My trust in RedHat went down when I learned they are not shipping all the SRPMs. Some say it is due to human error. If that is the case, why should I think they are better at backporting security fixes than at making sure a manifest of SRPMs is complete and correct?
Centos, SL and oracle enterprise linux are based on redhat.
Maybe you should start paying for SLES?
-- Eero