Further review of the prelude packages turned up one more package that has a configuration file that would contain the SQL database account and password - which is world readable. The ramifications of not updating the package is that an attacker could erase intrusion events from the database. The fix for this package was to add some explicit %attr tags to the files section of the spec file - no code was changed.