CME-1101
Automated Patch Management (dnf-automatic)
Description
Automatically downloads and applies security updates on schedule. Reduces the window between vulnerability disclosure and patch application from days/weeks to hours.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | Temporal: vulnerability window shortened; exploits against patched code fail |
Verification
Verify automatic updates are enabled
$ systemctl is-active dnf-automatic-install.timer
# Expected: active
# Expected: active
Platform: rhel
$ grep apply_updates /etc/dnf/automatic.conf
# Expected: apply_updates = yes
# Expected: apply_updates = yes
Platform: rhel
Remediation
rhel
dnf-automatic with security-only updates applied on schedule
dnf install -y dnf-automatic
sed -i 's/^apply_updates.*/apply_updates = yes/' /etc/dnf/automatic.conf && sed -i 's/^upgrade_type.*/upgrade_type = security/' /etc/dnf/automatic.conf
systemctl enable --now dnf-automatic-install.timer