patchlag · data as of …

How long until your distro ships the fix?

Loading…

Table view

Same CVE: who shipped first?

Only CVEs both releases fixed; kernel rows compare the same package, exploited-CVE rows the first fix per release. Positive = the second release shipped later.

Actively exploited CVEs with no fix shipped yet

CISA KEV entries the distro's own tracker lists as affected (and, on Ubuntu, present and triaged in Canonical's CVE tracker) with no fix in any non-browser package. The tracker's own state is shown next to each package: end-of-life, unimportant and ignored mean the distro decided not to fix it. Days counted from public disclosure.

How this is measured

Unit. A (CVE, release, source package) the distro's own tracker lists as affected. Kernel CVEs use the main kernel package only. Exploited CVEs are collapsed to one unit per (CVE, release), kernel flavours and browsers left out: Ubuntu ships a dozen kernel flavours, and Chromium and Firefox are snaps on Ubuntu, outside its security tracker.
Matched comparisons use only CVEs published after both releases existed and that both trackers list as exposed at disclosure, so neither side gets an easier mix.
Clock. Starts at the CVE's public disclosure, ends when the fixed package reached the archive users pull from: -security/-updates on Ubuntu (Launchpad), debian-security on Debian (snapshot.debian.org), or the advisory date (USN, DSA, RHSA), whichever came first.
Unfixed is censored, not dropped. A CVE still open has taken at least as long as it has been public. Kaplan–Meier curves use that; averages over fixed CVEs only would flatter slow distros.
Not counted: fixes that shipped before disclosure (kernel CVEs are often assigned to fixes already released), CVEs published before a release existed, and Ubuntu Livepatch, which can patch a running kernel without a package update.

Sources: CISA KEV, OSV.dev exports of Debian, Ubuntu and kernel.org advisories, the Debian security tracker, the Red Hat Security Data API, Launchpad, snapshot.debian.org. Code, data and every caveat: github.com/TheWingTheWong/patchlag.