A vulnerability report landed on my desk the other day. A spreadsheet export from Tenable: 280 findings across 15 Ubuntu 22.04 servers, 39 of them critical, 68 high. The kind of attachment that makes you mentally cancel your week.
Don't read it top to bottom
The worst thing you can do with a report like this is start at row one and work your way down. Scanners report per host, per plugin, per version bump, so one root cause fans out into dozens of rows. Ten minutes with a pivot table (or a short Python script, which is what I did) collapses the noise.
Grouped by package, the scary spreadsheet turned into this: 162 of the 280 findings, including 24 of the 39 criticals, were ImageMagick and its delegate libraries (libheif, libde265, OpenEXR) on six web servers. One package family. Fifty-eight percent of the report.
The rest was routine apt full-upgrade material (kernel, OpenSSL, MySQL, the usual suspects), a couple of Apache config findings, and a batch of items that belonged to another team entirely (expired certs, an endpoint agent with its own bundled OpenSSL).
Nobody was using it
The installed package was apt's imagemagick 8:6.9.11.60, sitting there since who knows when. Before touching it, I checked what actually needs it:
apt-cache rdepends --installed imagemagick imagemagick-6.q16
sudo grep -rl 'convert\|mogrify\|identify' /etc/cron* /var/spool/cronNothing. I also grepped all three codebases deployed on those boxes for Imagick, imagemagick, convert, mogrify. Not a single reference. The package was installed, exposed in every scan, patched by nobody, and used by nothing.
So instead of upgrading it, we removed it:
sudo apt purge 'imagemagick*' 'libmagickcore*' 'libmagickwand*'
sudo apt autoremove --purgeThe autoremove swept up the delegate libraries too, which were another 36 findings on their own. One purge, 162 findings resolved.
The part where patching wouldn't have helped anyway
Here's the twist that made removal the only sane option. Of those 162 findings, 72 came from generic Nessus plugins with names like "ImageMagick < 6.9.13-44 Multiple Vulnerabilities". These plugins compare the upstream version string, and the installed version reports 6.9.11.60.
But Ubuntu doesn't ship 6.9.13. Ubuntu backports the security fixes into 6.9.11.60 and bumps the Debian revision. The CVE gets fixed, the version string doesn't move, and the scanner keeps flagging it. Forever.
So even after a full apt upgrade, those 72 findings would have reappeared in the next scan cycle, and the cycle after that, each one needing a manual dispute with a backport rationale attached. "Yes, it says 6.9.11.60. Yes, it's patched. Here's the changelog. See you next month."
You can't false-positive your way out of a package that isn't there.
The box next door needs it
One caveat before you go purging ImageMagick across your fleet. The same environment has a pair of PDF processing servers, and the software running there absolutely does use ImageMagick for its conversion pipeline. Same fleet, same report, opposite answer.
That's why the pre-check matters and why the purge was scoped to the web servers only. "Is this package used?" is a per-role question, not a per-fleet question. The scanner won't tell you the difference; it just counts installed versions. Interestingly, the PDF boxes had zero ImageMagick findings this cycle, presumably because someone who actually uses a package also keeps it updated.
Takeaway
Vulnerability reports count findings, not causes. Two hundred eighty rows compressed into four root causes, and the biggest one wasn't a patching problem at all, it was an inventory problem. The cheapest patch in the world is removing software you don't run.
So next time a security spreadsheet ruins your morning, don't start reading. Start grouping.
Staring at a vulnerability report of your own? Send me your problem and I'll take a look.