{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"cs/patch","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/cs/patch/","da":"https://cmaintz.github.io/tech-atlas/da/terms/cs/patch/"},"term":{"en":"Patch","da":"Patch"},"aka":{"en":["security update","software update"],"da":["sikkerhedsopdatering","opdatering","rettelse"]},"domain":["cs"],"cluster":"os","layer":"os","status":"current","summary":{"en":"A small piece of software from a vendor that fixes a flaw - often a vulnerability - in a program already installed.","da":"Et lille stykke software fra en leverandør, der retter en fejl - ofte en sårbarhed - i et program, som allerede er installeret."},"body":{"formal":{"en":"A change published by a software vendor that replaces part of an installed program or operating system to correct a fault, close a vulnerability or add a small improvement, without installing everything again.","da":"En ændring, som en softwareleverandør udgiver, og som erstatter en del af et installeret program eller styresystem for at rette en fejl, lukke en sårbarhed eller tilføje en lille forbedring uden at geninstallere det hele."},"plain":{"en":"Like a car maker calling cars back so the garage can swap one faulty part - the car stays the same, but the known defect is gone.","da":"Som når en bilproducent kalder biler tilbage, og værkstedet udskifter en enkelt defekt del - bilen er den samme, men den kendte fejl er væk."},"inPractice":{"en":"Microsoft releases patches on the second Tuesday of each month. A region's IT operations team tries them on a small group of computers first, then rolls them out to the hospitals' other machines within a week.","da":"Microsoft udgiver patches den anden tirsdag i hver måned. En regions IT-drift afprøver dem først på en lille gruppe computere og ruller dem derefter ud til hospitalernes øvrige maskiner inden for en uge."},"whyItMatters":{"en":"Once a patch is out, attackers study it to learn the flaw, so machines left without the patch become easy targets - a common way in for ransomware.","da":"Når en patch er udgivet, studerer angribere den for at finde fejlen, så maskiner uden patchen bliver lette mål - en almindelig vej ind for ransomware."}},"deepDive":{"en":"Technically a patch ranges from a literal diff applied to source code (the unified diff format of diff/patch and git) to a binary delta, a replacement package version or a cumulative update. Windows now ships monthly cumulative updates, so each one contains all earlier fixes and machines cannot selectively skip one; Linux distributions ship rebuilt packages, often backporting a security fix into an older upstream version, which is why a vulnerability scanner that compares only version strings reports false positives on RHEL or Debian. Firmware, BIOS/UEFI, network appliances and embedded devices have their own, frequently manual, update channels and are the most commonly forgotten.\n\nMicrosoft's Patch Tuesday, the second Tuesday of each month, dates from 2003 and was adopted in similar form by Adobe, SAP and others; Oracle uses quarterly Critical Patch Updates. Out-of-band releases follow for actively exploited flaws. Publication starts a race, because attackers diff patched and unpatched binaries to derive the vulnerability (\"patch diffing\"), sometimes producing working exploits within days. Prioritisation therefore should not rely on CVSS base scores alone (CVSS v4.0 was released in November 2023) but combine them with exploitation evidence such as the CISA Known Exploited Vulnerabilities catalogue, which under Binding Operational Directive 22-01 US federal agencies must remediate within fixed deadlines, typically two weeks for newer CVEs, and with probability estimates such as EPSS and the asset's exposure.\n\nNIST SP 800-40 Rev. 4 (April 2022) recasts patching as preventive maintenance with a defined risk response for each asset class: patch within a maintenance plan, apply an emergency cycle for severe exploited flaws, mitigate with configuration or network controls when no patch exists, or accept and document residual risk. A mature process has an up-to-date asset inventory, test rings (pilot, broad, critical systems), rollback plans, maintenance windows agreed with the business, and verification afterwards through scanning or configuration management, since \"deployed\" is not the same as \"installed and rebooted\". ISO/IEC 27001:2022 control 8.8 (management of technical vulnerabilities) is the usual audit anchor, and NIS2 Art. 21(2)(e) requires vulnerability handling and disclosure as part of cybersecurity risk-management measures.\n\nRegulation is now reaching the vendor side. Under the EU Cyber Resilience Act (Regulation (EU) 2024/2847), manufacturers of products with digital elements must, from 11 September 2026, notify actively exploited vulnerabilities and severe incidents to their CSIRT and ENISA (early warning within 24 hours), while the obligation to provide free security updates throughout a declared support period applies with the main requirements from 11 December 2027. Patches can also be the attack vector: compromised update infrastructure delivered malware in NotPetya (via M.E.Doc, 2017) and SolarWinds Orion (2020), which is why updates must be signed and their signing keys protected. A patch fixes a defect; a workaround or mitigation only reduces exposure and should be tracked until the real fix is applied.","da":"Teknisk spænder en patch fra en bogstavelig diff, der anvendes på kildekode (det samlede diff-format fra diff/patch og git), over en binær delta og en ny pakkeversion til en kumulativ opdatering. Windows udsender nu månedlige kumulative opdateringer, så hver enkelt indeholder alle tidligere rettelser, og maskiner kan ikke selektivt springe én over; Linux-distributioner udsender genbyggede pakker og backporter ofte en sikkerhedsrettelse til en ældre upstream-version, hvilket er grunden til, at en sårbarhedsscanner, der kun sammenligner versionsnumre, giver falske positiver på RHEL eller Debian. Firmware, BIOS/UEFI, netværksudstyr og indlejrede enheder har deres egne, ofte manuelle, opdateringskanaler og er dem, der oftest bliver glemt.\n\nMicrosofts Patch Tuesday, anden tirsdag i hver måned, stammer fra 2003 og er i lignende form overtaget af Adobe, SAP og andre; Oracle bruger kvartalsvise Critical Patch Updates. Ekstraordinære udgivelser følger ved aktivt udnyttede fejl. Udgivelsen starter et kapløb, fordi angribere sammenligner patchede og upatchede binære filer for at finde sårbarheden (patch diffing) og nogle gange har fungerende exploits klar inden for få dage. Prioritering bør derfor ikke hvile på CVSS-basisscoren alene (CVSS v4.0 kom i november 2023), men kombinere den med tegn på udnyttelse, fx CISA's Known Exploited Vulnerabilities-katalog, som amerikanske føderale myndigheder efter Binding Operational Directive 22-01 skal afhjælpe inden for faste frister, typisk to uger for nyere CVE'er, med sandsynlighedsestimater som EPSS og med aktivets eksponering.\n\nNIST SP 800-40 Rev. 4 (april 2022) beskriver patching som forebyggende vedligehold med en fastlagt risikohåndtering for hver aktivklasse: patch inden for en vedligeholdelsesplan, kør en nødcyklus ved alvorlige udnyttede fejl, afbød med konfiguration eller netværkskontroller, når der ikke findes en patch, eller accepter og dokumenter restrisikoen. En moden proces har en opdateret aktivfortegnelse, testringe (pilot, bred udrulning, kritiske systemer), planer for tilbagerulning, servicevinduer aftalt med forretningen og efterfølgende verifikation via scanning eller konfigurationsstyring, fordi \"udrullet\" ikke er det samme som \"installeret og genstartet\". ISO/IEC 27001:2022 kontrol 8.8 (håndtering af tekniske sårbarheder) er det sædvanlige revisionsankerpunkt, og NIS2 art. 21, stk. 2, litra e, kræver håndtering og offentliggørelse af sårbarheder som en del af foranstaltningerne til styring af cybersikkerhedsrisici.\n\nReguleringen når nu også leverandørsiden. Efter EU's Cyber Resilience Act (forordning (EU) 2024/2847) skal producenter af produkter med digitale elementer fra 11. september 2026 underrette deres CSIRT og ENISA om aktivt udnyttede sårbarheder og alvorlige hændelser (tidlig varsling inden for 24 timer), mens pligten til at levere gratis sikkerhedsopdateringer i hele en oplyst supportperiode gælder sammen med hovedkravene fra 11. december 2027. Patches kan også selv være angrebsvejen: kompromitteret opdateringsinfrastruktur leverede malware i NotPetya (via M.E.Doc, 2017) og SolarWinds Orion (2020), og derfor skal opdateringer være signerede og signeringsnøglerne beskyttede. En patch retter en fejl; en workaround eller afbødning mindsker kun eksponeringen og bør følges, indtil den egentlige rettelse er installeret."},"edges":[{"type":"mitigates","to":"security/vulnerability","why":{"en":"A patch removes the specific flaw an attacker would otherwise abuse.","da":"En patch fjerner netop den fejl, en angriber ellers ville udnytte."},"confidence":"high","strength":"primary"},{"type":"used-with","to":"security/vulnerability-scanning","why":{"en":"Scanning reveals which machines are missing which patches.","da":"Scanning afslører, hvilke maskiner der mangler hvilke patches."},"confidence":"high","strength":"normal"}],"depth":0,"sources":[{"title":"NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning","url":"https://doi.org/10.6028/NIST.SP.800-40r4","tier":"standard","publisher":"NIST"},{"title":"Cyber Resilience Act - policy page","url":"https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act","tier":"official-doc","publisher":"European Commission"}],"draft":true}