Evaluate CVEs in Ubuntu 20.04 Publisher Images

Step 1: Review the Report

First, identify any CVE numbers listed in the scan report. CVE numbers follow this format: CVE-2023-44487

Step 2: Research Available Fixes

After you have identified a CVE number and its affected component, search for available patches using Ubuntu’s official security database:https://ubuntu.com/security/{CVE number}

Example: For CVE-2023-44487, visit https://ubuntu.com/security/CVE-2023-44487

This page provides detailed information about the vulnerability and Ubuntu’s official response. For instance, if the affected component is the nghttp2 library, look for the corresponding section. Search for focal (Ubuntu 20.04’s codename) to find the patched version. A release version like 1.40.0-1ubuntu0.2 indicates that upgrading to this version will resolve the vulnerability.

Common Status Definitions

(Reference: How to read CVE)

• Not vulnerable/Not affected: Your system is not at risk.
• Needs triage: Ubuntu is currently evaluating the vulnerability.
• Ignored: Ubuntu has decided not to address the issue because:
  • The vulnerability doesn’t require a fix (check the Notes section for explanations).
  • The OS has reached End-of-Life (EOL) and no longer receives updates.
• Needed/Pending: A patch is in development
• Released: An update is available to patch the vulnerability
  • Available with Ubuntu Pro: Patch is only accessible to Ubuntu Pro subscribers; alternative mitigation strategies should be considered

Step 3. Find the mitigation (if needed)

You can visit the below link to get the vulnerability detail.

https://nvd.nist.gov/vuln/detail/{CVE number}

For example: https://nvd.nist.gov/vuln/detail/CVE-2023-44487

Sometimes, you can get mitigation from your detailed report.

And there are some common mitigations:

• Remove the affected component if the component is not necessary.
• Prevent to use the affected component:
  • Sometimes you can see the component is vulnerable in a specific situation, suggest our customer be aware of it.
  • Disable the component if the customer is not using it.

List of CVEs Without Patches Provided by Ubuntu > 2 years

sudo apt-get remove python3-httplib2

sudo rm /usr/bin/scp