STIGQter: STIG Summary: Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide Version: 1 Release: 6 Benchmark Date: 01 Jul 2026:

Ubuntu 24.04 LTS must be configured so that Advance Package Tool (APT) removes all software components after updated versions have been installed.

DISA Rule

SV-270773r1066808_rule

Vulnerability Number

V-270773

Group Title

SRG-OS-000437-GPOS-00194

Rule Version

UBTU-24-700320

Severity

CAT II

CCI(s)

• CCI-002617 - Remove previous versions of organization-defined software components after updated versions have been installed.

Weight

10

Fix Recommendation

Configure APT to remove all software components after updated versions have been installed.

Add or update the following options to the "/etc/apt/apt.conf.d/50unattended-upgrades" file:

Unattended-Upgrade::Remove-Unused-Dependencies "true";
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";

Check Contents

Verify APT is configured to remove all software components after updated versions have been installed with the following command:

$ grep -i remove-unused /etc/apt/apt.conf.d/50unattended-upgrades
Unattended-Upgrade::Remove-Unused-Dependencies "true";
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";

If the "::Remove-Unused-Dependencies" and "::Remove-Unused-Kernel-Packages" parameters are not set to "true", are commented out, or are missing, this is a finding.

Vulnerability Number

V-270773

Documentable

False

Rule Version

UBTU-24-700320

Severity Override Guidance

Verify APT is configured to remove all software components after updated versions have been installed with the following command:

$ grep -i remove-unused /etc/apt/apt.conf.d/50unattended-upgrades
Unattended-Upgrade::Remove-Unused-Dependencies "true";
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";

If the "::Remove-Unused-Dependencies" and "::Remove-Unused-Kernel-Packages" parameters are not set to "true", are commented out, or are missing, this is a finding.

Check Content Reference

M

Target Key

5673