Should I be concerned that Paladin Shield is claiming upgraded Ubuntu LTS servers have critical vulnerabilities?

Question

Cyber insurance companies are offering a substantial discount if you sign up for "free" Paladin Shield cyber security services, and because of this, management leans heavily on the vulnerabilities they report.

Many of my clients are maintained with currently supported LTS Ubuntu servers (i.e. 20.04 LTS and 22.04 LTS). They are updated and upgraded regularly and are currently showing that "0 updates can be applied". At the same time, Paladin Shield is reporting the same servers have vulnerabilities that need corrective action:

10 critical vulnerabilities

CORRECTIVE ACTION
Urgently apply software updates

NOTES
CVE-2022-22720 Severity: 9.8
CVE-2022-31813 Severity: 9.8
CVE-2022-23943 Severity: 9.8
CVE-2021-44790 Severity: 9.8
CVE-2021-26691 Severity: 9.8
CVE-2021-39275 Severity: 9.8
CVE-2020-11984 Severity: 9.8
CVE-2022-22721 Severity: 9.1
CVE-2022-28615 Severity: 9.1
CVE-2021-40438 Severity: 9

ISSUE
13 high vulnerabilities

CORRECTIVE ACTION
Apply software updates

NOTES
CVE-2021-44224 Severity: 8.2
CVE-2021-34798 Severity: 7.5
CVE-2022-29404 Severity: 7.5
CVE-2020-11993 Severity: 7.5
CVE-2022-22719 Severity: 7.5
CVE-2020-9490 Severity: 7.5
CVE-2021-26690 Severity: 7.5
CVE-2022-26377 Severity: 7.5
CVE-2022-30556 Severity: 7.5
CVE-2021-33193 Severity: 7.5
CVE-2021-36160 Severity: 7.5
CVE-2020-13950 Severity: 7.5
CVE-2020-35452 Severity: 7.3

ISSUE
6 medium vulnerabilities

CORRECTIVE ACTION
Review findings

NOTES
CVE-2020-1927 Severity: 6.1
CVE-2020-13938 Severity: 5.5
CVE-2020-1934 Severity: 5.3
CVE-2022-28330 Severity: 5.3
CVE-2019-17567 Severity: 5.3
CVE-2022-28614 Severity: 5.3

Here is the version of Apache on 22.04:

dpkg -s apache2 | grep Version
Version: 2.4.52-1ubuntu4.2

Is it that Ubuntu LTS is not maintained up to date or is Paladin Shield crying wolf?

I realize that Paladin Shield has been described as "snake oil" (1). Any suggestions on cyber security best practices in this situation would be most appreciated.

(1) https://www.zdnet.com/article/paladin-security-app-snake-oil-security-experts-say/

Answer 1

The Ubuntu Security Team maintains a CVE Tracker so you can check for yourself if any of those hits are accurate.

Let's pick a CVE from your list at random: CVE-2022-26377

And the CVE tracker leads us to this:

---

---

There's the package name. Oh, look, that CVE has been fixed for a long time. There's the package version for each supported release of Ubuntu.

Simply ask apt what version you have installed: apt list <packagename>.

• If your version number is equal or higher than the patched version, then you're already secure. On a well-run, well-maintained system, this is the usual state. CVE patches are installed automatically. That's one reason folks choose Ubuntu.
• If your version number is lower than the patched version, then you have real problems to fix. Once you have the underlying problems fixed, security updates will flow automatically.

Answer 2

Paladin is snake oil. In your case, the reason the scanner is wrong is that it's only looking at the main part of the Apache version number (2.4.52) and comparing that to the Apache version in which the vulnerabilities were fixed upstream (varies; e.g., 2.4.53 for CVE-2022-23943). It completely ignores the distribution's patch suffix (-1ubuntu4.2 for you, and -1ubuntu2 when CVE-2022-23943 was first fixed). In addition, it's also lying about the severity of the vulnerabilities. Sticking with CVE-2022-23943 as the example, Paladin claimed it was critical, but the Apache maintainers and the Ubuntu security team both disagree.