Ubuntu
intel-microcode package

  1. Bug #2040280
  2. Comment #3

Comment 3 for bug 2040280

Revision history for this message
Grant Orndorff (orndorffgrant) wrote : Re: pro fix shows CVE-2022-40982 is not resolved although fixed version is installed

Thanks for the report and thanks for looping me in!

I think I was able to recreate this situation. The full output is
```
ubuntu@test:~$ pro fix CVE-2022-40982
CVE-2022-40982: Linux kernel (BlueField) vulnerabilities
 - https://ubuntu.com/security/CVE-2022-40982

2 affected source packages are installed: intel-microcode, linux
(1/2) linux:
A fix is coming soon. Try again tomorrow.
(2/2) intel-microcode:
A fix is available in Ubuntu standard updates.
The update is already installed.

1 package is still affected: linux
✘ CVE-2022-40982 is not resolved.
```
`linux` is the source package of the "generic" linux kernel. The output for `linux` is "A fix is coming soon. Try again tomorrow.", which agrees with the page: https://ubuntu.com/security/CVE-2022-40982 - if you scroll down to the entry for `linux`, the status for mantic is "Pending".

So I think everything is working as expected. Let me know if you disagree.