Security updates

What it inspects

Looks for this finding: Security updates are waiting to be installed. Pending updates, using the first tool that answers: /usr/lib/update-notifier/apt-check (Ubuntu), a simulated `apt-get upgrade`, `apt list --upgradable`, then `dnf updateinfo list --security` with `dnf check-update` (RHEL family). If the older `dnf updateinfo list security` form prints nothing while `dnf check-update` reports pending updates (dnf5), the check is skipped rather than passed. On RHEL an advisory counts only if `dnf check-update` would upgrade its package, so advisories for older installed kernels (kept side by side until removed) are not counted. It counts security updates: none passes, 1 to 5 warns, 6 or more fails. If none of these tools gives usable output, the check is skipped.

Why it matters

Finding: Security updates are waiting to be installed. Security updates fix vulnerabilities that are already public, which is exactly when automated attacks start. Each week an update stays pending is a week the known hole is open. Installing them promptly closes that window; the pending-count is the simplest measure of how far behind a server is.

How to verify

# Debian/Ubuntu:
apt list --upgradable 2>/dev/null | grep -i security
# RHEL family (packages with a pending security update; empty output = none):
dnf -q check-update --security

How to fix

Clears the finding "Security updates are waiting to be installed". Install the security updates (unattended-upgrade on Debian/Ubuntu, `dnf upgrade --security` on the RHEL family), then restart affected services or reboot.

# Installs only the updates that come from the security archives (unattended-upgrades' default origins).
apt-get update
apt-get install -y unattended-upgrades
unattended-upgrade -v
# Counted as pending: /usr/lib/update-notifier/apt-check on Ubuntu, otherwise a simulated `apt-get upgrade`.
apt list --upgradable 2>/dev/null

# Installs only the updates that dnf marks as security advisories.
dnf -y upgrade --security
# Lists what is still pending (empty output = done). `dnf updateinfo list security` also lists
# advisories for older installed kernels, which stay until they are removed; ignore those.
dnf -q check-update --security || true

References

• apt-get(8) manual page
• Debian wiki: UnattendedUpgrades