Debian dla-4548 : distro-info-data - security update

distro-info-data is a small Debian data package that ships release and end-of-life metadata used by lifecycle-aware tooling. The DLA-4548-1 advisory text says the Bullseye update moves the package to 0.51+deb11u11 and merely updates Bookworm EoL data plus adds Ubuntu 26.10; older Bullseye installs below that version are only missing refreshed metadata, not a code fix for memory corruption, auth bypass, or remote execution.

Tenable's HIGH label does not match reality. The plugin itself says there are no CVEs, cites no known exploits, and admits it is a version-only local check; Debian's own advisory calls this a routine database update, so this belongs in normal package hygiene or lifecycle-tool accuracy work, not in the security emergency lane.

Why this verdict

• No CVE, no flaw class, no exploit path: the plugin and Debian sources do not describe RCE, LPE, auth bypass, or data leak behavior.
• Attacker position required: none, because there is nothing to attack: this is a local metadata package, so the supposed prerequisite chain never starts.
• Reachable population is effectively zero from an exposure standpoint: distro-info-data is not a service and has no meaningful internet-facing footprint.
• Modern controls are beside the point: EDR, WAF, MFA, and NGFW do not matter because there is no malicious step for them to block.
• Vendor baseline is inflated by advisory taxonomy: Tenable appears to inherit the 'security advisory' wrapper and score it as a security miss even while the advisory text says 'routine update of the distro-info-data database.'

Why not higher?

There is no published vulnerability primitive to amplify into a higher rating. No remote trigger, no local privilege boundary crossing, no parser crash, no memory safety bug, and no active exploitation evidence are present.

Why not lower?

The only bucket below this is still IGNORE, and that is exactly where it belongs. It may warrant a normal package update for lifecycle-data accuracy, but that is asset-management hygiene, not vulnerability remediation.

1. Suppress plugin 310349 from security SLA tracking — Document that DLA-4548-1 is a routine distro-info-data database refresh with no CVE and no exploit path. Because the verdict is IGNORE, there is no action required under the noisgate SLA; remove it from security backlog metrics now to avoid wasting analyst time.
2. Route package updates through normal OS maintenance — If your lifecycle reporting, compliance dashboards, or release-support calculators depend on precise distro EoL metadata, update the package on your standard Debian cadence. For an IGNORE verdict there is no mitigation or remediation SLA; do it as routine hygiene, not as an incident-driven patch.
3. Validate lifecycle tooling inputs — If you have homegrown scripts that consume distro-info-data, verify whether they actually read this package and whether stale EoL dates materially affect reporting. This avoids emergency work for hosts where the package is installed but never used.

Run this on the target Debian host as a regular user; root is not required because it only reads package metadata. Save as check_distro_info_data.sh and run bash check_distro_info_data.sh 0.51+deb11u11 to compare the installed version against the advisory's stated fixed version and print VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env bash
# check_distro_info_data.sh
# Purpose: Compare installed distro-info-data version with an expected fixed version
# Note: For DLA-4548-1 this is an administrative package-state check only; it does NOT prove exploitability.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE (older than supplied fixed version)
#   2 = UNKNOWN (package missing / unsupported platform / bad args)

set -euo pipefail

PKG="distro-info-data"
FIXED_VERSION="${1:-0.51+deb11u11}"

if ! command -v dpkg-query >/dev/null 2>&1; then
  echo "UNKNOWN: dpkg-query not found; this does not look like a Debian-family host"
  exit 2
fi

STATUS_LINE="$(dpkg-query -W -f='${db:Status-Abbrev} ${Version}\n' "$PKG" 2>/dev/null || true)"
if [[ -z "$STATUS_LINE" ]]; then
  echo "UNKNOWN: package '$PKG' is not installed"
  exit 2
fi

INSTALLED_VERSION="$(awk '{print $2}' <<<"$STATUS_LINE")"
if [[ -z "$INSTALLED_VERSION" ]]; then
  echo "UNKNOWN: unable to parse installed version for '$PKG'"
  exit 2
fi

if dpkg --compare-versions "$INSTALLED_VERSION" ge "$FIXED_VERSION"; then
  echo "PATCHED: $PKG installed version $INSTALLED_VERSION is >= $FIXED_VERSION"
  exit 0
else
  echo "VULNERABLE: $PKG installed version $INSTALLED_VERSION is < $FIXED_VERSION"
  exit 1
fi

Sources

1. Tenable Nessus Plugin 310349
2. Debian LTS Security Information
3. Mail Archive copy of DLA-4548-1
4. Debian Security Tracker source package page
5. Debian Package Tracker for distro-info-data
6. Debian package source page for Bullseye
7. Debian changelog for distro-info-data 0.51+deb11u10