STIGQter STIGQter: STIG Summary: Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

Ubuntu 22.04 LTS must be configured so that the Advance Package Tool (APT) removes all software components after updated versions have been installed.

DISA Rule

SV-260477r1044773_rule

Vulnerability Number

V-260477

Group Title

SRG-OS-000437-GPOS-00194

Rule Version

UBTU-22-214015

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure APT to remove all software components after updated versions have been installed.

Add or modify the following lines in the "/etc/apt/apt.conf.d/50unattended-upgrades" file:

Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
Unattended-Upgrade::Remove-Unused-Dependencies "true";

Check Contents

Verify APT is configured to remove all software components after updated versions have been installed by using the following command:

$ grep -i remove-unused /etc/apt/apt.conf.d/50unattended-upgrades
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
Unattended-Upgrade::Remove-Unused-Dependencies "true";

If "Unattended-Upgrade::Remove-Unused-Kernel-Packages" and "Unattended-Upgrade::Remove-Unused-Dependencies" are not set to "true", are commented out, or are missing, this is a finding.

Vulnerability Number

V-260477

Documentable

False

Rule Version

UBTU-22-214015

Severity Override Guidance

Verify APT is configured to remove all software components after updated versions have been installed by using the following command:

$ grep -i remove-unused /etc/apt/apt.conf.d/50unattended-upgrades
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
Unattended-Upgrade::Remove-Unused-Dependencies "true";

If "Unattended-Upgrade::Remove-Unused-Kernel-Packages" and "Unattended-Upgrade::Remove-Unused-Dependencies" are not set to "true", are commented out, or are missing, this is a finding.

Check Content Reference

M

Target Key

5594