{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [], "removed": [], "diff": [ "ca-certificates", "distro-info-data", "liblzma5", "python3-jwt", "sudo-rs", "xz-utils" ] } }, "diff": { "deb": [ { "name": "ca-certificates", "from_version": { "source_package_name": "ca-certificates", "source_package_version": "20260816", "version": "20260816" }, "to_version": { "source_package_name": "ca-certificates", "source_package_version": "20260816ubuntu0.26.10.1", "version": "20260816ubuntu0.26.10.1" }, "cves": [], "launchpad_bugs_fixed": [ 2171507 ], "changes": [ { "cves": [], "log": [ "", " * Blacklist the following CA cert due to intermediate cert compromise", " (LP: #2171507)", " + \"emSign ECC Root CA - G3\"", "" ], "package": "ca-certificates", "version": "20260816ubuntu0.26.10.1", "urgency": "medium", "distributions": "stonking-security", "launchpad_bugs_fixed": [ 2171507 ], "author": "Marc Deslauriers ", "date": "Tue, 20 Oct 2026 08:44:41 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "distro-info-data", "from_version": { "source_package_name": "distro-info-data", "source_package_version": "2026.08.20-1", "version": "2026.08.20-1" }, "to_version": { "source_package_name": "distro-info-data", "source_package_version": "2026.10.12-1", "version": "2026.10.12-1" }, "cves": [], "launchpad_bugs_fixed": [ 2170573 ], "changes": [ { "cves": [], "log": [ "", " * New upstream release:", " - Add Ubuntu 27.04 \"Tenacious T-Rex\" (LP: #2170573)", " - Makefile: Clean .pyc files and mypy cache", "" ], "package": "distro-info-data", "version": "2026.10.12-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [ 2170573 ], "author": "Benjamin Drung ", "date": "Mon, 12 Oct 2026 14:24:11 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "liblzma5", "from_version": { "source_package_name": "xz-utils", "source_package_version": "5.8.3-1", "version": "5.8.3-1" }, "to_version": { "source_package_name": "xz-utils", "source_package_version": "5.8.3-1ubuntu1", "version": "5.8.3-1ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2170056 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: invalid memory write during decoder reinitialization", " after allocation failure (LP: #2170056)", " - debian/patches/LP-2170056_1.patch: Make lzma_lz_decoder_init()", " safe to reinit after alloc failure in src/liblzma/lz/lz_decoder.c.", " - debian/patches/LP-2170056_2.patch: Clean up after a filter chain", " initialization error in src/liblzma/common/alone_decoder.c,", " src/liblzma/common/lzip_decoder.c,", " src/liblzma/common/microlzma_decoder.c.", " - debian/patches/LP-2170056_3.patch: Test lzma_alone_decoder() reuse", " after dictionary allocation failure in tests/Makefile.am,", " tests/test_alone_decoder.c, tests/tests.cmake.", " - No CVE number", "" ], "package": "xz-utils", "version": "5.8.3-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2170056 ], "author": "Shafayat Hossain Majumder ", "date": "Fri, 09 Oct 2026 11:54:18 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-jwt", "from_version": { "source_package_name": "pyjwt", "source_package_version": "2.13.0-1ubuntu1", "version": "2.13.0-1ubuntu1" }, "to_version": { "source_package_name": "pyjwt", "source_package_version": "2.13.0-1ubuntu1.1", "version": "2.13.0-1ubuntu1.1" }, "cves": [ { "cve": "CVE-2026-101917", "url": "https://ubuntu.com/security/CVE-2026-101917", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-101918", "url": "https://ubuntu.com/security/CVE-2026-101918", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102274", "url": "https://ubuntu.com/security/CVE-2026-102274", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102275", "url": "https://ubuntu.com/security/CVE-2026-102275", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-101917", "url": "https://ubuntu.com/security/CVE-2026-101917", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-101918", "url": "https://ubuntu.com/security/CVE-2026-101918", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102274", "url": "https://ubuntu.com/security/CVE-2026-102274", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102275", "url": "https://ubuntu.com/security/CVE-2026-102275", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Unauthenticated Denial of Service via unbounded thread", " lock waiting during JWKS cache refreshes", " - debian/patches/CVE-2026-101917.patch: Throttle repeated PyJWKClient", " refreshes in jwt/jwks_client.py, tests/test_jwks_client.py.", " - CVE-2026-101917", " * SECURITY UPDATE: Uncaught recursion exception in get_signing_key_from_jwt", " - debian/patches/CVE-2026-101918.patch: fix: normalize recursive JWT", " payload errors in jwt/api_jwt.py, tests/test_api_jwt.py,", " tests/test_jwks_client.py.", " - CVE-2026-101918", " * SECURITY UPDATE: Uncaught exception in RSAAlgorithm.from_jwk when", " processing malformed RSA key.", " - debian/patches/CVE-2026-102274.patch: Skip malformed JWKs in JWK sets in", " jwt/api_jwk.py, tests/test_api_jwk.py.", " - CVE-2026-102274", " * SECURITY UPDATE: Public/private key identity confusion via mismatched x", " and d parameters in OKPAlgorithm.from_jwk", " - debian/patches/CVE-2026-102275.patch: fix: reject inconsistent OKP", " private keys in jwt/algorithms.py, tests/test_algorithms.py.", " - CVE-2026-102275", "" ], "package": "pyjwt", "version": "2.13.0-1ubuntu1.1", "urgency": "medium", "distributions": "stonking-security", "launchpad_bugs_fixed": [], "author": "Hurman ", "date": "Mon, 19 Oct 2026 23:52:44 +0800" } ], "notes": null, "is_version_downgrade": false }, { "name": "sudo-rs", "from_version": { "source_package_name": "rust-sudo-rs", "source_package_version": "0.2.14-1ubuntu4", "version": "0.2.14-1ubuntu4" }, "to_version": { "source_package_name": "rust-sudo-rs", "source_package_version": "0.2.14-1ubuntu4.1", "version": "0.2.14-1ubuntu4.1" }, "cves": [], "launchpad_bugs_fixed": [ 2165142 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: Privilege Escalation via sudoedit (LP: #2165142)", " - debian/patches/fix-sudoedit.patch: Prevent unauthorized sudoedits Fix an", " issue where users with limited sudoedit rights could exploit a race", " condition to get escalated sudoedit permissions. in src/common/context.rs.", " - No CVE number", "" ], "package": "rust-sudo-rs", "version": "0.2.14-1ubuntu4.1", "urgency": "medium", "distributions": "stonking-security", "launchpad_bugs_fixed": [ 2165142 ], "author": "Marc Deslauriers ", "date": "Tue, 20 Oct 2026 07:26:12 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "xz-utils", "from_version": { "source_package_name": "xz-utils", "source_package_version": "5.8.3-1", "version": "5.8.3-1" }, "to_version": { "source_package_name": "xz-utils", "source_package_version": "5.8.3-1ubuntu1", "version": "5.8.3-1ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2170056 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: invalid memory write during decoder reinitialization", " after allocation failure (LP: #2170056)", " - debian/patches/LP-2170056_1.patch: Make lzma_lz_decoder_init()", " safe to reinit after alloc failure in src/liblzma/lz/lz_decoder.c.", " - debian/patches/LP-2170056_2.patch: Clean up after a filter chain", " initialization error in src/liblzma/common/alone_decoder.c,", " src/liblzma/common/lzip_decoder.c,", " src/liblzma/common/microlzma_decoder.c.", " - debian/patches/LP-2170056_3.patch: Test lzma_alone_decoder() reuse", " after dictionary allocation failure in tests/Makefile.am,", " tests/test_alone_decoder.c, tests/tests.cmake.", " - No CVE number", "" ], "package": "xz-utils", "version": "5.8.3-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2170056 ], "author": "Shafayat Hossain Majumder ", "date": "Fri, 09 Oct 2026 11:54:18 -0400" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [], "snap": [] }, "removed": { "deb": [], "snap": [] }, "notes": "Changelog diff for Ubuntu 26.10 stonking image from release image serial 20261019 to 20261021", "from_series": "stonking", "to_series": "stonking", "from_serial": "20261019", "to_serial": "20261021", "from_manifest_filename": "release_manifest.previous", "to_manifest_filename": "manifest.current" }