Ubuntu Pro Withholding Security Updates

S. Johnson

5/9/24, 12:42 PM

This has been talked about many times over the past few months, but I wanted to mention some specific packages that are available only through Ubuntu Pro, despite being high/critical security vulnerabilities.

graphviz, libcdt, libcaraph6, libgvc6, libavpr2, liblab-aamut1, libpathplan4 (and more) - https://vulners.com/ubuntu/USN-5971-1
libeditorconfig0 - https://vulners.com/ubuntu/USN-5842-1
libavcodec58, libavcodec58-dev, libavdevice-dev, libavformat58, libavformat-dev, libavutil56, libavutil-dev, libpostproc55, libswresample3, libswscale5 (and more) - https://vulners.com/ubuntu/USN-5958-1
exo-utils, libexo, libexo-common - https://vulners.com/ubuntu/USN-6008-1
tigervnc-common, tigervnc-xorg-extension - https://vulners.com/ubuntu/USN-5965-1
cloud-init - https://vulners.com/ubuntu/USN-6042-1
python3-ipython - https://vulners.com/ubuntu/USN-5953-1

All of these have been discovered and patched since the rollout of Ubuntu Pro, but the packages to update them all exist only in ESM, even though they affect Ubuntu 20.04 LTS and 22.04 LTS.

This new policy essentially kills Ubuntu in our organization. If anyone has any suggestion for an enterprise-level solution, not a free account limited to 5 computers, and without spending lots of money (because that's why we started with Ubuntu in the first place), please comment below. (No, I don't count building from the source, that's not sustainable for any organization with more than 20 systems.)

EDIT: To be very clear, 6 months ago, Nessus scans (which are NOT run or influenced by me) turned up no outstanding vulnerabilities. Now that Ubuntu Pro exists and provides an update through a "supported" repository, Nessus scans turn up outstanding vulnerabilities. THAT is why the existence of Ubuntu Pro kills Ubuntu in my organization.

155

0 + 1

updates

security

esm

ubuntu-pro

Thomas Ward

5/9/24, 3:54 PM

@S.Johnson This is not a discussion forum. As posted, your post is effectively *just* a rant hidden behind a thin veil. As an IT Security Professional, I can guarantee you that Nessus, etc. only check base version strings and *NOT* the full patchsets of Ubuntu to make sure things're patched. I am locking this post as it is just generating unnecessary noise and comments, and should stay dead. You are free to post your question / request for assists on an actual forum site or Reddit if you want to rant and get support at the same time.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Ubuntu Pro Withholding Security Updates

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.