Cyber insurance companies are offering a substantial discount if you sign up for "free" Paladin Shield cyber security services, and because of this, management leans heavily on the vulnerabilities they report.

Many of my clients are maintained with currently supported LTS Ubuntu servers (i.e. 20.04 LTS and 22.04 LTS). They are updated and upgraded regularly and are currently showing that "0 updates can be applied". At the same time, Paladin Shield is reporting the same servers have vulnerabilities that need corrective action:

10 critical vulnerabilities

Urgently apply software updates

CVE-2022-22720 Severity: 9.8
CVE-2022-31813 Severity: 9.8
CVE-2022-23943 Severity: 9.8
CVE-2021-44790 Severity: 9.8
CVE-2021-26691 Severity: 9.8
CVE-2021-39275 Severity: 9.8
CVE-2020-11984 Severity: 9.8
CVE-2022-22721 Severity: 9.1
CVE-2022-28615 Severity: 9.1
CVE-2021-40438 Severity: 9

13 high vulnerabilities

Apply software updates

CVE-2021-44224 Severity: 8.2
CVE-2021-34798 Severity: 7.5
CVE-2022-29404 Severity: 7.5
CVE-2020-11993 Severity: 7.5
CVE-2022-22719 Severity: 7.5
CVE-2020-9490 Severity: 7.5
CVE-2021-26690 Severity: 7.5
CVE-2022-26377 Severity: 7.5
CVE-2022-30556 Severity: 7.5
CVE-2021-33193 Severity: 7.5
CVE-2021-36160 Severity: 7.5
CVE-2020-13950 Severity: 7.5
CVE-2020-35452 Severity: 7.3

6 medium vulnerabilities

Review findings

CVE-2020-1927 Severity: 6.1
CVE-2020-13938 Severity: 5.5
CVE-2020-1934 Severity: 5.3
CVE-2022-28330 Severity: 5.3
CVE-2019-17567 Severity: 5.3
CVE-2022-28614 Severity: 5.3

Here is the version of Apache on 22.04:

dpkg -s apache2 | grep Version
Version: 2.4.52-1ubuntu4.2

Is it that Ubuntu LTS is not maintained up to date or is Paladin Shield crying wolf?

I realize that Paladin Shield has been described as "snake oil" (1). Any suggestions on cyber security best practices in this situation would be most appreciated.

(1) https://www.zdnet.com/article/paladin-security-app-snake-oil-security-experts-say/

  • Suggestion on security best practices: Listen to Ubuntu Security Podcast, episodes #152-155. An expert security engineer breaks it all down for you. Excellent free advice from an experienced professional.
    – user535733
    Dec 19, 2022 at 18:35

2 Answers 2


The Ubuntu Security Team maintains a CVE Tracker so you can check for yourself if any of those hits are accurate.

Let's pick a CVE from your list at random: CVE-2022-26377

And the CVE tracker leads us to this:

enter image description here

There's the package name. Oh, look, that CVE has been fixed for a long time. There's the package version for each supported release of Ubuntu.

Simply ask apt what version you have installed: apt list <packagename>.

  • If your version number is equal or higher than the patched version, then you're already secure. On a well-run, well-maintained system, this is the usual state. CVE patches are installed automatically. That's one reason folks choose Ubuntu.
  • If your version number is lower than the patched version, then you have real problems to fix. Once you have the underlying problems fixed, security updates will flow automatically.

Paladin is snake oil. In your case, the reason the scanner is wrong is that it's only looking at the main part of the Apache version number (2.4.52) and comparing that to the Apache version in which the vulnerabilities were fixed upstream (varies; e.g., 2.4.53 for CVE-2022-23943). It completely ignores the distribution's patch suffix (-1ubuntu4.2 for you, and -1ubuntu2 when CVE-2022-23943 was first fixed). In addition, it's also lying about the severity of the vulnerabilities. Sticking with CVE-2022-23943 as the example, Paladin claimed it was critical, but the Apache maintainers and the Ubuntu security team both disagree.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .