Dear All,

I received an email from our security engineer to apply security patches to our Red Hat Linux 7.5 server. We are not paying for it and running an application on it.

That article mentions a link to apply patches which is as below:
I saw many patches with a severity level of Crtical to Moderate.

How do we apply the security patches?? I cannot find any link to download those patches on the website.

Is it necessary to have a subscription to download those patches? And what affect can it have on the running application? Is it appropriate to apply the patch in production environment??

I would be glad for your advices and suggestions.

if you are not paying for it you won't be able to download it.
The critical patches are really required, but I would say all of them are "appropriate".

They are in a special repo (repository) that you only have access to when you are on a support contract (that is: you're paying for it) and they're normal rpm files there.
Without support you will have to do the whole work yourself: that is: find the patch, apply it on the source, REcompile that source and make it into an rpm to UPdate the installed one.

(Bolded/underlined a part above for emphasis only)

You've been given this advice numerous times in the past, and have been told plainly that unless you PAY FOR RHEL, you won't get updates/patches/fixes, period. This is nothing you've not been told before. Again, if you're using RHEL, pay for it, and you can run a simple yum command to get all the patches and updates. You don't get those things unless you pay for it.

If you're not going to pay for RHEL, there's no point in using it...load CentOS instead, and get your administrator to do their job properly.

Thank you for your response. I will make sure we go for subscription.

Thank you. I must get a support contract from Red Hat as there are some critical applications running on the server. If I find a patch myself and apply it, it may cause some problems in the OS I feel. Directly downloading from official Red Hat repos may cause less problems I believe.

You've said that several times in the past, but don't seem to have done it.
Again, as you've been told before, running RHEL without paying for it is pointless. Even *IF* you manage to get and apply the current patches, you STILL won't get the future patches, and be right back where you started.

This isn't new information for you; pay for Oracle and RHEL if you're going to use them in a production setting. If you're NOT, then load up CentOS and MySQL.