When to Ubuntu update packages become available on https://packages.microsoft.com/ubuntu/22.04/prod

Question

I have numerous vulnerabilities that are being flagged on my Ubuntu 22.0.4 VMs. These vuls point to Ubuntu USN articles. When I go to those articles, the patches appear to be available via Ubuntu Pro subscription only. I regularly update my OS from the https://packages.microsoft.com/ubuntu/22.04/prod source but none of these vulnerabilities are getting addressed by this update.

When do these types of fixes developed by Ubuntu become available on Microsoft repositories for deployment to my Linux VMs?

Answer 1

The vulnerabilities you're seeing are likely related to extended security maintenance (ESM) or additional security updates provided through the Ubuntu Pro subscription. These updates may take longer to appear in Microsoft's package repository, as that repository generally pulls from the public repositories and does not include all of the Ubuntu Pro-exclusive security patches.

Here's an overview of how the process works:

1. Ubuntu Pro Patches:

• Ubuntu Pro offers access to additional security patches, especially for high-risk vulnerabilities or for packages beyond the default support lifecycle. If these patches are being flagged in USN articles and are marked as only available via Ubuntu Pro, they will not be immediately available in the public package repositories.

2. Microsoft Repositories:

• The packages.microsoft.com repository typically provides updates for Microsoft-specific software and tools for Linux, but it may not include all Ubuntu security updates.
• Microsoft does not maintain its own equivalent to Ubuntu Pro patches, so there could be a delay or unavailability for some security fixes from the mainline Ubuntu repositories unless you're using Ubuntu Pro.

3. Availability Timing:

• For standard Ubuntu security patches, once they are released to the public, they should eventually be mirrored on the Microsoft repository. However, this timeline can vary depending on the sync schedule between Ubuntu’s public repositories and Microsoft's Ubuntu sources.
• Critical or high-impact security vulnerabilities should get prioritized updates, but if the fix is behind the Ubuntu Pro subscription, you may need to subscribe to Ubuntu Pro to get these immediately.

4. Considerations:

• If these vulnerabilities are critical for your environment, you may want to consider subscribing to Ubuntu Pro for your VMs. Ubuntu Pro provides 10 years of security maintenance and includes fixes for thousands of packages.
• If you're unable to subscribe to Ubuntu Pro, you'll need to wait for these patches to be rolled out to the public repositories, though this might take time depending on the type of vulnerability and its priority.

For now, you can continue updating your systems from the packages.microsoft.com repository and monitor any critical vulnerabilities. However, if the flagged vulnerabilities require immediate attention, adopting Ubuntu Pro might be necessary for comprehensive protection.The vulnerabilities you're seeing are likely related to extended security maintenance (ESM) or additional security updates provided through the Ubuntu Pro subscription. These updates may take longer to appear in Microsoft's package repository, as that repository generally pulls from the public repositories and does not include all of the Ubuntu Pro-exclusive security patches.

Here's an overview of how the process works:

1. Ubuntu Pro Patches:

• Ubuntu Pro offers access to additional security patches, especially for high-risk vulnerabilities or for packages beyond the default support lifecycle. If these patches are being flagged in USN articles and are marked as only available via Ubuntu Pro, they will not be immediately available in the public package repositories.

2. Microsoft Repositories:

• The packages.microsoft.com repository typically provides updates for Microsoft-specific software and tools for Linux, but it may not include all Ubuntu security updates.
• Microsoft does not maintain its own equivalent to Ubuntu Pro patches, so there could be a delay or unavailability for some security fixes from the mainline Ubuntu repositories unless you're using Ubuntu Pro.

3. Availability Timing:

• For standard Ubuntu security patches, once they are released to the public, they should eventually be mirrored on the Microsoft repository. However, this timeline can vary depending on the sync schedule between Ubuntu’s public repositories and Microsoft's Ubuntu sources.
• Critical or high-impact security vulnerabilities should get prioritized updates, but if the fix is behind the Ubuntu Pro subscription, you may need to subscribe to Ubuntu Pro to get these immediately.

4. Considerations:

• If these vulnerabilities are critical for your environment, you may want to consider subscribing to Ubuntu Pro for your VMs. Ubuntu Pro provides 10 years of security maintenance and includes fixes for thousands of packages.
• If you're unable to subscribe to Ubuntu Pro, you'll need to wait for these patches to be rolled out to the public repositories, though this might take time depending on the type of vulnerability and its priority.

For now, you can continue updating your systems from the packages.microsoft.com repository and monitor any critical vulnerabilities. However, if the flagged vulnerabilities require immediate attention, adopting Ubuntu Pro might be necessary for comprehensive protection.