lua5.4 update missing on Jammy

[Elfranne]

lua5.4 has been updated to 5.4.6-3build2 but Jammy seems to have been missed. Jammy is currently at version 5.4.4-1, which contains 2 CVE (CVE-2022-33099 and CVE-2022-28805)

https://launchpad.net/ubuntu/+source/lua5.4

[Eduardo Barretto (ebarretto)]

Both CVEs are already patched and released through Ubuntu Pro, for more information see:
https://ubuntu.com/security/notices/USN-6916-1

You can have free access to Ubuntu Pro up to 5 machines, see https://ubuntu.com/pro

[Elfranne (elfranne)]

Thanks, I am aware of that.
Oracular and Noble have been kept updated so I am curious why Noble has not?

[Eduardo Barretto (ebarretto)]

I believe you mean "why jammy has not?"

lua5.4 in jammy is in universe, and therefore it is community maintained. In oracular and noble lua5.4 is in main, and therefore officially supported.
Therefore in jammy if the Ubuntu Security Team proactively fixes it, we then publish this update into Ubuntu Pro.

[Elfranne (elfranne)]

oh that makes much more sense now.

[Renan Rodrigo (renanrodrigo)]

@elfranne I am marking this bug as wishlisted. If you can't use the version in Ubuntu Pro with ESM-Apps for some reason, feel free to propose a patch/backport and the security team will be happy to review and sponsor it. Thanks again for reaching out.