STIGQter: STIG Summary: Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The Ubuntu operating system must be configured so that Advance package Tool (APT) removes all software components after updated versions have been installed.

DISA Rule

SV-219156r610963_rule

Vulnerability Number

V-219156

Group Title

SRG-OS-000437-GPOS-00194

Rule Version

UBTU-18-010017

Severity

CAT II

CCI(s)

• CCI-002617 - The organization removes organization-defined software components (e.g., previous versions) after updated versions have been installed.

Weight

10

Fix Recommendation

Configure APT to remove all software components after updated versions have been installed.

Add or updated the following options to the "/etc/apt/apt.conf.d/50unattended-upgrades" file:

Unattended-Upgrade::Remove-Unused-Dependencies "true";
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";

Check Contents

Verify Advance package Tool (APT) is configured to remove all software components after updated versions have been installed.

Check that APT is configured to remove all software components after updating with the following command:

# grep -i remove-unused /etc/apt/apt.conf.d/50unattended-upgrades
Unattended-Upgrade::Remove-Unused-Dependencies "true";
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";

If the "::Remove-Unused-Dependencies" and "::Remove-Unused-Kernel-Packages" parameters are not set to "true", or are missing, or are commented out, this is a finding.

Vulnerability Number

V-219156

Documentable

False

Rule Version

UBTU-18-010017

Severity Override Guidance

Verify Advance package Tool (APT) is configured to remove all software components after updated versions have been installed.

Check that APT is configured to remove all software components after updating with the following command:

# grep -i remove-unused /etc/apt/apt.conf.d/50unattended-upgrades
Unattended-Upgrade::Remove-Unused-Dependencies "true";
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";

If the "::Remove-Unused-Dependencies" and "::Remove-Unused-Kernel-Packages" parameters are not set to "true", or are missing, or are commented out, this is a finding.

Check Content Reference

M

Target Key

4055

Comments