OSのパッケージバージョン管理とパッチ当て：Ubuntu版

cat /etc/os-release

PRETTY_NAME="Ubuntu 26.04.1 LTS"
NAME="Ubuntu"
VERSION_ID="26.04"
VERSION="26.04.1 LTS (Resolute Raccoon)"
VERSION_CODENAME=resolute
ID=ubuntu

uname -a

Linux web01 7.0.0-1014-aws #14-Ubuntu SMP PREEMPT Fri Sep 18 00:50:36 UTC 2026 aarch64 GNU/Linux

hostnamectl

 Static hostname: web01
       Icon name: computer-vm
         Chassis: vm
  Virtualization: amazon
Operating System: Ubuntu 26.04.1 LTS
          Kernel: Linux 7.0.0-1014-aws
    Architecture: arm64
 Hardware Vendor: Amazon EC2
  Hardware Model: t4g.small

apt list [オプション] [パッケージ名のパターン]

apt list 'openssh*'

Listing...
openssh-client/resolute-updates,resolute-security,now 1:10.2p1-2ubuntu3.8 arm64 [installed,automatic]
openssh-known-hosts/resolute 0.6.3-1build1 all
openssh-server/resolute-updates,resolute-security,now 1:10.2p1-2ubuntu3.8 arm64 [installed]
openssh-sftp-server/resolute-updates,resolute-security,now 1:10.2p1-2ubuntu3.8 arm64 [installed]
openssh-tests/resolute-updates,resolute-security 1:10.2p1-2ubuntu3.8 arm64

openssh-server / resolute-updates,resolute-security,now  1:10.2p1-2ubuntu3.8  arm64  [installed]
  パッケージ名  /  取得元のリポジトリ                      バージョン            CPU    状態

apt list --installed 2>/dev/null | wc -l

1422

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

apt list --installed 'python3-*' 2>/dev/null | head -5

Listing...
python3-apt/resolute,now 3.1.0ubuntu1 arm64 [installed,automatic]
python3-attr/resolute,now 25.3.0-1 all [installed,automatic]
python3-babel/resolute,now 2.17.0-1 all [installed,automatic]
python3-bcrypt/resolute,now 4.2.0-2.1build2 arm64 [installed,automatic]

apt list -a openssl

Listing...
openssl/resolute-updates,resolute-security,now 3.5.5-1ubuntu3.7 arm64 [installed,automatic]
openssl/resolute 3.5.5-1ubuntu3 arm64

apt list --installed 2>/dev/null | grep -m1 '^openssl/'
dpkg-query -W -f='${db:Status-Abbrev} ${Package}:${Architecture} ${Version}\n' openssl

openssl/resolute-updates,resolute-security,now 3.5.5-1ubuntu3.7 arm64 [installed,automatic]
ii  openssl:arm64 3.5.5-1ubuntu3.7

dpkg-query -W -f='${Installed-Size}\t${Package}\n' | sort -rn | head -8

216141	ansible
146758	linux-modules-7.0.0-1014-aws
139622	mesa-vulkan-drivers
130672	libllvm21
127960	docker.io
117624	snapd
108192	python3-botocore
96528	containerd

apt-cache rdepends --installed openssl

openssl
Reverse Depends:
  ssl-cert
  ca-certificates
  ec2-instance-connect

apt-mark showmanual

acl
ansible
bash
chrony
cloud-init
curl

ls /usr/local/bin /opt

/opt:
amazon  containerd  terraform

/usr/local/bin:
aws  aws_completer  terraform

pip list --user

Package    Version
---------- -------
requests   2.32.3

npm list -g --depth=0

/usr/local/lib
└── npm@11.6.0

cargo install --list

ripgrep v14.1.1:
    rg

dpkg -S /usr/bin/ssh

openssh-client: /usr/bin/ssh

dpkg -S /usr/local/bin/terraform

dpkg-query: no path found matching pattern /usr/local/bin/terraform

grep -rhE '^(deb|URIs)' /etc/apt/sources.list /etc/apt/sources.list.d/ 2>/dev/null

URIs: http://ap-northeast-1.ec2.archive.ubuntu.com/ubuntu/
URIs: http://security.ubuntu.com/ubuntu
deb [arch=arm64 signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main

dpkg-query -W -f='${Package}\t${Version}\n' openssh-server openssl

openssh-server	1:10.2p1-2ubuntu3.8
openssl	3.5.5-1ubuntu3.7

apt-mark showmanual | xargs dpkg-query -W -f='${Package}\t${Version}\n'

example-tool    1.2.3-0ubuntu2.1
libfoo          4.5+dfsg-1ubuntu1
bar-daemon      2.0.1+ds1-0ubuntu1
baz-cli         3.4.0

[epoch:]上流バージョン[-リビジョン]

apt policy openssh-server

openssh-server:
  Installed: 1:10.2p1-2ubuntu3.8
  Candidate: 1:10.2p1-2ubuntu3.8
  Version table:
 *** 1:10.2p1-2ubuntu3.8 500
        500 http://ap-northeast-1.ec2.archive.ubuntu.com/ubuntu resolute-updates/main arm64 Packages
        500 http://security.ubuntu.com/ubuntu resolute-security/main arm64 Packages
        100 /var/lib/dpkg/status
     1:10.2p1-2ubuntu3 500
        500 http://ap-northeast-1.ec2.archive.ubuntu.com/ubuntu resolute/main arm64 Packages

apt changelog openssh-server | grep -i 'CVE-' | head -5

    - debian/patches/CVE-2026-0001.patch: upstream: sftp: be stricter in
    - CVE-2026-0001
    - debian/patches/CVE-2026-0002.patch: upstream: Reset GSSAPI client
    - CVE-2026-0002

apt list --upgradable 2>/dev/null

Listing...
cloud-init/resolute-updates 26.2-0ubuntu1~26.04.1 all [upgradable from: 26.1-0ubuntu3~26.04.1]
containerd/resolute-updates 2.2.2-0ubuntu1.2 arm64 [upgradable from: 2.2.2-0ubuntu1.1]
libsystemd0/resolute-updates 259.9-0ubuntu0.1 arm64 [upgradable from: 259.8-0ubuntu0.1]

systemctl list-units --type=service --state=running

  UNIT                 LOAD   ACTIVE SUB     DESCRIPTION
  apache2.service      loaded active running The Apache HTTP Server
  chrony.service       loaded active running chrony, an NTP client/server
  containerd.service   loaded active running containerd container runtime
  cron.service         loaded active running Regular background program processing daemon
  ssh.service          loaded active running OpenBSD Secure Shell server

sudo ss -tulpn

Netid State  Recv-Q Send-Q  Local Address:Port  Peer Address:Port Process
udp   UNCONN 0      0       127.0.0.53%lo:53         0.0.0.0:*    users:(("systemd-resolve",pid=3393,fd=17))
udp   UNCONN 0      0           127.0.0.1:323        0.0.0.0:*    users:(("chronyd",pid=821,fd=4))
tcp   LISTEN 0      4096          0.0.0.0:22         0.0.0.0:*    users:(("sshd",pid=1012,fd=3))
tcp   LISTEN 0      511                 *:80               *:*    users:(("apache2",pid=1388,fd=4))
tcp   LISTEN 0      4096        127.0.0.1:5432       0.0.0.0:*    users:(("postgres",pid=1120,fd=6))

grep -v -E 'nologin|false' /etc/passwd

root:x:0:0:root:/root:/bin/bash
sync:x:4:65534:sync:/bin:/bin/sync
ubuntu:x:1000:1000:Ubuntu:/home/ubuntu:/bin/bash
sato:x:1001:1001::/home/sato:/bin/bash

getent group sudo docker

sudo:x:27:ubuntu,sato
docker:x:109:sato

sudo ufw status verbose

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp (OpenSSH)           ALLOW IN    Anywhere
80/tcp                     ALLOW IN    Anywhere
22/tcp (OpenSSH (v6))      ALLOW IN    Anywhere (v6)

sudo apt update          パッケージの一覧を最新にする
  → apt list --upgradable  何が更新されるかを見る
  → apt -s upgrade         シミュレーションで確認する
  → sudo apt upgrade       適用する
  → 再起動が必要かを確認する

sudo apt update

Hit:1 http://ap-northeast-1.ec2.archive.ubuntu.com/ubuntu resolute InRelease
Get:2 http://ap-northeast-1.ec2.archive.ubuntu.com/ubuntu resolute-updates InRelease [126 kB]
Get:3 http://security.ubuntu.com/ubuntu resolute-security InRelease [126 kB]
Fetched 1,284 kB in 2s (642 kB/s)
16 packages can be upgraded. Run 'apt list --upgradable' to see them.

apt -s upgrade

NOTE: This is only a simulation!
...
Upgrading:
  cloud-init       libpam-systemd     libudev1            systemd-resolved
  cloud-init-base  libsystemd-shared  systemd             systemd-sysv
  libnss-systemd   libsystemd0        systemd-cryptsetup  udev

Not upgrading yet due to phasing:
  containerd  tmux  ubuntu-pro-client  ubuntu-pro-client-l10n

Summary:
  Upgrading: 12, Installing: 0, Removing: 0, Not Upgrading: 4

sudo apt upgrade

Summary:
  Upgrading: 12, Installing: 0, Removing: 0, Not Upgrading: 4
  Download size: 18.4 MB
  Space needed: 1,024 kB / 6,512 MB available

Continue? [Y/n] y
...
Setting up systemd (259.9-0ubuntu0.1) ...

1. sudo apt update                更新候補を取得する
2. apt list --upgradable          一括で更新されるものを確認する
3. apt -s upgrade                 シミュレーションで、Installing / Removing を確認する
4. 必要なら apt-mark hold         止めたいものを除外する
5. sudo apt upgrade               一括で適用する
6. 再起動が必要かを確認する        needrestart / /var/run/reboot-required
7. 動作を確認する                 サービスの状態、ログ、アプリの疎通

mkdir -p ~/upgrade-log/$(date +%F) && cd ~/upgrade-log/$(date +%F)

dpkg-query -W -f='${Package} ${Version}\n' | sort > before.txt   # 全パッケージの版
apt list --upgradable 2>/dev/null > upgradable.txt              # 更新候補
apt -s upgrade > simulate.txt                                   # 今回のシミュレーション
uname -r > kernel_before.txt                                    # 動いているカーネル
systemctl --failed > failed_before.txt                          # 失敗しているサービス

sudo apt upgrade -y 2>&1 | tee upgrade.log

dpkg-query -W -f='${Package} ${Version}\n' | sort > after.txt
diff before.txt after.txt > diff.txt     # 版が変わったものだけが出る
cat diff.txt

ls /var/run/reboot-required 2>/dev/null; cat /var/run/reboot-packages.txt 2>/dev/null
sudo reboot
# 再起動後
uname -r > kernel_after.txt
systemctl --failed > failed_after.txt

sudo apt install --only-upgrade openssh-server

Upgrading:
  openssh-client  openssh-server  openssh-sftp-server

Summary:
  Upgrading: 3, Installing: 0, Removing: 0, Not Upgrading: 13

apt list --installed 'linux-*aws*' 2>/dev/null

Listing...
linux-aws/resolute-updates,resolute-security,now 7.0.0.1014.14 arm64 [installed,automatic]
linux-headers-7.0.0-1014-aws/resolute-updates,resolute-security,now 7.0.0-1014.14 arm64 [installed,automatic]
linux-headers-aws/resolute-updates,resolute-security,now 7.0.0.1014.14 arm64 [installed,automatic]
linux-image-7.0.0-1014-aws/resolute-updates,resolute-security,now 7.0.0-1014.14 arm64 [installed,automatic]
linux-image-aws/resolute-updates,resolute-security,now 7.0.0.1014.14 arm64 [installed,automatic]
linux-modules-7.0.0-1014-aws/resolute-updates,resolute-security,now 7.0.0-1014.14 arm64 [installed,automatic]

apt list --upgradable 'linux-*' 2>/dev/null

Listing...
linux-aws/resolute-updates,resolute-security 7.0.0.1015.15 arm64 [upgradable from: 7.0.0.1014.14]
linux-headers-aws/resolute-updates,resolute-security 7.0.0.1015.15 arm64 [upgradable from: 7.0.0.1014.14]
linux-image-aws/resolute-updates,resolute-security 7.0.0.1015.15 arm64 [upgradable from: 7.0.0.1014.14]

apt -s install --only-upgrade linux-aws linux-image-aws linux-headers-aws

NOTE: This is only a simulation!
...
Installing dependencies:
  linux-aws-headers-7.0.0-1015  linux-image-7.0.0-1015-aws
  linux-headers-7.0.0-1015-aws  linux-modules-7.0.0-1015-aws

Upgrading:
  linux-aws  linux-headers-aws  linux-image-aws

Summary:
  Upgrading: 3, Installing: 4, Removing: 0, Not Upgrading: 13

sudo apt install --only-upgrade linux-aws linux-image-aws linux-headers-aws

Setting up linux-image-7.0.0-1015-aws (7.0.0-1015.15) ...
...
Processing triggers for linux-image-7.0.0-1015-aws (7.0.0-1015.15) ...
/etc/kernel/postinst.d/initramfs-tools:
update-initramfs: Generating /boot/initrd.img-7.0.0-1015-aws
/etc/kernel/postinst.d/zz-update-grub:
Generating grub configuration file ...
done

sudo reboot
# 再接続してから
uname -r

7.0.0-1015-aws

dpkg-query -W -f='${db:Status-Abbrev} ${Package}\n' 'linux-image-[0-9]*'

ii  linux-image-7.0.0-1014-aws
ii  linux-image-7.0.0-1015-aws

sudo apt-mark hold linux-aws linux-image-aws linux-headers-aws
sudo apt upgrade
sudo apt-mark unhold linux-aws linux-image-aws linux-headers-aws

cat /var/run/reboot-required /var/run/reboot-required.pkgs

*** System restart required ***
linux-image-7.0.0-1015-aws
linux-base

sudo needrestart -r l

Services to be restarted:
 systemctl restart apache2.service
 systemctl restart cron.service

sudo apt-mark hold containerd
apt-mark showhold

containerd set on hold.
containerd

cat /etc/apt/apt.conf.d/20auto-upgrades

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

grep -E '^(Start-Date|Commandline|Upgrade)' /var/log/apt/history.log | tail -6

Start-Date: 2026-10-24  06:38:33
Commandline: /usr/bin/unattended-upgrade
Upgrade: zlib1g:arm64 (1:1.3.dfsg+really1.3.1-1ubuntu3.1, 1:1.3.dfsg+really1.3.1-1ubuntu3.2)
Start-Date: 2026-10-24  13:40:30
Commandline: apt install --only-upgrade openssh-server
Upgrade: openssh-server:arm64 (1:10.2p1-2ubuntu3.7, 1:10.2p1-2ubuntu3.8)

snap refresh --list

Name    Version   Rev   Size    Publisher    Notes
core22  20260909  2988  72.4MB  canonical**  base

pip list --user --outdated

Package  Version Latest Type
-------- ------- ------ -----
requests 2.32.3  2.32.5 wheel

sudo apt install openssh-server=1:10.2p1-2ubuntu3

do-release-upgrade -c

Checking for a new Ubuntu release
New release '26.04.1 LTS' available.
Run 'do-release-upgrade' to upgrade to it.

Checking for a new Ubuntu release
There is no development version of an LTS available.

1. PHP が入っているか、どこから入れたかを確認する
2. Ubuntu の CVE トラッカーで、修正済みのバージョンを確認する
3. apt update して、修正版が届いているかを見る
4. PHP のパッケージだけをシミュレーション → 更新する
5. changelog で CVE が修正されていることを確認する
6. PHP を読み込んでいるサービスを再起動する
7. apt の管理外の PHP がないかを確認する

apt list --installed '*php*' 2>/dev/null

Listing...
libapache2-mod-php8.5/resolute-updates,resolute-security,now 8.5.4-0ubuntu1.4 arm64 [installed,automatic]
php-common/resolute,now 2:96ubuntu1 all [installed,automatic]
php8.5-cli/resolute-updates,resolute-security,now 8.5.4-0ubuntu1.4 arm64 [installed,automatic]
php8.5-common/resolute-updates,resolute-security,now 8.5.4-0ubuntu1.4 arm64 [installed,automatic]
php8.5-mysql/resolute-updates,resolute-security,now 8.5.4-0ubuntu1.4 arm64 [installed,automatic]
php8.5-opcache/resolute-updates,resolute-security,now 8.5.4-0ubuntu1.4 arm64 [installed,automatic]
php8.5-readline/resolute-updates,resolute-security,now 8.5.4-0ubuntu1.4 arm64 [installed,automatic]
php/resolute,now 2:8.5+96ubuntu1 all [installed]

dpkg-query -W -f='${Package}\t${source:Package}\t${Version}\n' '*php*'

libapache2-mod-php8.5	php8.5	8.5.4-0ubuntu1.4
php	php-defaults	2:8.5+96ubuntu1
php-common	php-defaults	2:96ubuntu1
php8.5-cli	php8.5	8.5.4-0ubuntu1.4
php8.5-common	php8.5	8.5.4-0ubuntu1.4
php8.5-mysql	php8.5	8.5.4-0ubuntu1.4
php8.5-opcache	php8.5	8.5.4-0ubuntu1.4
php8.5-readline	php8.5	8.5.4-0ubuntu1.4

apt policy php8.5-common

php8.5-common:
  Installed: 8.5.4-0ubuntu1.4
  Candidate: 8.5.4-0ubuntu1.4
  Version table:
 *** 8.5.4-0ubuntu1.4 500
        500 http://ap-northeast-1.ec2.archive.ubuntu.com/ubuntu resolute-updates/main arm64 Packages
        500 http://security.ubuntu.com/ubuntu resolute-security/main arm64 Packages
        100 /var/lib/dpkg/status
     8.5.4-0ubuntu1 500
        500 http://ap-northeast-1.ec2.archive.ubuntu.com/ubuntu resolute/main arm64 Packages

dpkg --compare-versions 8.5.4-0ubuntu1.4 lt 8.5.4-0ubuntu1.5 && echo "修正前のバージョンです"

修正前のバージョンです

grep -A2 'Start-Date: 2026-10-2' /var/log/apt/history.log | grep -i php

sudo apt update
apt list --upgradable '*php*' 2>/dev/null

Listing...
libapache2-mod-php8.5/resolute-updates,resolute-security 8.5.4-0ubuntu1.5 arm64 [upgradable from: 8.5.4-0ubuntu1.4]
php8.5-cli/resolute-updates,resolute-security 8.5.4-0ubuntu1.5 arm64 [upgradable from: 8.5.4-0ubuntu1.4]
php8.5-common/resolute-updates,resolute-security 8.5.4-0ubuntu1.5 arm64 [upgradable from: 8.5.4-0ubuntu1.4]
php8.5-mysql/resolute-updates,resolute-security 8.5.4-0ubuntu1.5 arm64 [upgradable from: 8.5.4-0ubuntu1.4]
php8.5-opcache/resolute-updates,resolute-security 8.5.4-0ubuntu1.5 arm64 [upgradable from: 8.5.4-0ubuntu1.4]
php8.5-readline/resolute-updates,resolute-security 8.5.4-0ubuntu1.5 arm64 [upgradable from: 8.5.4-0ubuntu1.4]

PKGS=$(dpkg-query -W -f='${db:Status-Abbrev} ${Package} ${source:Package}\n' \
  | awk '$1 == "ii" && $3 == "php8.5" { print $2 }')
echo $PKGS

libapache2-mod-php8.5 php8.5-cli php8.5-common php8.5-mysql php8.5-opcache php8.5-readline

apt -s install --only-upgrade $PKGS

NOTE: This is only a simulation!
...
Upgrading:
  libapache2-mod-php8.5  php8.5-common  php8.5-opcache
  php8.5-cli             php8.5-mysql   php8.5-readline

Summary:
  Upgrading: 6, Installing: 0, Removing: 0, Not Upgrading: 10

sudo apt install --only-upgrade $PKGS

Setting up php8.5-common (8.5.4-0ubuntu1.5) ...
Setting up php8.5-cli (8.5.4-0ubuntu1.5) ...
Setting up libapache2-mod-php8.5 (8.5.4-0ubuntu1.5) ...
...

dpkg-query -W -f='${Package}\t${Version}\n' $PKGS

libapache2-mod-php8.5	8.5.4-0ubuntu1.5
php8.5-cli	8.5.4-0ubuntu1.5
php8.5-common	8.5.4-0ubuntu1.5
php8.5-mysql	8.5.4-0ubuntu1.5
php8.5-opcache	8.5.4-0ubuntu1.5
php8.5-readline	8.5.4-0ubuntu1.5

apt changelog php8.5-common | grep -E 'CVE-2026-10961[89]'

    - debian/patches/CVE-2026-109618.patch: fix request cleanup after
    - CVE-2026-109618
    - debian/patches/CVE-2026-109619.patch: fix use-after-free in
    - CVE-2026-109619

sudo needrestart -r l

Services to be restarted:
 systemctl restart apache2.service

sudo systemctl restart apache2
systemctl status apache2 --no-pager | head -3

● apache2.service - The Apache HTTP Server
     Loaded: loaded (/usr/lib/systemd/system/apache2.service; enabled; preset: enabled)
     Active: active (running) since Sun 2026-10-25 10:12:41 JST; 4s ago

which -a php

/usr/bin/php

sudo docker ps --format '{{.Names}}\t{{.Image}}' | grep -i php

legacy-app	php:8.5.11-apache

sudo apt install lynis
sudo lynis audit system

  Lynis security scan details:

  Hardening index : 64 [############        ]
  Tests performed : 268