Alexander Gromnitsky's Blog

Debian CVE fixes over time

Latest update:

For each version, starting with 9 (2017), Debian provides a big ChangeLog file that lists fixes included in periodic updates. If one looks at the changelog for the current release (13), the number of CVE mentions may astonish an unsuspecting reader.

While I wasn't going to waste space here explaining the obvious reason for such an explosion, I got curious about how it had changed over time.

If we extract CVE names & group them by the dates on which they appear in a file, like, for example, in v9:

2017-07-22 44
2017-10-07 348
2017-12-09 301
2018-03-10 280
2018-07-14 331
2018-11-10 766
2019-02-16 206
2019-04-27 214
2019-09-07 250
2020-02-08 424
2020-07-18 434

& do the same for all subsequent Debian versions, we get a quite expected, but still dreadful, picture nevertheless:

CVE fixes per Debian version over time

(An archive with the data & scripts: debian-cve.tar.xz.)


Tags: ойті
Authors: ag