[Bug 1989433] Re: Security patch only available via proposed repository

[Nick Rosbrook]

Typically, when a version of a package is in -proposed for a stable
release, that is because it is going through the SRU process and is in
the minimum 7-day aging period [1].

In this case, systemd 237-3ubuntu10.54 was removed from -security due to
a serious regression [2]. A fix is being worked on to avoid the
regression, and it will be released to -security when it is ready.

[1] https://wiki.ubuntu.com/StableReleaseUpdates
[2] https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1988119

** Changed in: systemd (Ubuntu)
       Status: Confirmed => Invalid

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to systemd in Ubuntu.
https://bugs.launchpad.net/bugs/1989433

Title:
  Security patch only available via proposed repository

Status in systemd package in Ubuntu:
  Invalid

Bug description:
  Hello

  on Ubuntu 18.04, systemd 237-3ubuntu10.54 has a fix for CVE-2022-2526,
  however this version is only available in proposed, see[1] - not in
  updates or security - so most users are on 237-3ubuntu10.53. I would
  expect security updates in the updates or security repo.

    ~frukto

  lsb_release -rd
  Description:	Ubuntu 18.04.6 LTS
  Release:	18.04

  apt-cache policy systemd
  systemd:
    Installed: 237-3ubuntu10.54
    Candidate: 237-3ubuntu10.54
    Version table:
   *** 237-3ubuntu10.54 100
          100 /var/lib/dpkg/status
       237-3ubuntu10.53 500
          500 http://ubuntu.ethz.ch/ubuntu bionic-updates/main amd64 Packages
       237-3ubuntu10.50 500
          500 http://ubuntu.ethz.ch/ubuntu bionic-security/main amd64 Packages
       237-3ubuntu10 500
          500 http://ubuntu.ethz.ch/ubuntu bionic/main amd64 Packages

  
  [1] https://launchpad.net/ubuntu/+source/systemd/237-3ubuntu10.54

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1989433/+subscriptions