Cis Nginx V300 1 2 2CAUTION

Open-source AI-powered offensive security harness for automated penetration testing.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: cis-nginx-v300-1-2-2
description: "Ensure the latest software package is installed (Manual)"
category: cis-nginx
version: "3.0"
author: cyberstrike-official
tags: [cis, nginx, web-server, reverse-proxy, software-updates, initial-setup]
cis_id: "1.2.2"
cis_benchmark: "CIS NGINX Benchmark v3.0.0"
tech_stack: [nginx, linux, web-server]
cwe_ids: []
chains_with: []
prerequisites: []
severity_boost: {}
---

# CIS 1.2.2 — Ensure the latest software package is installed

## Profile Applicability

- Level 1 - Webserver
- Level 1 - Proxy
- Level 1 - Loadbalancer

## Description

As new security vulnerabilities are discovered, the corresponding fixes are implemented by your NGINX software package provider. Installing the latest software version ensures these fixes are available on your system.

## Rationale

Up-to-date software provides the best possible protection against exploitation of security vulnerabilities, such as the execution of malicious code.

## Impact

Updating the NGINX package requires a service reload or restart to apply the changes. This may cause a brief interruption or configuration errors if the new version deprecates existing syntax.

## Audit Procedure

To verify your NGINX package is up to date, run the following command (example):

**Redhat:**

```bash
dnf info nginx
```

## Remediation

To install the latest NGINX package, run the following command (example):

**Redhat:**

```bash
dnf update nginx -y
```

## Default Value

Not applicable. The installed version depends on the configured repository and when the last update was performed.

## References

1. https://nginx.org/en/linux_packages.html

## Additional Information

Package update and installation commands are based on Red Hat Enterprise Linux 9. If using a different Linux distribution, please substitute with the appropriate command(s) and consider your organization patch management policy.

## CIS Controls

| Controls Version | Control                                                      | IG 1 | IG 2 | IG 3 |
| ---------------- | ------------------------------------------------------------ | ---- | ---- | ---- |
| v8               | 7.3 Perform Automated Operating System Patch Management      | Y    | Y    | Y    |
| v8               | 7.4 Perform Automated Application Patch Management           | Y    | Y    | Y    |
| v7               | 3.4 Deploy Automated Operating System Patch Management Tools | Y    | Y    | Y    |
| v7               | 3.5 Deploy Automated Software Patch Management Tools         | Y    | Y    | Y    |

## MITRE ATT&CK Mappings

| Tactic         | Technique                                 |
| -------------- | ----------------------------------------- |
| Initial Access | T1190 - Exploit Public-Facing Application |

## Profile

- Level 1 - Webserver
- Level 1 - Proxy
- Level 1 - Loadbalancer

CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (5)

packages/app/public/apple-touch-icon-v3.png

packages/app/public/apple-touch-icon.png

packages/app/public/favicon-96x96-v3.png

packages/app/public/favicon-96x96.png

packages/app/public/favicon-v3.ico

Gates applied: no_behavioural_pass.

[![ModelsAtlas audit: Cis Nginx V300 1 2 2](https://modelsatlas.com/skills/cyberstrikeus/cis-nginx-v300-1-2-2/badge.svg)](https://modelsatlas.com/skills/cyberstrikeus/cis-nginx-v300-1-2-2/)

Not your listing, or something out of date? Claim or update your listing.