When a scanner shows no fixed version, check your distribution's own tracker for your exact release. The answer is one of four: a fix exists and the scanner is stale, a fix is in progress, the vendor deferred or ignored it, or your release is not affected. Write down which, with the date.
Why a scanner can be blank
A scanner copies data from advisories. It can be blank because no fix exists, because the data feed lags the vendor, or because the vendor tracks the package under a source name your scanner did not map. Treat blank as a question, not an answer.
Debian
The Debian security tracker says its data comes from the security team's own database, built from Debian security advisories, the CVE database, the National Vulnerability Database and issues reported in the bug tracker. You can search it by CVE id or package name. The front page also lists useful groups, such as vulnerable packages in the stable suite, issues that need checking, and open issues rated unimportant.
Steps:
- Search the CVE id or the source package name.
- Find the row for your release name, for example the stable release your image uses.
- Read the status and the fixed version, if any.
- Compare the fixed version with your installed version using the package manager. See what the fixed version means.
Statuses such as no DSA or postponed are explained in Debian tracker statuses. Remember to look up the source package, not the binary name, since the tracker is organised by source. See why one CVE lists several packages.
Ubuntu
Canonical's CVE pages show the status for each package and release, with notes. The documented statuses include needs evaluation, not affected, vulnerable, work in progress, fix deferred, fixed, ignored and not in release. The fixed status usually carries the version number that contains the patch. Canonical advises checking the individual CVE page for the package and release you use, since the summary aggregates across all of them. See Ubuntu statuses explained.
What to record
| Field | Example content |
|---|---|
| CVE and package | The id and the source package name |
| Release checked | The exact OS release of the image |
| Tracker status | The vendor's words |
| Fixed version | Version or none |
| Date checked | Today's date |
| Decision | Rebuild, wait, exception or close |
A dated record turns a blank into evidence. If the status later changes, you know when to revisit.
What to do for each result
- Fixed version exists: rebuild with a fresh pull and confirm. See confirming a fix landed.
- In progress: set a re-check date.
- Deferred or ignored: assess reachability and write an exception. See no fix available.
- Not affected: close with the vendor note attached.
Where Safeguard fits
Safeguard's SBOM and dependency scanning supplies the package and version to look up, and reachability analysis helps decide when a deferred issue matters. Free scan: gold.safeguard.sh/scan.
Quick check
Should I trust the tracker over my scanner?
For your OS packages, the vendor's tracker is the primary source. Report differences to your scanner's support.
Do I need to check every blank row by hand?
Start with reachable and high severity ones. Batch the rest by source package.
Sources
Last reviewed: 19 October 2026.
