Hi folks! I noticed that the new snapd version, 2.77.1, recently landed in -proposed.
For Jammy, I released 2.76.3+ubuntu22.04.1 to -security a couple of weeks ago. This was a no-change rebuild to pick up security fixes in the Go toolchain for CVE-2026-39821. As far as I can tell, the new snapd version for Jammy, 2.77.1+ubuntu22.04, has moved from golang-1.18 to golang-1.23. However, the fix for CVE-2026-39821 is not yet available in golang-1.23, as you can see in USN-8883-1. Therefore, I believe we should wait until the security fix for golang-1.23 is available and rebuild the deb package before completing the SRU (at least for Jammy), to avoid reintroducing the vulnerability. Refs: - https://launchpad.net/ubuntu/+source/snapd - https://ubuntu.com/security/CVE-2026-39821 - https://ubuntu.com/security/notices/USN-8883-1 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-39821 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2158102 Title: [SRU] 2.77.1 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/snapd/+bug/2158102/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
