2

I just ran ubuntu-security-status on a 20.04 installation learnt to enable ESM to get more security updates:

4667 packages installed, of which:
1962 receive package updates with LTS until 4/2025
2694 could receive security updates with ESM Apps until 4/2030
  11 packages are from third parties

[...]


Enable Extended Security Maintenance (ESM Apps) to get 3 security
updates (so far) and enable coverage of 2694 packages.

A littel bit of tinkering revealed the three packages as ant,ant-doc and libzmq5. So I subscribed to the free plan on Ubuntu advantage and enabled it my host as documented.

ubuntu-security-status does not show the warning anymore, but the packages did not receive any updates.

Using the ant package as an example: The ESM-focal-apps-security-package list lists ant-1.10.7-1ubuntu0.1~esm1. The Changelog reveals that it patches CVE-2020-1945. However the package comes from the esm-apps-repository which is not enabled by default and cannot be enabled via ua enable esm-apps ("This subscription is not entitled to ESM Apps")

# ua status
SERVICE       ENTITLED  STATUS    DESCRIPTION
esm-apps      no        —         UA Apps: Extended Security Maintenance
[...]

Reading on launchpad/ant shows that CVE-2020-1945 was patched in

  • Ubuntu 19.10 in ant-1.10.6
  • Ubuntu 21.04 in ant-1.10.8

So what is going on:

  • Why are there ESM packages for the current LTS release at all?
  • What is this esm-apps and how to get the updates?
  • Why is this CVE patched for 19.10 and 21.04, but not for 20.04 the only LTS version here?
  • Does this mean Canonical is holding back security patches and preovide them only for paying customers?
frukto
  • 21
  • 1
    Please file a bug report for the spurious ubuntu-security-status output. ESM does not begin for 20.04 until April 2025, so the correct number of available ESM updates should be zero until then. – user535733 Mar 22 '21 at 17:35
  • The reason why https://ubuntu.com/security/CVE-2020-1945 seems not patched in 20.04 is clearly stated on that page. The complete fix requires action on another CVE, which is currently in queue. Both CVEs are medium priority. – user535733 Mar 22 '21 at 17:41
  • Nobody is "holding back security patches and preovide them only for paying customers." That would be unconscionable. Community participants with an interest in security or specific CVEs are welcome to help the Ubuntu Security Team. Ubuntu is open source, and driven by community participation. – user535733 Mar 22 '21 at 17:46
  • 2
    Does this answer your question? What are ESM Apps, and how do they relate to Ubuntu Pro? – Artur Meinild Feb 06 '23 at 13:51

0 Answers0