OL 9 must not install packages from the Extra Packages for Enterprise Linux (EPEL) repository.

STIG ID: OL09-00-000105  |  SRG: SRG-OS-000095-GPOS-00049 |  Severity: medium (CAT II)  |  CCI: CCI-000381 |  Vulnerability Id: V-271457

Vulnerability Discussion

The EPEL is a repository of high-quality open-source packages for enterprise-class Linux distributions such as RHEL, CentOS, AlmaLinux, Rocky Linux, and Oracle Linux. These packages are not part of the official distribution but are built using the same Fedora build system to ensure compatibility and maintain quality standards.

Check

Verify that OL 9 is not able to install packages from the EPEL with the following command:

$ dnf repolist
repo id repo name
ol9_UEKR7 Oracle Linux 9 UEK Release 7 (x86_64)
ol9_appstream Oracle Linux 9 Application Stream Packages (x86_64)
ol9_baseos_latest Oracle Linux 9 BaseOS Latest (x86_64)
ol9_oraclelinuxmanager210_client Oracle Linux Manager Client 2.10 for Oracle Linux 9 (x86_64)

If any repositories containing the word "epel" in the name exist, this is a finding.

Fix

Configure OL 9 to not be able to install packages from the EPEL.

Search for and remove any/all packages that came from the EPEL repo:

$ dnf repository-packages ol9_developer_EPEL remove

Remove the package that installs access to the EPEL repo:

$ dnf remove oracle-epel-release-el9
This website is not created by, run, approved, or endorsed by the U.S. Department of Defense. Use at your own risk. This website is created by open-source software.