apt-news security notification messages may be too vague for users who are not extremely familiar with internal Ubuntu processes

[Andrea Corbellini]

Recently APT has begun showing the following message to Ubuntu users:

# An OpenSSL vulnerability has recently been fixed with USN-6188-1 & 6119-1:
# CVE-2023-2650: possible DoS translating ASN.1 object identifiers.
# Ensure you have updated the package to its latest version.

While the message itself is useful, the way it is worded has several problems:

1. It includes terms like 'USN' and 'CVE', which may not be familiar terms to all users.

2. It doesn't include any links to the aforementioned USNs and CVEs. While somebody may use a search engine to find them, it would be better to provide links explicitly, both for convenience, and so that users can be sure that there's an official page that contains all the information they need to learn more about the issue.

3. Perhaps the most important point: **it doesn't tell the user how to check if their system is affected or not**. In fact, this message is shown to everyone, including people who have an up-to-date system, causing confusion, and leading people to ignore this messages in the future because they're getting used to see a message that requires no action.

4. It does not tell users how patch their systems. In my opinion, "ensure you have updated the package..." makes sense only to people who know well enough how APT works, what pockets are, and how Ubuntu security updates are delivered.

5. It does not include the names of the binary packages that need to be upgraded, so the user might need some work to figure out what "the package" is. It's not obvious to everyone that libssl3 is an affected package that should be upgraded (in this specific case).

I propose that all future security warning messages like this one follow a better template that can be more informative to all command-line users, who are not necessarily Ubuntu experts.

[Filing this bug against ubuntu-advantage-tools, even though this message was produced somewhere else. Please reassign if/as needed. Although note that apt-news should perhaps gain the ability to show messages depending on installed package versions, so this bug is still relevant to ubuntu-advantage-tools.]

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[edub (e-dub)]

How about something simple like saying what commands are needed?

[GilgongoJones (gilgongo)]

That this message shows even if the package it up to date on the system feels like a bug to me.

[Grant Orndorff (orndorffgrant)]

Sorry for the silence here, and thank you everyone for your feedback!

I've forwarded this feedback to the authors of the APT News message.

This is related to #2027674 where we agreed that there should be an apt-news feature to only display a message like this if the package in question is out-of-date. Let's leave this bug open to represent that.

[Grant Orndorff (orndorffgrant)]

I should add: Thank you especially for the considerate and well-thought-out critique of the message and suggestions on how to make it better. This is genuinely helpful and will go into making future messages better.

[Tim Riker (timriker)]

I think the more important issue is that the notice shows up even after the updates are installed. That should not be the case.

[James Greenhalgh (jamesgreenblue)]

Completely agree with the consensus here – I found myself trying to guess which binaries to check against. Related issue is that on our 22.04.2 LTS virtual machines the output of:

~$ openssl version
OpenSSL 3.0.2 15 Mar 2022 (Library: OpenSSL 3.0.2 15 Mar 2022)

...doesn't show the same version number resolution as: https://launchpad.net/ubuntu/+source/openssl

The Jammy Jellyfish (supported)
OpenSSL trunk series
3.0.2-0ubuntu1.10 security, updates (main) 2023-05-30
3.0.2-0ubuntu1 release (main) 2022-04-01

So despite apt stating `0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded` the wording of this message left me feeling uneasy that I had missed something and the message is telling me that further action is required. This ultimately led me to this launchpad discussion.

Could someone here document the commands for the wider community so that others who discover this page can feel confident that their versions of openssl and libssl3 are patched.

[Daniel Andrés Silva Navarro (dsncode)]

in the meantime, and for those seeking for answers, what commands should we run to ensure we have the latest patch for this openssl bug?

[Jimmy Jones (no9n)]

I can't believe how stupid I am. I've been trying for days to find out why I can't install the latest openssl becasue this message (# An OpenSSL vulnerability has recently been fixed with USN-6188-1 & 6119-1:
# CVE-2023-2650: possible DoS translating ASN.1 object identifiers.
# Ensure you have updated the package to its latest version.) continues to pop up no matter what I've done.

In my defense I have had a issue with a website over online credit card and purchase and it had me a little rattled. So I'm thinking this may be the reason and Ubuntu Guys are trying to tell me something here.

Maybe I should have figured out days ago that it was just a suggestion to make sure I had the latest version (which I did check from the beginning but an online forum said I had the wrong version) but I didn't even consider that until about day 4 of seeing this message and got into some serious trouble trying to fix a problem that wasn't EVER there. I took my operating system to the point of being able to boot to the purple screen with no mouse and nothing else working. I'm baaaack without reinstalling it but it's only by the grace of god. I admit, I'm very ignorant but maybe in the future we could be a little more specific with messages of this type for the stupid like me?
Thank you

[Christian Ehrhardt  (paelzer)]

I've already filed an item when we discussed bug 2027674 to work on to make this possible by gating particular news based on a package being present and below a given version. That should eventually address this.

But for expectations, it is likely taking a while to get to it (my gut feeling says somewhen in the 24.04 cycle).

=> SC-1587