The USN-3686-1: file vulnerabilities are fixed automatically and installed on SecureDrop production instances. I received the following OSSEC alerts for the Application Server and Monitor Server.
OSSEC HIDS Notification. 2018 Jun 15 04:16:11 Received From: mon->syscheck Rule: 550 fired (level 7) -> "Integrity checksum changed." Portion of the log(s): Integrity checksum changed for: '/usr/bin/file' Size changed from '18848' to '19000' Old md5sum was: 'e26d5aa3b96c8375d1a132199928acdb' New md5sum is : '53333946c96bc46e1e0b3274ba6b1cdd' Old sha1sum was: '0fb77226ffa34f8f72d6d215edbc20af9d6dc566' New sha1sum is : '7372f233c95458cb712043a7ebac890aaebeae2e' --END OF NOTIFICATION