The USN-3686-1: file vulnerabilities are fixed automatically and installed on SecureDrop production instances. I received the following OSSEC alerts for the Application Server and Monitor Server.
OSSEC HIDS Notification.
2018 Jun 15 04:16:11
Received From: mon->syscheck
Rule: 550 fired (level 7) -> "Integrity checksum changed."
Portion of the log(s):
Integrity checksum changed for: '/usr/bin/file'
Size changed from '18848' to '19000'
Old md5sum was: 'e26d5aa3b96c8375d1a132199928acdb'
New md5sum is : '53333946c96bc46e1e0b3274ba6b1cdd'
Old sha1sum was: '0fb77226ffa34f8f72d6d215edbc20af9d6dc566'
New sha1sum is : '7372f233c95458cb712043a7ebac890aaebeae2e'
--END OF NOTIFICATION