How to get a list of all pending security updates?

I need to list (not count or install) all pending security updates on an Ubuntu 14.04 system. I've read the post How to create a list of of only security updates with apt-get? and its accepted answer (apt-show-versions | grep upgradeable | grep security) does indeed give me a list.

However, that command lists 62 pending security updates. /usr/lib/update-notifier/apt-check tells me that I have 75 pending security updates, but doesn't seem to have a way to list them. How can I reconcile these two numbers? Is one of the two commands doing something other than what I want?

8 Answers

If you are just looking to do this quickly once, instead of creating a separate repository and scripting up some automation and all that. Great if you aren't supposed to be making changes while auditing a system or whatever.

These two commands will spit out the list. Pipe to wc -l to see how many are behind. ;-)

grep security /etc/apt/sources.list > /tmp/security.list
sudo apt-get upgrade -oDir::Etc::Sourcelist=/tmp/security.list -oDir::Etc::SourceParts=/some/valid/dir/false -s

Still valid for older distros or if you have update repos off, but security on:

sudo apt-get upgrade -s | grep ^Inst | grep -i security 

4

+---------------------------------------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Command | Purpose |
+---------------------------------------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| apt list --upgradable | List all updates available |
| apt list --upgradable | grep "\-security" | List all updates that are security. |
| apt list --upgradable 2>/dev/null | grep "\-security" | wc -l | Count number of security updates available. and redirects the stderr like "WARNING: apt does not have a stable CLI interface. Use with caution in scripts." to null |
+---------------------------------------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------+

3

sudo apt-get -s --no-download dist-upgrade -V | grep "^Inst.*security.*$" | cut -d " " -f 2

With some help from this question

1

there must be a way to request how many packages are updatable and how many security updates right now, but if you settle for asking it once a day you can simply read the file /var/lib/update-notifier/updates-available, which seems to be updated daily by the script /etc/ which belongs to the package update-notifier-common

Example:

$ sudo cat /var/lib/update-notifier/updates-available
355 packages can be updated.
1 update is a security update.

Tested in:

• Ubuntu 14.04 LTS
• Ubuntu 16.04 LTS
• Ubuntu 18.04 LTS

Regards,

/Ángel

The other answers given here do not all list the same security upgrades.

Ubuntu has two standard policies for upgrading packages: apt-get upgrade is more conservative than apt-get dist-upgrade. The latter will generally upgrade more packages, and it may contain security upgrades that the former ignores.

The notification shown (by default) upon login is a cached copy of the output of apt-check:

$ /usr/lib/update-notifier/apt-check --human-readable
92 packages can be updated.
3 updates are security updates.

These numbers count packages that will be upgraded by apt-get dist-upgrade; you can list these security upgrades as follows:

sudo apt-get --no-download -s dist-upgrade -V | awk '/^Inst.*security/ {print $2}'

or

apt-get -s dist-upgrade -V | awk '/^Inst.*security/ {print $2}'

To see just the security upgrades in an apt-get upgrade, do

apt-get -s upgrade -V | awk '/^Inst.*security/ {print $2}'

or

apt list --upgradable

By default, unattended-upgrades only runs an upgrade, not dist-upgrade.

This explains why unattended-upgrades, even when configured to automatically install security upgrades, doesn't always install all security upgrades reported by apt-check.

All of these tools use the local package index - so to check the status on the Ubuntu mirror your host is using, first update it with sudo apt update.

A mirror can be out of date in principle, so if you want to check at the source, you need to check on Launchpad - at least for packages distributed by Ubuntu.

This worked for me:

sudo unattended-upgrade --dry-run -d 2> /dev/null | awk '/Checking/ { print $2 }'

1

sudo apt list --upgradable |grep "/$(lsb_release -cs)-security"

This lists all available updates which come via the security repository.

2

Mystery solved: /usr/lib/update-notifier/apt-check counts "real" packages whereas apt list --upgradable counts virtual packages. Example:

8 updates can be installed immediately.
8 of these updates are security updates.
apt list --upgradable # only 3 lines
linux-generic/focal-updates,focal-security 5.4.0.56.59 amd64 [upgradable from: 5.4.0.53.56]
linux-headers-generic/focal-updates,focal-security 5.4.0.56.59 amd64 [upgradable from: 5.4.0.53.56]
linux-image-generic/focal-updates,focal-security 5.4.0.56.59 amd64 [upgradable from: 5.4.0.53.56]
apt upgrade
The following NEW packages will be installed: linux-headers-5.4.0-56 linux-headers-5.4.0-56-generic linux-image-5.4.0-56-generic linux-modules-5.4.0-56-generic linux-modules-extra-5.4.0-56-generic
The following packages will be upgraded: linux-generic linux-headers-generic linux-image-generic
3 upgraded, 5 newly installed, 0 to remove and 0 not upgraded.

1

Your Answer

Sign up or log in

Sign up using Google Sign up using Facebook Sign up using Email and Password Submit

Post as a guest

Post Your Answer Discard

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy