USN-8769-1: correção de vulnerabilidade no phpseclib no Ubuntu

Visão geral

O aviso de segurança USN-8769-1, da Ubuntu, trata de uma vulnerabilidade no phpseclib. A publicação é de 15 de setembro de 2026 e o aviso oficial está em https://ubuntu.com/security/notices/USN-8769-1.

Escopo e CVEs

O aviso está associado aos identificadores CVE-2023-48795, CVE-2023-52892, CVE-2024-27354, CVE-2024-27355 e CVE-2026-32935. Os CVEs não implicam que todas as releases listadas sejam afetadas por todas as falhas.

Releases afetadas e versões corrigidas

Entre as releases listadas, apenas a correção para 22.04 LTS jammy é distribuída pelo acesso padrão; as demais dependem de Ubuntu Pro / ESM, conforme o aviso oficial.

Dados estruturados do aviso

{
"project": "ubuntu",
"event": "security",
"identifier": "USN-8769-1",
"version": null,
"announcementDate": "2026-09-15 15:59:40+00",
"officialSource": "https://ubuntu.com/security/notices/USN-8769-1",
"cves": [
"CVE-2023-48795",
"CVE-2023-52892",
"CVE-2024-27354",
"CVE-2024-27355",
"CVE-2026-32935"
],
"fixedPackages": [
{
"release": "26.04 LTS resolute",
"package": "php-seclib",
"version": "1.0.24-1ubuntu0.1~esm1",
"access": "Ubuntu Pro / ESM (see official notice)"
},
{
"release": "24.04 LTS noble",
"package": "php-seclib",
"version": "1.0.23-1ubuntu0.1~esm1",
"access": "Ubuntu Pro / ESM (see official notice)"
},
{
"release": "22.04 LTS jammy",
"package": "php-seclib",
"version": "1.0.20-1+deb12u3build0.22.04.1",
"access": "standard update"
},
{
"release": "20.04 LTS focal",
"package": "php-seclib",
"version": "1.0.18-2ubuntu0.1~esm2",
"access": "Ubuntu Pro / ESM (see official notice)"
},
{
"release": "18.04 LTS bionic",
"package": "php-seclib",
"version": "1.0.9-1ubuntu0.1~esm2",
"access": "Ubuntu Pro / ESM (see official notice)"
},
{
"release": "16.04 LTS xenial",
"package": "php-seclib",
"version": "1.0.1-3ubuntu0.1+esm1",
"access": "Ubuntu Pro / ESM (see official notice)"
}
],
"editorialLimits": "Use only these verified fields. No inferred features, upgrade commands, affected-version ranges or support deadlines. A release announcement does not establish distribution package availability. For security fixes preserve the exact distribution, package version and Pro/ESM access requirements; CVEs do not imply every listed release is affected by every issue."
}