# WTF are patches and advisories?

> Sarge says: The advisory is your orders. The patch is the fix. Read one, apply the other.

- Term: Patch and advisory
- Also called: patch; security patch; advisory; security advisory; vendor advisory; release notes; upgrade to version; fixed version; affected versions
- Section: The basics
- Web page: https://codemarine.ai/learn/patch-and-advisory/

## Short version

An advisory tells you what is broken and which versions are hit. A patch is the fix.

## Life of a bug

1. **Flaw found:** Someone spots a security flaw in a product.
2. **CVE assigned:** A CVE Numbering Authority gives it an ID, so everyone means the same bug.
3. **Advisory:** The official notice: what is broken and which versions are hit.
4. **Patch:** The update that repairs the flaw. Attackers read advisories too.
5. **Exploited, added to CISA KEV:** Attackers hit real targets. With reliable evidence and a clear fix, it goes on the list.
6. **You patch:** Move to the fixed version, then check for signs of compromise.

Real bugs do not always march in this order. A zero-day is attacked before any fix exists, and plenty of bugs never reach step 5.

## The briefing

- **Advisory:** The official notice about a flaw. A useful one gives a description, the severity, the affected versions and the patched versions, plus any workaround.
- **Who publishes them:** GitHub advisories carry those fields, and vendors publish their own.
- **Patch:** The update that repairs the flaw. CISA describes patches as software and operating system updates that address security vulnerabilities.
- **Release notes:** The changelog for that update. A security fix can get one dull line in there, so read the advisory as well.
- **"Upgrade to version X":** X is the fixed version, usually the earliest one. Any version in the affected range is a target until you move to X or later.
- **Trap: no fix version:** A malicious package has none. GitHub says the only safe course is not to use the package at all.
- **Trap: the quiet patch:** A patch closes the hole without telling you who came through it first.

## In the Threat Brief this looks like

> Affected: ExampleApp 2.0 to 2.3.4. Upgrade to version 2.3.5.

Everything in that range is a target until you run 2.3.5 or later.

Example only. The product, versions and names are made up.

## What to do

- Check the version you actually run, including copies buried in your dependency tree. Lock files such as package-lock.json will show them.
- Update as soon as you can and turn on automatic updates where that makes sense.
- Get updates from the vendor directly. CISA warns that attackers use emails to push malicious files disguised as legitimate updates, so do not trust the link in the message.

## Official sources

- [CISA: Understanding Patches and Software Updates](https://www.cisa.gov/news-events/news/understanding-patches-and-software-updates)
- [CISA: Cybersecurity Alerts and Advisories](https://www.cisa.gov/news-events/cybersecurity-advisories)
- [NIST CSRC Glossary: patch](https://csrc.nist.gov/glossary/term/patch)
- [GitHub Docs: Repository security advisories](https://docs.github.com/en/code-security/concepts/vulnerability-reporting-and-management/repository-security-advisories)
- [GitHub Docs: GitHub Advisory Database](https://docs.github.com/en/code-security/concepts/vulnerability-reporting-and-management/github-advisory-database)

## Related

- [CVE](https://codemarine.ai/learn/wtf-is-a-cve.md)
- [Zero-day](https://codemarine.ai/learn/zero-day.md)
- [Indicators of compromise](https://codemarine.ai/learn/indicators-of-compromise.md)