Ubuntu, Debian, Fedora, RedHat och OpenSUSE En jämförelse av CVE på Linux distributioner Ubuntu, Debian, Fedora, RedHat and OpenSUSE A comparison in CVE on Linux distributions Bachelor Degree Project in Computer Science Network and Systems Administration, G2E, 22.5hp Spring term 2018 IT610G Fredrik Janson
[email protected] Supervisor: Dennis Modig Examiner: Jianguo Ding Abstract Package management in Linux systems is a popular way to install and update software and the de facto standard on Ubuntu, Debian, Fedora, RedHat, CentOS and OpenSUSE. The software provided in the repositories can however differ when it comes to fixing vulnerabilities since package maintainers in some cases must implement some specific changes to the source used to build the software to make it compatible with the Linux system it is intended to be executed on. The Common Vulnerabilities and Exposures (CVE) standard provides a way to compare how fixes for vulnerabilities is handled on each Linux system where this work is aimed to examine if there exists different patterns when it comes to the time in days it took for a fix to emerge in the changelog for the software. This data is collected by using scripts in Linux to iterate through the National Vulnerability Database (NVD) which contains CVE entries, the severity score in terms of the impact of the vulnerability and references to which systems that the vulnerability affects. The dates are collected by using another script that iterates through the changelog of all available packages and saves the earliest date when the fix was issued. The results show that there is not enough statistical significance to reliably determine if a difference existed between the Linux distributions except when comparing OpenSUSE with Ubuntu, Debian and Fedora where significance was found which suggests that further study is needed.