trivy reports CVEs in Ubuntu ESM packages with "no fixed version available" - the agent can't tell patched from...

TL;DR

Ubuntu ESM backports security fixes without bumping to a normally "fixed" version, so trivy reports the CVE with no fixed version available. That does not mean the package is unpatched. Check the installed version against the fixed version on the Ubuntu CVE tracker, confirm the ESM pocket is enabled, and only then mark the finding handled, with the evidence attached.

The query

trivy reports CVEs in Ubuntu ESM packages with "no fixed version available" - the agent can't tell patched from unpatched

Use this when

• trivy flags CVEs on Ubuntu packages with "no fixed version available"
• The image uses Ubuntu Pro or ESM (check for the esm-apps or esm-infra pocket)
• You need an evidence trail that an ESM package is actually patched

Not for

• Non-Ubuntu images (Debian, Alpine, RHEL track fixes differently)
• Packages with a listed fixed version you have not installed yet (just patch those)
• Marking findings handled without checking the installed version

Steps

1. Confirm the package is ESM-tracked

apt list --installed 2>/dev/null | grep -i esm; pro status 2>/dev/null | head -20

Expected output: confirmation that ESM apps or infra is enabled and which pocket the package comes from.

2. Get the installed version

dpkg -l [package-name] | tail -1

Expected output: the exact installed version string, including the Ubuntu revision suffix.

3. Look up the CVE on the Ubuntu CVE tracker

Open the Ubuntu CVE tracker page for the CVE ID and find the fixed version listed for your Ubuntu release and ESM pocket. Compare it against the installed version: installed equal to or newer than the tracker fixed version means patched.

Expected output: a clear patched or unpatched verdict for that package and CVE.

4. Record the evidence on the finding

Write the installed version, the tracker fixed version, and the tracker URL into the ticket or finding note. An agent should store this as structured evidence, not just a "handled" flag, so the next rescan does not reopen the question.

Expected output: the finding carries version evidence anyone can re-verify.

5. Teach the pipeline the ESM rule

Add a triage rule: ESM-pocket findings with installed version at or above the tracker fixed version are "patched via ESM", not "no fix available". Verify: the next scan run auto-resolves these instead of re-flagging them.

Variant phrasings

trivy ubuntu esm no fixed version

The short form, same triage rule.

ubuntu ESM package flagged CVE patched or not

The underlying question operators ask before closing the ticket.

Compatibility: trivy scanning Ubuntu 18.04+ images with ESM enabled. The Ubuntu CVE tracker is the source of truth for fixed versions.

Why it happens

ESM delivers security backports to a stable package version rather than moving you to a new upstream release. Trivy's matcher sees a CVE whose fixed version does not map to a normal version bump and reports "no fixed version available". The fix exists; it is just expressed as a backported patch in the same version line, which only the Ubuntu CVE tracker describes accurately.

Edge cases / pitfalls

• ESM enablement can lapse. A package that was patched via ESM last month is unpatched today if the subscription expired, so re-verify enablement, not just versions.
• The tracker lists per-release fixed versions. Compare against your release's row, not the newest Ubuntu release.
• Some CVEs are marked "needed" with no fixed version yet even under ESM. Those are genuinely unpatched: track them, do not close them.
• Base-image rebuilds can silently drop ESM enablement. Verify pro status in the built image, not just the Dockerfile intent.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_z9vf605T-TcYGVR-67PoJA