Security updates and CVE response · Linux

Security updates arrive continuously; the discipline is to receive them quickly, test them, and deploy them in waves. A host that misses a year of security patches is a host that will be compromised.

Unattended upgrades (Debian-family)

Read-only / Safeunattended-upgrades config— 50unattended-upgrades declares which packages receive automatic upgrades (the security origin by default), when to run, and whether to reboot. Origins-Pattern limits unattended upgrades to security; everything else waits for manual review.

$ cat /etc/apt/apt.conf.d/50unattended-upgrades | head -30

Unattended-Upgrade::Origins-Pattern (config contents snipped)

Unattended-Upgrade Package-Blacklist is empty

Unattended-Upgrade::DevRelease false
Unattended-Upgrade::AutoFixInterruptedDpkg true
Unattended-Upgrade::MinimalSteps true
Unattended-Upgrade::InstallOnShutdown false
Unattended-Upgrade::Remove-Unused-Kernel-Packages true
Unattended-Upgrade::Remove-New-Unused-Dependencies true
Unattended-Upgrade::Remove-Unused-Dependencies false
Unattended-Upgrade::Automatic-Reboot false
Unattended-Upgrade::Automatic-Reboot-Time 02:00

Illustrative output

Configuration changedry-run— unattended-upgrade --dry-run shows what would be installed without actually installing. --debug produces verbose output. Use this to verify the configuration picks up the packages you expect.

$ sudo unattended-upgrade --dry-run --debug

...

Illustrative output

dnf-automatic (RHEL-family)

Read-only / Safednf-automatic— dnf-automatic.conf configures the dnf-automatic timer. upgrade_type=security limits automatic upgrades to security updates. apply_updates=yes applies them; download_updates=yes downloads without applying. emit_via=email sends notifications of what was applied.

$ cat /etc/dnf/automatic.conf | head -20

[commands]
upgrade_type = security
apply_updates = yes
download_updates = yes
random_sleep = 300

[emitters]
emit_via = email

[email]
email_from = root@example.com
email_to = admin@example.com
...

Illustrative output

Configuration changeenable dnf-automatic— Enable the dnf-automatic timer; the timer runs once a day and applies security updates. list-timers shows the next scheduled run. The default timer uses RandomizedDelaySec to spread fleet-wide upgrades across a window.

$ sudo systemctl enable --now dnf-automatic.timer; sudo systemctl list-timers dnf-automatic*

...

Illustrative output

CVE response workflow

For a CVE that affects your fleet:

Identify — read the CVE; confirm the host is affected (the package is installed and the vulnerable code path is reachable)
Assess — CVSS score is a hint, not a verdict. A CVSS 9.0 in an unused code path may be deferred; a CVSS 6.0 in an exposed service is urgent
Test — apply the patch to a clone host or a single canary host; run smoke tests; check for regressions
Deploy — staged rollout: dev → canary → production wave 1 → production wave 2
Verify — confirm the new package version is installed on every host; confirm the vulnerable code path is gone
Document — what was affected, what the timeline was, what worked, what did not

Auditing the fleet for missed updates

Read-only / Safefleet audit— Use configuration management to query every host for the count of upgradable packages. A host with a non-zero count has missed updates. Investigate why unattended-upgrades / dnf-automatic is not catching them.

$ ansible all -m shell -a 'apt list --upgradable 2>/dev/null | wc -l' 2>/dev/null

...

Illustrative output

Unattended upgrades (Debian-family)

dnf-automatic (RHEL-family)

CVE response workflow

Auditing the fleet for missed updates

Knowledge check