Patch Triage: Find the Vulnerable Packages (Offline)

You're triaging an air-gapped host against a security advisory. There's no internet, so apt upgrade is out; the job is to identify WHAT is exposed before the change window. A captured package inventory sits at /root/patch/installed.txt (one name version per line, dpkg-style), and the advisory at /root/patch/advisory.txt lists the fixed version each affected package must reach. Both differ per session. Compare them the way a real analyst does: with dpkg --compare-versions, not string sorting. Debian revisions compare numerically, so …ubuntu1.9 is OLDER than …ubuntu1.18, even though a string sort says otherwise. Record three answer files under /root/answers/: vulnerable.txt — the installed packages still BELOW their fixed version (package names only, one per line); count.txt — how many there are (just the number); openssl_fixed.txt — the exact version openssl must reach (just the version string). (Maps to NIST RA-5 / SI-2 and 800-171 3.11.2 / 3.14.1.)