CB-DEB-PKG-009: Run a Debian release that still receives security updates (v0.1.0)

Description

The Debian security team supports each stable release for about three years, until about one year after the next stable release. The Debian LTS team then extends security support to five years in total, for the most used architectures and packages. After that, no security update is published. The testing and unstable distributions get no security support either.

On 2026-10-18: Debian 12 "bookworm" is in LTS (regular security support ended in June 2026, LTS until June 2028); Debian 13 "trixie" has regular security support. Update the supported_versions parameter as releases reach end of life (see the Debian releases and LTS pages), and plan upgrades before the date rather than after.

Rationale

An unsupported release accumulates known, public, unfixed vulnerabilities. No configuration hardening compensates for that.

Impact

Upgrading to the next stable release needs planning and testing of the hosted applications.

Setting

Location	/etc/os-release
Recommended	One of the supported versions: {{ supported_versions }}

Parameters

Parameter	Core	Server	Server hardened	Desktop	Desktop hardened	Bounds
`supported_versions`list. Debian major versions accepted as supported. Hardened profiles only accept releases under regular security support, not LTS.	`12, 13`	`12, 13`	`13`	`12, 13`	`13`

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

Run cat /etc/debian_version and compare with the dates on https://www.debian.org/releases/ and https://wiki.debian.org/LTS. The release must still be supported, and must not be testing or unstable (/etc/debian_version ending in /sid).

Automated: every check must pass. Scanners report each check by its id.

`release`

Major version from /etc/os-release, against the supported list.

engine: POSIX shell

script: |
  v=$( (. /etc/os-release && printf '%s' "${VERSION_ID:-}") 2>/dev/null)
  d=$(cat /etc/debian_version 2>/dev/null)
  echo "debian_version $d, VERSION_ID ${v:-none}, supported: $CB_SUPPORTED_VERSIONS"
  case $d in */sid) exit 1 ;; esac
  for s in $CB_SUPPORTED_VERSIONS; do
    [ "$s" = "${v%%.*}" ] && exit 0
  done
  exit 1

Remediation

Upgrade to a supported stable release, following the upgrade chapter of the release notes of the target release (one release at a time). Move systems running testing or unstable to a stable release.

References

Debian Releases Debian, vendor-doc, accessed 2026-10-18
Debian Wiki - LTS Debian, vendor-doc, accessed 2026-10-18
Debian Security FAQ Debian, vendor-doc, accessed 2026-10-18

Mappings

Framework	ID	Relation
ANSSI-BP-028 - Recommandations de configuration d'un système GNU/Linux2.0	`R61`	related
NIST SP 800-53 Rev. 55.1.1	`SA-22`	equivalent

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Taxonomy	ID
MITRE ATT&CK	`T1190`
Common Weakness Enumeration	`CWE-1104`

related CB-DEB-PKG-008 Leave no security update pending

People and lifecycle

Authors	Alice@Sn0wAlice
Verified	2026-10-18 by Sn0wAlice on 12, Proxmox VM, Debian 12 genericcloud image, kernel 6.1.0-54-cloud-amd64. Passes with the default list; fails when the list excludes the running version.
Verified	2026-10-18 by Sn0wAlice on 13, Proxmox VM, Debian 13 genericcloud image, kernel 6.12.113+deb13-cloud-amd64. Passes with the default list; fails when the list excludes the running version.
Introduced in	v0.1.0
Created, updated	2026-10-18, 2026-10-18
Translations	`fr`