check_debsecan
Monitoring/Nagios plugin for Debian - Checks the Debian CVE database against all installed packages on your system
Usage
Usage: check_debsecan [OPTIONS]
Arguments:
-f warning value for fixed packages | default = 20
-F critical value for fixed packages | default = 30
-o warning value for obsolete packages | default = 1
-O critical value for obsolete packages | default = 1
-l warning value for "low urgency" fixes | default = 10
-L critical value for "low urgency" fixes | default = 20
-m warning value for "medium urgency" fixes | default = 5
-M critical value for "medium urgency" fixes | default = 10
-u warning value for urgent "high urgency" fixes | default = 1
-U critical value for urgent "high urgency" fixes | default = 1
-s set the suite parameter manually
-P "[proxy-url]" set the proxy manually
Options:
-d produces debugging output
-r disables the cve/packages report
-h print this help
Result
OK: (F:7;O:0;H:0;M:3;L:1) - 7 security fixes ready to install found!
CVE-2016-8864 libdns-export100 (fixed, remotely exploitable, medium urgency)
CVE-2017-3135 libdns-export100 (fixed)
CVE-2017-5848 gstreamer1.0-plugins-bad (fixed, remotely exploitable, low urgency)
TEMP-0000000-1E5903 libgraphicsmagick-q16-3 (fixed)
CVE-2016-7444 libgnutls-deb0-28 (fixed, remotely exploitable, medium urgency)
CVE-2017-5334 libgnutls-deb0-28 (fixed)
CVE-2017-5027 chromium (fixed, remotely exploitable, medium urgency)
| 'fixed'=7;20;30;0;30 'obsolete'=0;1;1;0;1 'high-urgency'=0;1;1;0;1 'medium-urgency'=3;5;10;0;10 'low-urgency'=1;10;20;0;20
The default thresholds of the check are relatively high, so if you want to check for all CVE's just set -f 1 -F 1 so every CVE popping up will force the check to CRITICAL.