Lesson 1.30: Does it affect us? Inventory, versions and backports
An advisory only matters if you run what it describes, in an affected version, in a way that can be reached. Answering that needs an inventory of components and versions, careful version comparison (7.2.10 is newer than 7.2.6), and attention to how Linux distributions patch: they often backport a fix into the same upstream version, so 'OpenSSH 9.6p1' can be vulnerable or fixed depending on the package release. In the lab you match the week's CVEs to Northwind's component list, compare versions, read a distribution security notice, and write a prioritised ticket list.
17 min
You will learn to
- Match advisories to an inventory
- Compare versions correctly with sort -V
- Explain distribution backports
- Read a distribution security notice
- Write prioritised remediation tickets
Key terms
- Asset inventory / CMDB
- The list of systems and the components and versions they run.
- Affected range
- The versions an advisory says are vulnerable, and the first fixed one.
- Backport
- A fix applied to an older version by a distribution, without changing the upstream version number.
- sort -V
- Version sort: compares numbers inside strings numerically.
- Remediation SLA
- Agreed time to fix by priority, e.g. KEV and internet-facing within days.
← Serving the full chain · All lessons · Why it matters: lessons from real incidents →