When installing Percona XtraDB Cluster 8.0.x or 8.4.x on RHEL8 via YUM, it appears that the percona-xtradb-cluster-server packages has a yum dependency on the compat-openssl10 package.

On a RHEL8.10 subscribed server, for example, this will install compat-openssl10-1:1.0.2o-4.el8_6.x86_64 from the rhel-8-for-x86_64-appstream-rpms redhat repo which lays down some old 1.0.2 ssl libs e.g:

…and these will typically get flagged by vulnerability scanners now.

I know you guys did a bunch of good work recently to remove all the old bundled ssl libs from your tarball releases of PXC and PXB on el8 as per my earlier tickets and

Can this compat-openssl10 dependency be reviewed for el8 and removed if possible please for future releases.

Note that we generally advise our third parties to forcibly remove the package after PXC install using:

…which does not appear to cause any problems for our/their usage of PXC but this obviously operates outside of YUM and the package will come back if upgrading to a newer version of PXC.