{"created_at":"2023-03-29T20:21:46.498Z","post_id":87747,"previous_hidden":false,"current_hidden":false,"first_revision":2,"previous_revision":null,"current_revision":2,"next_revision":null,"last_revision":2,"current_version":2,"version_count":2,"username":"emitorino","display_username":"emitorino","acting_user_name":"Maria Emilia Torino","avatar_template":"/user_avatar/discourse.ubuntu.com/emitorino/{size}/12140_2.png","edit_reason":null,"body_changes":{"inline":"\u003cdiv class=\"inline-diff\"\u003e\u003caside class=\"quote no-group\" data-username=\"janorel\" data-post=\"22\" data-topic=\"34042\"\u003e\n\u003cdiv class=\"title\"\u003e\n\u003cdiv class=\"quote-controls\"\u003e\u003c/div\u003e\n\u003cimg loading=\"lazy\" alt=\"\" width=\"24\" height=\"24\" src=\"https://discourse.ubuntu.com/letter_avatar_proxy/v4/letter/j/ecd19e/48.png\" class=\"diff-ins avatar\"\u003e\u003cimg alt=\"\" width=\"20\" height=\"20\" src=\"https://discourse.ubuntu.com/letter_avatar/janorel/40/5_6d6f4cde2641c35611d5cac2fb97c77e.png\" class=\"diff-del avatar\"\u003e janorel:\u003c/div\u003e\n\u003cblockquote\u003e\n\u003cp\u003eWhat is the frequency of the CVE security patches on average?\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/aside\u003e\u003cp\u003eIn this \u003ca href=\"https://ubuntu.com/blog/securing-open-source-through-cve-prioritisation\" rel=\"noopener nofollow ugc\"\u003eblog post\u003c/a\u003e you can find detailed information. But to summarize, the Ubuntu security team is triaging, fixing and releasing updated software packages for known vulnerabilities every day. On average, the team is providing more than 3 updates each day, and the most vital updates are prepared, tested and released within 24 hours.\u003c/p\u003e\u003caside class=\"quote no-group\" data-username=\"janorel\" data-post=\"22\" data-topic=\"34042\"\u003e\n\u003cdiv class=\"title\"\u003e\n\u003cdiv class=\"quote-controls\"\u003e\u003c/div\u003e\n\u003cimg loading=\"lazy\" alt=\"\" width=\"24\" height=\"24\" src=\"https://discourse.ubuntu.com/letter_avatar_proxy/v4/letter/j/ecd19e/48.png\" class=\"diff-ins avatar\"\u003e\u003cimg alt=\"\" width=\"20\" height=\"20\" src=\"https://discourse.ubuntu.com/letter_avatar/janorel/40/5_6d6f4cde2641c35611d5cac2fb97c77e.png\" class=\"diff-del avatar\"\u003e janorel:\u003c/div\u003e\n\u003cblockquote\u003e\n\u003cp\u003eWhat is the time difference between security patches between PRO and upstream?\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/aside\u003e\u003cp\u003eIt will depend on the CVE priority. As stated above, critical vulnerabilities are released within 24 hours. Then, on average, high CVEs are patched within 30 days, and medium CVEs within 60 days since they are known to the Ubuntu Security Team. This criteria applies to every package affected by the vulnerability, across every Ubuntu release actively supported.\u003c/p\u003e\u003cp class=\"diff-ins\"\u003eIn general, preparing a security update requires not only a proper understanding of the security issue and its impact on the package(s), but also a great engineering effort to make sure that the issue is fixed and no regressions are introduced. Please note that the security team might need to backport the upstream fixes/patches to older versions of the vulnerable software as they are present in the different affected Ubuntu releases.\u003c/p\u003e\u003cp class=\"diff-ins\"\u003eIn this \u003ca href=\"https://wiki.ubuntu.com/SecurityTeam/#Vulnerabilities\" rel=\"noopener nofollow ugc\"\u003ewiki\u003c/a\u003e you can find more details about the processes and tools involved in preparing, testing and releasing security updates. Also, please note that packages which have autopkgtest enabled will have their tests run \u003ca href=\"https://packaging.ubuntu.com/html/auto-pkg-test.html\" rel=\"noopener nofollow ugc\"\u003eautomatically\u003c/a\u003e on the Ubuntu infrastructure whenever they get updated or any of their dependencies change. This means any other package that depends on the one being updated, will also have their tests run every time security engineers release a security update.\u003c/p\u003e\u003cp class=\"diff-ins\"\u003eThese strong building and testing processes and infrastructure, contribute to make Ubuntu as one of the most robust and secure Operating Systems.\u003c/p\u003e\u003c/div\u003e","side_by_side":"\u003cdiv class=\"revision-content\"\u003e\u003caside class=\"quote no-group\" data-username=\"janorel\" data-post=\"22\" data-topic=\"34042\"\u003e\n\u003cdiv class=\"title\"\u003e\n\u003cdiv class=\"quote-controls\"\u003e\u003c/div\u003e\n\u003cimg alt=\"\" width=\"20\" height=\"20\" src=\"https://discourse.ubuntu.com/letter_avatar/janorel/40/5_6d6f4cde2641c35611d5cac2fb97c77e.png\" class=\"diff-del avatar\"\u003e janorel:\u003c/div\u003e\n\u003cblockquote\u003e\n\u003cp\u003eWhat is the frequency of the CVE security patches on average?\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/aside\u003e\u003cp\u003eIn this \u003ca href=\"https://ubuntu.com/blog/securing-open-source-through-cve-prioritisation\" rel=\"noopener nofollow ugc\"\u003eblog post\u003c/a\u003e you can find detailed information. But to summarize, the Ubuntu security team is triaging, fixing and releasing updated software packages for known vulnerabilities every day. On average, the team is providing more than 3 updates each day, and the most vital updates are prepared, tested and released within 24 hours.\u003c/p\u003e\u003caside class=\"quote no-group\" data-username=\"janorel\" data-post=\"22\" data-topic=\"34042\"\u003e\n\u003cdiv class=\"title\"\u003e\n\u003cdiv class=\"quote-controls\"\u003e\u003c/div\u003e\n\u003cimg alt=\"\" width=\"20\" height=\"20\" src=\"https://discourse.ubuntu.com/letter_avatar/janorel/40/5_6d6f4cde2641c35611d5cac2fb97c77e.png\" class=\"diff-del avatar\"\u003e janorel:\u003c/div\u003e\n\u003cblockquote\u003e\n\u003cp\u003eWhat is the time difference between security patches between PRO and upstream?\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/aside\u003e\u003cp\u003eIt will depend on the CVE priority. As stated above, critical vulnerabilities are released within 24 hours. Then, on average, high CVEs are patched within 30 days, and medium CVEs within 60 days since they are known to the Ubuntu Security Team. This criteria applies to every package affected by the vulnerability, across every Ubuntu release actively supported.\u003c/p\u003e\u003c/div\u003e\u003cdiv class=\"revision-content\"\u003e\u003caside class=\"quote no-group\" data-username=\"janorel\" data-post=\"22\" data-topic=\"34042\"\u003e\n\u003cdiv class=\"title\"\u003e\n\u003cdiv class=\"quote-controls\"\u003e\u003c/div\u003e\n\u003cimg loading=\"lazy\" alt=\"\" width=\"24\" height=\"24\" src=\"https://discourse.ubuntu.com/letter_avatar_proxy/v4/letter/j/ecd19e/48.png\" class=\"diff-ins avatar\"\u003e janorel:\u003c/div\u003e\n\u003cblockquote\u003e\n\u003cp\u003eWhat is the frequency of the CVE security patches on average?\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/aside\u003e\u003cp\u003eIn this \u003ca href=\"https://ubuntu.com/blog/securing-open-source-through-cve-prioritisation\" rel=\"noopener nofollow ugc\"\u003eblog post\u003c/a\u003e you can find detailed information. But to summarize, the Ubuntu security team is triaging, fixing and releasing updated software packages for known vulnerabilities every day. On average, the team is providing more than 3 updates each day, and the most vital updates are prepared, tested and released within 24 hours.\u003c/p\u003e\u003caside class=\"quote no-group\" data-username=\"janorel\" data-post=\"22\" data-topic=\"34042\"\u003e\n\u003cdiv class=\"title\"\u003e\n\u003cdiv class=\"quote-controls\"\u003e\u003c/div\u003e\n\u003cimg loading=\"lazy\" alt=\"\" width=\"24\" height=\"24\" src=\"https://discourse.ubuntu.com/letter_avatar_proxy/v4/letter/j/ecd19e/48.png\" class=\"diff-ins avatar\"\u003e janorel:\u003c/div\u003e\n\u003cblockquote\u003e\n\u003cp\u003eWhat is the time difference between security patches between PRO and upstream?\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/aside\u003e\u003cp\u003eIt will depend on the CVE priority. As stated above, critical vulnerabilities are released within 24 hours. Then, on average, high CVEs are patched within 30 days, and medium CVEs within 60 days since they are known to the Ubuntu Security Team. This criteria applies to every package affected by the vulnerability, across every Ubuntu release actively supported.\u003c/p\u003e\u003cp class=\"diff-ins\"\u003eIn general, preparing a security update requires not only a proper understanding of the security issue and its impact on the package(s), but also a great engineering effort to make sure that the issue is fixed and no regressions are introduced. Please note that the security team might need to backport the upstream fixes/patches to older versions of the vulnerable software as they are present in the different affected Ubuntu releases.\u003c/p\u003e\u003cp class=\"diff-ins\"\u003eIn this \u003ca href=\"https://wiki.ubuntu.com/SecurityTeam/#Vulnerabilities\" rel=\"noopener nofollow ugc\"\u003ewiki\u003c/a\u003e you can find more details about the processes and tools involved in preparing, testing and releasing security updates. Also, please note that packages which have autopkgtest enabled will have their tests run \u003ca href=\"https://packaging.ubuntu.com/html/auto-pkg-test.html\" rel=\"noopener nofollow ugc\"\u003eautomatically\u003c/a\u003e on the Ubuntu infrastructure whenever they get updated or any of their dependencies change. This means any other package that depends on the one being updated, will also have their tests run every time security engineers release a security update.\u003c/p\u003e\u003cp class=\"diff-ins\"\u003eThese strong building and testing processes and infrastructure, contribute to make Ubuntu as one of the most robust and secure Operating Systems.\u003c/p\u003e\u003c/div\u003e","side_by_side_markdown":"\u003ctable class=\"markdown\"\u003e\u003ctr\u003e\u003ctd\u003e[quote=\u0026quot;janorel, post:22, topic:34042\u0026quot;]\nWhat is the frequency of the CVE security patches on average?\n[/quote]\n\nIn this [blog post](https://ubuntu.com/blog/securing-open-source-through-cve-prioritisation) you can find detailed information. But to summarize, the Ubuntu security team is triaging, fixing and releasing updated software packages for known vulnerabilities every day. On average, the team is providing more than 3 updates each day, and the most vital updates are prepared, tested and released within 24 hours. \n\n[quote=\u0026quot;janorel, post:22, topic:34042\u0026quot;]\nWhat is the time difference between security patches between PRO and upstream?\n[/quote]\n\n\u003c/td\u003e\u003ctd\u003e[quote=\u0026quot;janorel, post:22, topic:34042\u0026quot;]\nWhat is the frequency of the CVE security patches on average?\n[/quote]\n\nIn this [blog post](https://ubuntu.com/blog/securing-open-source-through-cve-prioritisation) you can find detailed information. But to summarize, the Ubuntu security team is triaging, fixing and releasing updated software packages for known vulnerabilities every day. On average, the team is providing more than 3 updates each day, and the most vital updates are prepared, tested and released within 24 hours. \n\n[quote=\u0026quot;janorel, post:22, topic:34042\u0026quot;]\nWhat is the time difference between security patches between PRO and upstream?\n[/quote]\n\n\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd class=\"diff-del\"\u003e\u003cdel\u003eIt will depend on the CVE priority. As stated above, critical vulnerabilities are released within 24 hours. Then, on average, high CVEs are patched within 30 days, and medium CVEs within 60 days since they are known to the Ubuntu Security Team. This criteria applies to every package affected by the vulnerability, across every Ubuntu release actively supported.\u003c/del\u003e\u003c/td\u003e\u003ctd class=\"diff-ins\"\u003e\u003cins\u003eIt will depend on the CVE priority. As stated above, critical vulnerabilities are released within 24 hours. Then, on average, high CVEs are patched within 30 days, and medium CVEs within 60 days since they are known to the Ubuntu Security Team. This criteria applies to every package affected by the vulnerability, across every Ubuntu release actively supported.\n\nIn general, preparing a security update requires not only a proper understanding of the security issue and its impact on the package(s), but also a great engineering effort to make sure that the issue is fixed and no regressions are introduced. Please note that the security team might need to backport the upstream fixes/patches to older versions of the vulnerable software as they are present in the different affected Ubuntu releases. \n\nIn this [wiki](https://wiki.ubuntu.com/SecurityTeam/#Vulnerabilities) you can find more details about the processes and tools involved in preparing, testing and releasing security updates. Also, please note that packages which have autopkgtest enabled will have their tests run [automatically](https://packaging.ubuntu.com/html/auto-pkg-test.html) on the Ubuntu infrastructure whenever they get updated or any of their dependencies change. This means any other package that depends on the one being updated, will also have their tests run every time security engineers release a security update. \n\nThese strong building and testing processes and infrastructure, contribute to make Ubuntu as one of the most robust and secure Operating Systems.\u003c/ins\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/table\u003e"},"can_edit":false}