Debsecan: Debian Security Analyzer

Debian Security Analyzer is a very practical tool, discovered recently.

It simply generates a list of vulnerabilities affecting a given installation, making it complementary to apt-listbugs.

By default at installation, daily email reports are enabled for a generic installation.

This behavior is modified via /etc/default/debsecan:

# Configuration file for debsecan. Contents of this file should
# adhere to the KEY=VALUE shell syntax. This file may be edited by
# debsecan's scripts, but your modifications are preserved.

# If true, enable daily reports, sent by email.
REPORT=true

# For better reporting, specify the correct suite here, using the code
# name (that is, "sid" instead of "unstable").
#
# Available:
# GENERIC
# etch
# lenny
# sid
# squeeze
# wheezy
SUITE=GENERIC

# Mail address to which reports are sent.
MAILTO=root

# Source URL
# eg: http://secure-testing.debian.net/debian-secure-testing/project/debsecan/release/1/$SUITE
SOURCE=

The SUITE parameter is the most important: GENERIC lists all CVEs for all versions, including ones that do not affect you. Setting it to your exact suite (lsb_release -c), debsecan filters by version and the list becomes actionable.

On the command line:

user@vhalholl:~$ debsecan --format detail --suite `lsb_release -c | cut -d ':' -f2` |more

And to count the “remotely exploitable” CVEs (the ones that matter):

user@vhalholl:~$ debsecan --suite `lsb_release -c | cut -d ':' -f2` |grep 'remotely exploitable' |wc -l

And the line that automates patching:

install $(debsecan --suite `lsb_release -c | cut -d ':' -f2` --only-fixed --format packages) -y -o APT::Get::Show-Installed=true

This last line extracts the packages that have a fix available and feeds them directly to apt-get install. It is patch management in one line and it replaces manually reading the daily reports.

[edit: 2026] The Ansible implementation of all this: the unattended-upgrades role .