I'm curious how various distros handle discovery of security alerts that affect their packages. Is it all up to a package maintainer to follow one of the security alert mailing lists or the source project's mailing list? Or is there a way that it is more automated, such as a script for comparing package names and versions against some security alert service?

The reason I'm wondering is that I have some apps that I compile myself, either for specific options or to get a specific version. And sometimes I have to compile their dependencies too. This means I'm now responsible for watching for security updates of all these things instead of my distro's default security checking of installed packages. It seems like a lot of work to track something like this manually.

any thoughts or experience with this? thanks!

IMO that's not as much a distribution issue as it is your freedom to choose: you chose to pass up on on what your distribution offered and take on responsibility yourself. Many distributions provide a security email list so subscribing and setting up filtering rules in your MUA should be real easy.

www.us-cert.gov

The government puts out weekly Vulnerability Summaries for Technical and Non-technical people. They are currently rated by threat level High, Medium, Low. It lists the "Primary Vendor -- Product" a Description, the date it was published, a score, and source and patch info links.You can subscribe to a mailing list or be notified via RSS or Atom feeds.

There is no automated system I know of, because there are just too many forks, versions . . .

Though you could probably use RSS feeds and some filters to get pretty close to just what you need.

Hope this helps.

1 members found this post helpful.

@unSpawn - I agree that when you do this you take on that responsibility yourself, that's why I'm curious how people do this in general, so I can do the same for my self-installed apps. Seems like a lot of work, which makes me appreciate all the effort that goes into providing a distro even more.

@never say never - I see what you mean about all the variations. Just version numbers and application names would be ok, but it occurs to me now that distros split applications into different packages, they may patch source code or make other changes, they could be compiled with different options that may or may not affect the vulnerability, etc.

Thanks for the responses.

I came across this tool that looks like it would be very helpful in this:
https://cassandra.cerias.purdue.edu/main/index.html

You can add Vendors or Products and it will scan various lists like secunia for alerts that match your custom list.

Gonna check that out, looks like it could save me some time. Thanks for posting what you found.