Debian publishes a security advisory almost every day, and each one follows the same pattern. Once you can read that pattern, you can answer the only question that matters for your servers in a minute: am I running a fixed version or not? This guide explains the parts of a Debian advisory, the security tracker behind it, and the commands to check a machine.
DSA or DLA?
- DSA (Debian Security Advisory) comes from the Debian Security Team and covers releases under regular support. Today that is Debian 13 (trixie). DSAs are announced on the debian-security-announce list and listed at debian.org/security.
- DLA (Debian LTS Advisory) comes from the Debian LTS team, which takes over once regular support ends. Today that is Debian 12 (bookworm), until 30 June 2028. DLAs go to debian-lts-announce and debian.org/lts/security.
Both use the same archive and the same apt workflow. If you run both releases, follow both lists. An identifier such as DSA-6204-1 has a number and a revision; a -2 often fixes a regression introduced by the first update.
Anatomy of an advisory
Take DSA-6204-1 (openssh, 9 April 2026) as an example. Its header gives the package (openssh), the CVE IDs (CVE-2026-3497) and the Debian bug number. The text describes the impact in plain words, in this case a flaw that affects only non-default configurations with GSSAPIKeyExchange enabled. Then come the lines that matter most:
For the oldstable distribution (bookworm), this problem has been fixed in version 1:9.2p1-2+deb12u9. [...] For the stable distribution (trixie), this problem has been fixed in version 1:10.0p1-7+deb13u2.
Any installed version equal to or newer than the one listed for your release contains the fix.
Source packages and binary packages
Advisories name the source package. You install binary packages built from it: openssh becomes openssh-server, openssh-client and openssh-sftp-server; glibc becomes libc6, libc-bin and others; linux becomes linux-image-... packages. The Debian security FAQ asks you to update all the binary packages built from the named source package. To see which installed packages come from a given source:
dpkg-query -W -f='${source:Package} ${binary:Package} ${Version}\n' | awk '$1=="openssh"'Reading the version number
Stable updates fork the version number. Debian's Developer's Reference describes the convention +debXuY, where X is the release number and Y counts the updates: 1.5-3+deb13u1 is the first stable or security update of version 1.5-3 for Debian 13. The same reference also allows the form ~deb13u1, which you will see on packages such as intel-microcode or systemd. So +deb12u9 is the ninth such update for bookworm.
Do not be surprised that the upstream version stays old. The FAQ explains that Debian backports security fixes to the version shipped in the release instead of moving to new upstream versions, so nothing changes unexpectedly. openssh 9.2p1 on bookworm can therefore be fully patched. Let dpkg do the comparison:
apt policy openssh-server
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' openssh-server)" ge '1:10.0p1-7+deb13u2' && echo fixed || echo update-neededapt-get changelog openssh-server shows the package changelog, where Debian maintainers normally list the CVEs each update fixes.
The security tracker
Every advisory links to the security tracker. Its CVE pages show, per release, the version currently in the archive and whether it is fixed or vulnerable, plus the fixed version and the advisory that delivered it. Source-package pages list open and resolved issues. The notes use a small vocabulary, defined in the tracker documentation:
- no-dsa: the issue does not warrant an immediate advisory, for example because it is minor. It may still be fixed in a point update or alongside a later security update.
- postponed: it deserves a fix via an advisory, but not one released for this issue alone; it will ride along with a later update.
- ignored: no update will be provided.
- not-affected: the vulnerable code is not in Debian's version, or was fixed before the package entered the archive.
- unimportant: no real impact on Debian's binary packages, or the package is not covered by security support.
The FAQ adds that not every CVE gets a DSA: low-impact issues can be fixed in a point release or the next Debian release. So a CVE without a DSA is not automatically a gap.
Tools that help
debsecancompares installed packages with the tracker data. With the correct suite, it can list only packages that already have a fix available:debsecan --suite trixie --format packages --only-fixed.check-support-statusfromdebian-security-supportlists installed packages whose security support is limited or has ended.needrestartshows which services still run old libraries after an update.
Ubuntu uses its own advisories (USNs) and version numbers; do not apply Debian fixed versions to Ubuntu systems.
What you should do
- Subscribe to debian-security-announce, and to debian-lts-announce if you still run Debian 12.
- For each advisory, find your release's fixed version and compare it with
apt policyordpkg --compare-versions. - Update every binary package built from the named source package, then restart the affected services or reboot for kernel and core library updates.
- Use the security tracker when an advisory is unclear or a CVE seems to have no fix; check its notes before assuming the worst.
Sources
- debian.org/security/faq
- security-team.debian.org/security_tracker.html
- debian.org/doc/manuals/developers-reference/pkgs.en.html
- lists.debian.org/debian-security-announce/2026/msg00114.html
- security-tracker.debian.org/tracker/DSA-6204-1
- wiki.debian.org/LTS
- manpages.debian.org/trixie/debsecan/debsecan.1.en.html
- manpages.debian.org/trixie/dpkg/dpkg-query.1.en.html
- manpages.debian.org/trixie/dpkg/dpkg.1.en.html
- manpages.debian.org/trixie/apt/apt-get.8.en.html
- manpages.debian.org/bookworm/debian-security-support/check-support-status.1.en.html
- debian.org/News/2026/20260712
Comments
0 total · 0 threads