[quote="janorel, post:22, topic:34042"]
What is the frequency of the CVE security patches on average?
[/quote]
In this [blog post](https://ubuntu.com/blog/securing-open-source-through-cve-prioritisation) you can find detailed information. But to summarize, the Ubuntu security team is triaging, fixing and releasing updated software packages for known vulnerabilities every day. On average, the team is providing more than 3 updates each day, and the most vital updates are prepared, tested and released within 24 hours.
[quote="janorel, post:22, topic:34042"]
What is the time difference between security patches between PRO and upstream?
[/quote]
It will depend on the CVE priority. As stated above, critical vulnerabilities are released within 24 hours. Then, on average, high CVEs are patched within 30 days, and medium CVEs within 60 days since they are known to the Ubuntu Security Team. This criteria applies to every package affected by the vulnerability, across every Ubuntu release actively supported.
In general, preparing a security update requires not only a proper understanding of the security issue and its impact on the package(s), but also a great engineering effort to make sure that the issue is fixed and no regressions are introduced. Please note that the security team might need to backport the upstream fixes/patches to older versions of the vulnerable software as they are present in the different affected Ubuntu releases.
In this [wiki](https://wiki.ubuntu.com/SecurityTeam/#Vulnerabilities) you can find more details about the processes and tools involved in preparing, testing and releasing security updates. Also, please note that packages which have autopkgtest enabled will have their tests run [automatically](https://packaging.ubuntu.com/html/auto-pkg-test.html) on the Ubuntu infrastructure whenever they get updated or any of their dependencies change. This means any other package that depends on the one being updated, will also have their tests run every time security engineers release a security update.
These strong building and testing processes and infrastructure, contribute to make Ubuntu as one of the most robust and secure Operating Systems.