Why your Linux package version does not match the advisory (backports explained)

An advisory says "fixed in OpenSSH 9.8", but your server runs 8.9 and a scanner still flags it. Is it vulnerable? Not necessarily.

What is a backport?

Enterprise distributions keep a stable version for years and copy individual security fixes back into it. Ubuntu 22.04 ships OpenSSH 8.9, and its security fixes arrive in package versions such as 1:8.9p1-3ubuntu0.10: the upstream number stays at 8.9 while the code changes. Version-based scanners that only read 8.9 report a false positive.

How to verify a fix

Find the distribution's fixed package version in its security tracker (Ubuntu CVE tracker, Debian security tracker, Red Hat security data, Alpine secdb, Amazon ALAS).
Compare it with your installed package version using the distribution's own tool.

# Debian / Ubuntu: prints PATCHED when installed >= fixed dpkg --compare-versions "$(dpkg-query -W -f='${Version}' PKG)" ge "FIXED_VERSION" && echo PATCHED || echo STILL-VULNERABLE # RHEL / Amazon Linux rpm -q PKG rpm -q --changelog PKG | grep CVE-2024-1234

What this means for patching

Trust the distribution fixed version, not the upstream version range.
Install the distribution update instead of compiling a newer upstream release, unless you must.
Restart the service afterwards.

Every CVE page here lists the exact distribution fixed versions where the trackers publish them. See how to check a version and patch.

FAQ

Why does my scanner flag a CVE that my distribution already fixed?

The scanner compares the upstream version number, but the distribution backported the fix without changing that number. Compare against the distribution fixed package version instead.

How do I check if a backported fix is installed?

Search the package changelog for the CVE ID, or compare the installed package version with the fixed version from the distribution security tracker.

← All guides