Security updates

What it inspects

Pending updates, using the first tool that answers: /usr/lib/update-notifier/apt-check (Ubuntu), a simulated `apt-get upgrade`, `apt list --upgradable`, then `dnf updateinfo list security` with `dnf check-update` (RHEL family). On RHEL an advisory counts only if `dnf check-update` would upgrade its package, so advisories for older installed kernels (kept side by side until removed) are not counted. It counts security updates: none passes, 1 to 5 warns, 6 or more fails. If none of these tools gives usable output, the check is skipped.

Why it matters

Security updates fix vulnerabilities that are already public, which is exactly when automated attacks start. Each week an update stays pending is a week the known hole is open. Installing them promptly closes that window; the pending-count is the simplest measure of how far behind a server is.

How to verify

# Debian/Ubuntu:
apt list --upgradable 2>/dev/null | grep -i security
# RHEL family (packages with a pending security update; empty output = none):
dnf -q check-update --security

How to fix

Install the security updates (unattended-upgrade on Debian/Ubuntu, `dnf upgrade --security` on the RHEL family), then restart affected services or reboot.

# Installs only the updates that come from the security archives (unattended-upgrades' default origins).
apt-get update
apt-get install -y unattended-upgrades
unattended-upgrade -v
# Counted as pending: /usr/lib/update-notifier/apt-check on Ubuntu, otherwise a simulated `apt-get upgrade`.
apt list --upgradable 2>/dev/null

# Installs only the updates that dnf marks as security advisories.
dnf -y upgrade --security
# Lists what is still pending (empty output = done). `dnf updateinfo list security` also lists
# advisories for older installed kernels, which stay until they are removed; ignore those.
dnf -q check-update --security || true

References

• apt-get(8) manual page
• Debian wiki: UnattendedUpgrades