Ubuntu alert USN-8555-2 (ubuntu-advantage-tools)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8555-2] Ubuntu Advantage Tools (pro client) regression
Date:
             
 
Tue, 01 Sep 2026 16:25:26 +0000
Message-ID:
             
 
<E1x1RIc-0001dY-To@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8555-2
September 01, 2026

ubuntu-advantage-tools regression
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 LTS

Summary:

USN-8555-1 introduced a regression in Ubuntu Advantage Tools.

Software Description:
- ubuntu-advantage-tools: Management tools for Ubuntu Pro

Details:

USN-8555-1 fixed vulnerabilities in Ubuntu Advantage Tools. On Ubuntu
14.04 LTS only, it was discovered that some machines were unable to
enable esm-infra-legacy due to a preemptive apt-helper check. This
update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

 Bilal Teke discovered that Ubuntu Advantage Tools exposed the Pro bearer
 token in command-line arguments when validating APT credentials. A local
 attacker could possibly use this issue to obtain sensitive information
 and gain unauthorized access to Ubuntu Pro repositories. (CVE-2026-9494)

 Frederick Jerusha discovered that Ubuntu Advantage Tools did not properly
 validate data received from the contract server when writing APT source
 files. An attacker could possibly use this issue to inject arbitrary APT
 configuration and execute arbitrary code. (CVE-2026-11386)

 Mateusz Gierblinski discovered that Ubuntu Advantage Tools did not
 properly handle symbolic links when collecting diagnostic logs. A local
 attacker could possibly use this issue to obtain sensitive information
 from files owned by the administrator. This issue only affected Ubuntu
 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,
 Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-12391)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS
  ubuntu-advantage-tools          19.7ubuntu0.2

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8555-2
  https://ubuntu.com/security/notices/USN-8555-1
  https://launchpad.net/bugs/2165073

Package Information:
  https://launchpad.net/ubuntu/+source/ubuntu-advantage-too...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmqW++MACgkQcpJm3tlz
hgGu5g//YVRMQwEFG7JVbrhUZvBEW3NojYma7BSKw9CkzKi040O7TfXL5sroPyqw
v60QzeapDxLZVI3gMALJ1cRNybOl9zBUdkDeHv0OFhimXxzarT6baM3RAgYdFJ+s
RIIB+kqmeV59BRBOsTBdoCQb0iD32RMaza+1RFtWkSkDF+FVwILAQTX3BlHecxDz
37AIZS8Q3j0b7xqdew86ztoSQSf5YVV5QUXxQ8PUd07N+JoudjNH2n/6JTHM4yix
LSf1wdb5/3BOlArsd/2zMIMv5pmpEzwNHfPQW4oDqWEe1X03BtZHWtyVYgJZzOR7
azCEzySH33Gjh6D/QdnOsEk6Xqj86WG7qC5AGsVdevo5E6R4e2s0h+ja9Ttvfqxc
6P9rmFM8WVokuU/qm0cM6DRG7SG0y+H3aTs6peU7xy0R13o05VbFUttJclt5RFTM
qCSDRTFGsxj4DIFS0oNgUhyZB2w3Ij5LRZLFs5Zul/MAX+qAf+ivb5h4IPMdYuRl
DCf2BkkFm6T+aw8jZifR9XZrIHqo/soRScTsa4sYryX+twRbBgANn+ke15WK7qSp
GB6BrMCkqnt8iBQuJF0IAHVXrTQzt28jD1uVABIxxSbX4oKbrbKjeTeLs9Az6X+X
LECdnOLbV2WNz9l1RMGAQTv5TFu49DMy75yd7Omt7juNrpDx9io=
=oE/x
-----END PGP SIGNATURE-----