Ubuntu 24.04 security patch for Ubuntu Pro only

[Keith]

On 3/11/2026 1:01 AM, nate wrote:
> On 2026-03-10 19:05, Keith via ubuntu-users wrote:
> 
>> You've answered your question. Mongo-c-driver is in universe and 
>> therefore community supported. It's up to the community to backport 
>> whatever security patches are available from upstream into current 
>> version in noble. Nobody really seems to care, though, because nobody 
>> has even bothered to file a bug report about it:
>>
>> https://bugs.launchpad.net/ubuntu/+source/mongo-c-driver
>> 0 New bugs
>> 1 Open bug
>> 0 In-progress bugs
>> 0 Critical bugs
>> 0 High importance bugs
>> Bugs fixed elsewhere
>> 0 Bugs with patches
>> 0 Open CVE bugs
>>
>> Last I checked, Ubuntu provided diffs even for ESM packages. So it's 
>> not exactly difficult to get the source diffs through a subscription 
>> to Ubuntu Pro and create a patch set from it to apply to the package 
>> in universe. Someone from the community just needs to be willing to do 
>> the work.
> 
> thanks though I am still curious why ubuntu cared so much about a 
> package in universe to patch it like this, can't be a very important 
> package if it's in universe, like the example of varnish(also
> in universe), several security issues but no patches in years. I'm sure 
> there's tons of others that are the same in the universe repo.. what 
> makes this mongo-c driver special enough to patch?
> I suppose will never know.

Go to https://ubuntu.com/pro Click the button titled "Talk to an 
Expert". Fill out some paperwork and ask your question. Who knows, maybe 
they'll respond.

This list is low-traffic. You may have a better chance getting your 
question answered on one of the busier venues like discourse.ubuntu.com 
or Askubuntu.com or just communicating with Canonical directly.


> 
> Strange that they don't seem to document this practice anywhere. 
> Everything I have read says ESM does nothing(from a security standpoint) 
> other than extend the lifetime of LTS.
> 

It's not strange. It's not weird. It's not peculiar. It's certainly not 
conspiracy fodder.

-- 
Keith