Even with the OS itself patched, individual application dependencies (libraries, frameworks) can have known vulnerabilities. This guide covers auditing your installed software for known security issues.
Why This Goes Beyond OS-Level Patching
OS package updates (see Debian Security Advisories or Ubuntu equivalents) cover system packages, but application-level dependencies (npm packages, Python libraries, application frameworks) have their own separate vulnerability landscape needing separate attention.
Auditing System Packages
sudo apt list --upgradableShows packages with available updates, though doesn't specifically flag which updates are security-relevant versus general improvements — cross-reference with security advisories for that context.
Using a Dedicated Vulnerability Scanner (Lynis)
sudo apt install lynis -y
sudo lynis audit systemPerforms a broad security audit including checking for outdated/vulnerable software, providing a comprehensive report with specific recommendations.
Auditing Node.js Dependencies
npm auditnpm audit fixChecks your project's package.json dependencies against known vulnerability databases, and can automatically fix issues where a compatible patched version exists.
Auditing Python Dependencies
pip install pip-audit --break-system-packages
pip-auditAuditing PHP/Composer Dependencies
composer auditAuditing Docker Images
docker scout cves your-image:tagOr use a dedicated container scanning tool to check base images and installed packages within containers for known vulnerabilities.
Setting Up Automated Dependency Scanning in CI/CD
Integrate dependency auditing into your CI/CD pipeline (see How to Build a Simple CI/CD Pipeline with GitHub Actions) so vulnerabilities are caught before deployment, not discovered after the fact in production.
Prioritizing Findings
Not every flagged vulnerability warrants immediate action — consider: is the vulnerable code path actually reachable/used in your application, what's the severity, and is a patched version genuinely available and compatible with your setup.
Handling Vulnerabilities Without an Available Fix
Sometimes a vulnerability is identified but no patched version exists yet — consider whether you can avoid the vulnerable code path, apply a workaround, or whether the risk is acceptable given your specific usage pattern, while monitoring for an eventual fix.
Establishing a Regular Audit Cadence
Run dependency audits regularly (ideally automated as part of CI/CD, plus periodic manual review) rather than only once at initial deployment — new vulnerabilities in existing dependencies are discovered continuously.
Common Errors
Audit tool reports many vulnerabilities in transitive dependencies you don't directly control — focus first on vulnerabilities with available fixes and genuine severity; some transitive dependency issues may need to wait for upstream maintainers to update their own dependencies.
Continue Reading
- How to Set Up Security Auditing with Lynis
- Debian Security Advisories: How to Stay Informed and Patch Promptly
- How to Build a Simple CI/CD Pipeline with GitHub Actions
Browse more articles in Server Security & Hardening.
