Detections
Analytics

1.2.2.1 Ensure updates, patches, and additional security software are installed

Information

Security vulnerabilities and functional improvements are regularly addressed through software updates and patches.

Unpatched software can expose systems to known vulnerabilities that may be exploited by attackers. It is recommended that operating system updates be performed on enterprise assets through automated patch management on a monthly, or more frequent, basis.

Solution

Use your package manager to update all packages on the system according to site policy.

The following command will install all available updates:

# dnf update

Once the update process is complete, verify if reboot is required to load changes.

# dnf needs-restarting -r

Impact:

Applying updates may require restarting affected services or rebooting the system (for kernel and core-library updates) to take effect, causing planned downtime. Updates can also change behavior or introduce regressions, which is why testing on non-production systems and following a defined patch-management policy is recommended.

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|RA-5, 800-53|SI-2, 800-53|SI-2(2), CSCv7|3.4, CSCv7|3.5

Plugin: Unix

Control ID: d582ffcb8c7d39ec20a542a3598c96cab24fe60ad785aeef261b05fd3a2649d0