate them from a nearing end of life poorly maintained Enterprise Linux Distro to an available and more modern and currently maintained distro within an appropriate timeframe?

Maybe there is an excuse for your big box low margin hosting, I mean what can people expect for your $5 a month plan?

But your $273 a month plan, surely that pays for a simple migration?

Why not? It's only a management problem, done properly there should be little downtime to users.

Perhaps the answer is simple?

Profit, hitting targets, milking customers, and keeping investors happy.