{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [], "removed": [], "diff": [ "ca-certificates", "distro-info-data", "liblzma5", "python3-jwt", "xz-utils" ] } }, "diff": { "deb": [ { "name": "ca-certificates", "from_version": { "source_package_name": "ca-certificates", "source_package_version": "20260601~22.04.1", "version": "20260601~22.04.1" }, "to_version": { "source_package_name": "ca-certificates", "source_package_version": "20260816ubuntu0.22.04.1", "version": "20260816ubuntu0.22.04.1" }, "cves": [], "launchpad_bugs_fixed": [ 2171507 ], "changes": [ { "cves": [], "log": [ "", " * Blacklist the following CA cert due to intermediate cert compromise", " (LP: #2171507)", " + \"emSign ECC Root CA - G3\"", " * Update Mozilla certificate authority bundle to version 2.90", " The following certificate authorities were added (+):", " + \"SECOM TLS ECC Root CA 2024\"", " + \"SECOM TLS RSA Root CA 2024\"", " + \"Telia EC TLS Root CA v3\"", " + \"Telia RSA TLS Root CA v3\"", " The following certificate authorities were removed (-):", " - \"Atos TrustedRoot 2011\"", " - \"Entrust Root Certification Authority\"", " - \"SecureSign Root CA12\"", " - \"ePKI Root Certification Authority\"", "" ], "package": "ca-certificates", "version": "20260816ubuntu0.22.04.1", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2171507 ], "author": "Marc Deslauriers ", "date": "Tue, 20 Oct 2026 09:03:26 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "distro-info-data", "from_version": { "source_package_name": "distro-info-data", "source_package_version": "0.72-0ubuntu0.22.04.1", "version": "0.72-0ubuntu0.22.04.1" }, "to_version": { "source_package_name": "distro-info-data", "source_package_version": "2026.10.12-0ubuntu0.22.04.1", "version": "2026.10.12-0ubuntu0.22.04.1" }, "cves": [], "launchpad_bugs_fixed": [ 2170573 ], "changes": [ { "cves": [], "log": [ "", " * New data update release", " - Correct Debian codename Experimental to RC-Buggy", " - Support testing against the installed data", " - Switch to calendar versioning (CalVer)", " - Add Ubuntu 27.04 \"Tenacious T-Rex\" (LP: #2170573)", " - Makefile: Clean .pyc files and mypy cache", " * Apply patch to revert correcting Debian codename Experimental to RC-Buggy,", " because this change breaks the distro-info test case and dgit (see #2168892)", " * autopkgtest:", " - test against the installed data", " - reduce dependencies to the needed minimum", "" ], "package": "distro-info-data", "version": "2026.10.12-0ubuntu0.22.04.1", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2170573 ], "author": "Benjamin Drung ", "date": "Mon, 12 Oct 2026 17:36:37 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "liblzma5", "from_version": { "source_package_name": "xz-utils", "source_package_version": "5.2.5-2ubuntu1.1", "version": "5.2.5-2ubuntu1.1" }, "to_version": { "source_package_name": "xz-utils", "source_package_version": "5.2.5-2ubuntu1.2", "version": "5.2.5-2ubuntu1.2" }, "cves": [], "launchpad_bugs_fixed": [ 2170056 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: invalid memory write during decoder reinitialization", " after allocation failure (LP: #2170056)", " - debian/patches/LP-2170056_1.patch: Make lzma_lz_decoder_init()", " safe to reinit after alloc failure in src/liblzma/lz/lz_decoder.c.", " - debian/patches/LP-2170056_2.patch: Clean up after a filter chain", " initialization error in src/liblzma/common/alone_decoder.c.", " - debian/patches/LP-2170056_3.patch: Test lzma_alone_decoder() reuse", " after dictionary allocation failure in tests/Makefile.am,", " tests/test_alone_decoder.c.", " - No CVE number", "" ], "package": "xz-utils", "version": "5.2.5-2ubuntu1.2", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2170056 ], "author": "Shafayat Hossain Majumder ", "date": "Fri, 09 Oct 2026 11:54:08 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-jwt", "from_version": { "source_package_name": "pyjwt", "source_package_version": "2.3.0-1ubuntu0.5", "version": "2.3.0-1ubuntu0.5" }, "to_version": { "source_package_name": "pyjwt", "source_package_version": "2.3.0-1ubuntu0.6", "version": "2.3.0-1ubuntu0.6" }, "cves": [ { "cve": "CVE-2026-101917", "url": "https://ubuntu.com/security/CVE-2026-101917", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-101918", "url": "https://ubuntu.com/security/CVE-2026-101918", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102274", "url": "https://ubuntu.com/security/CVE-2026-102274", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102275", "url": "https://ubuntu.com/security/CVE-2026-102275", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-101917", "url": "https://ubuntu.com/security/CVE-2026-101917", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-101918", "url": "https://ubuntu.com/security/CVE-2026-101918", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102274", "url": "https://ubuntu.com/security/CVE-2026-102274", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102275", "url": "https://ubuntu.com/security/CVE-2026-102275", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Unauthenticated Denial of Service via unbounded thread", " lock waiting during JWKS cache refreshes", " - debian/patches/CVE-2026-101917.patch: Throttle repeated PyJWKClient", " refreshes in jwt/jwks_client.py, tests/test_jwks_client.py.", " - CVE-2026-101917", " * SECURITY UPDATE: Uncaught recursion exception in get_signing_key_from_jwt", " - debian/patches/CVE-2026-101918.patch: fix: normalize recursive JWT ", " payload errors in jwt/api_jwt.py, tests/test_api_jwt.py,", " tests/test_jwks_client.py.", " - CVE-2026-101918", " * SECURITY UPDATE: Uncaught exception in RSAAlgorithm.from_jwk when ", " processing malformed RSA key.", " - debian/patches/CVE-2026-102274.patch: Skip malformed JWKs in JWK sets in", " jwt/api_jwk.py, tests/test_api_jwk.py.", " - CVE-2026-102274", " * SECURITY UPDATE: Public/private key identity confusion via mismatched x ", " and d parameters in OKPAlgorithm.from_jwk", " - debian/patches/CVE-2026-102275.patch: fix: reject inconsistent OKP ", " private keys in jwt/algorithms.py, tests/test_algorithms.py.", " - CVE-2026-102275", "" ], "package": "pyjwt", "version": "2.3.0-1ubuntu0.6", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Hurman ", "date": "Thu, 15 Oct 2026 12:31:23 +0800" } ], "notes": null, "is_version_downgrade": false }, { "name": "xz-utils", "from_version": { "source_package_name": "xz-utils", "source_package_version": "5.2.5-2ubuntu1.1", "version": "5.2.5-2ubuntu1.1" }, "to_version": { "source_package_name": "xz-utils", "source_package_version": "5.2.5-2ubuntu1.2", "version": "5.2.5-2ubuntu1.2" }, "cves": [], "launchpad_bugs_fixed": [ 2170056 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: invalid memory write during decoder reinitialization", " after allocation failure (LP: #2170056)", " - debian/patches/LP-2170056_1.patch: Make lzma_lz_decoder_init()", " safe to reinit after alloc failure in src/liblzma/lz/lz_decoder.c.", " - debian/patches/LP-2170056_2.patch: Clean up after a filter chain", " initialization error in src/liblzma/common/alone_decoder.c.", " - debian/patches/LP-2170056_3.patch: Test lzma_alone_decoder() reuse", " after dictionary allocation failure in tests/Makefile.am,", " tests/test_alone_decoder.c.", " - No CVE number", "" ], "package": "xz-utils", "version": "5.2.5-2ubuntu1.2", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2170056 ], "author": "Shafayat Hossain Majumder ", "date": "Fri, 09 Oct 2026 11:54:08 -0400" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [], "snap": [] }, "removed": { "deb": [], "snap": [] }, "notes": "Changelog diff for Ubuntu 22.04 jammy image from release image serial 20261014 to 20261020", "from_series": "jammy", "to_series": "jammy", "from_serial": "20261014", "to_serial": "20261020", "from_manifest_filename": "release_manifest.previous", "to_manifest_filename": "manifest.current" }