To install security updates automatically I use
$ sudo unattended-upgrade -d | tail -1 No packages found that can be upgraded unattended and no pending auto-removals
I also tried another tool called
debsecan (homepage, currently on official repos) to list all packages with any vulnerability of CVE database. On a recently updated Ubuntu 18.04 LTS it returns 967 "remotely exploitable, high urgency" vulnerabilities on 220 packages (7 times more in total):
$ debsecan | grep "remotely exploitable, high urgency" | wc -l 967 $ debsecan | grep "remotely exploitable, high urgency" | col2 | uniq | wc -l 220 $ debsecan | grep -o "CVE-20[0-2][0-9]" | sort | uniq -c 3 CVE-2007 11 CVE-2012 14 CVE-2013 9 CVE-2014 42 CVE-2015 214 CVE-2016 954 CVE-2017 3771 CVE-2018 4074 CVE-2019 1071 CVE-2020
- Am I missing something?
- There is any tool to check for vulnerabilities, maybe a debsecan for Ubuntu, like Red Hat's OpenSCAP. Any other beside OpenVAS or Nessus?
Answer from someone on Ubuntu Security Team:
In Ubuntu, landscape is the preferred solution for checking security update status.
We would certainly like for someone to contribute the modifications required to get debsecan working. Here is the bug about debsecan.
debsecanread this file:
curl -s https://security-tracker.debian.org/tracker/debsecan/release/1/GENERIC | zlib-flate -uncompress | less
Update 2020-05: UST2DSA
We've just finished a tool to build debsecan suitable databases from the Ubuntu CVE Tracker data.
It is open source under Apache 2.0 and it is available here: https://github.com/BBVA/ust2dsa
Using Github's CI we rebuild the databases every 6 hours for them to contain the latest vulnerability information.
If anybody want to test the result you just have to run this command in your current Ubuntu installation:
debsecan --suite $(lsb_release --codename --short) --source https://raw.githubusercontent.com/BBVA/ust2dsa/data/