How to check an installed version and patch a vulnerable package (Linux, Windows, pip, npm)

When a CVE is announced, two questions come first: which version do I run and how do I update it. These are the commands for the common systems. Replace PKG with the package name.

Ubuntu and Debian

apt-cache policy PKG dpkg -l | grep PKG sudo apt update && sudo apt install --only-upgrade PKG

To see whether the installed build already contains a fix, search its changelog: apt changelog PKG | grep CVE-2024-1234.

RHEL, CentOS, Rocky, AlmaLinux and Amazon Linux

rpm -q PKG sudo dnf upgrade PKG # Amazon Linux 2 and older RHEL use yum sudo yum update PKG

Security-only updates: sudo dnf upgrade --security (Amazon Linux 2: sudo yum update --security). Apply one advisory: sudo dnf upgrade --advisory=RHSA-2024:1234. Check a package changelog: rpm -q --changelog PKG | grep CVE-2024-1234.

Alpine

apk info -v PKG apk update && apk upgrade PKG

Windows

Get-HotFix -Id KB5044284 Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10 [System.Environment]::OSVersion.Version

Microsoft fixes are delivered as KB updates. Install through Windows Update, then confirm the KB is listed. The build number from the last command should be at or above the fixed build shown on our patch pages.

Python (pip)

pip show PKG pip install --upgrade "PKG>=FIXED_VERSION" pip list --outdated

Node.js (npm)

npm ls PKG npm install PKG@">=FIXED_VERSION" npm audit

After patching

Restart the service (or reboot for kernel and libc updates). A running process keeps using the old code until it restarts.
Re-check the version with the same command you used before.
Test on a non-production host first when the package is critical.

FAQ

How do I check if a CVE is fixed on my Linux distribution?

Compare your installed package version with the fixed version in the distribution security tracker, or search the package changelog for the CVE ID. Distributions often fix a flaw without changing the upstream version number.

How do I confirm a Windows security update is installed?

Run Get-HotFix -Id followed by the KB number in PowerShell. If it returns a row, the update is installed.

← All guides