ubuntu jammy v1.1143

Known Issues:

• The Warden CPI is unable to create VMs when using the bosh-warden-boshlite-ubuntu-jammy-go_agent variety of this stemcell. It will fail deploys with timeouts when pinging the VM. See #562 for more details.

Metadata:

BOSH Agent Version: 2.836.0
Kernel Version: 5.15.0.174.162

USNs:

Title: USN-8124-1 -- Bind vulnerabilities
URL: https://ubuntu.com/security/notices/USN-8124-1
Priorities: medium
Description:
Samy Medjahed discovered that Bind incorrectly handled insecure delegation validation. A remote attacker could possibly use this issue to cause excessive NSEC3 iterations, consuming CPU resources, and leading to a denial of service. (CVE-2026-1519) Vitaly Simonovich discovered that Bind incorrectly handled memory when preparing DNSSEC proofs of non-existence. A remote attacker could possibly use this issue to cause memory consumption, leading to a denial of service. This issue only affected Ubuntu 25.10. (CVE-2026-3104) Vitaly Simonovich discovered that Bind incorrectly handled authenticated queries containing TKEY records. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 25.10. (CVE-2026-3119) It was discovered that Bind incorrectly handled DNS queries signed with SIG(0). A remote attacker could possibly use this issue to bypass ACLs. This issue only affected Ubuntu 25.10. (CVE-2026-3591) Update Instructions: Run sudo pro fix USN-8124-1 to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: bind9 - 1:9.18.39-0ubuntu0.22.04.3 bind9-dev - 1:9.18.39-0ubuntu0.22.04.3 bind9-dnsutils - 1:9.18.39-0ubuntu0.22.04.3 bind9-doc - 1:9.18.39-0ubuntu0.22.04.3 bind9-host - 1:9.18.39-0ubuntu0.22.04.3 bind9-libs - 1:9.18.39-0ubuntu0.22.04.3 bind9-utils - 1:9.18.39-0ubuntu0.22.04.3 bind9utils - 1:9.18.39-0ubuntu0.22.04.3 dnsutils - 1:9.18.39-0ubuntu0.22.04.3 No subscription required
CVEs:

• https://ubuntu.com/security/CVE-2026-3104
• https://ubuntu.com/security/CVE-2026-3119
• https://ubuntu.com/security/CVE-2026-1519
• https://ubuntu.com/security/CVE-2026-3591

Title: USN-8129-1 -- pyasn1 vulnerability
URL: https://ubuntu.com/security/notices/USN-8129-1
Priorities: medium
Description:
It was discovered that pyasn1 incorrectly handled recursion when decoding ASN.1 data. An attacker could use this issue to cause pyasn1 to consume resources, leading to a denial of service. Update Instructions: Run sudo pro fix USN-8129-1 to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: pypy-pyasn1 - 0.4.8-1ubuntu0.2 python-pyasn1-doc - 0.4.8-1ubuntu0.2 python3-pyasn1 - 0.4.8-1ubuntu0.2 No subscription required
CVEs:

• https://ubuntu.com/security/CVE-2026-30922

Title: USN-8133-1 -- PyJWT vulnerability
URL: https://ubuntu.com/security/notices/USN-8133-1
Priorities: medium
Description:
It was discovered that PyJWT did not validate the critical header parameter, contrary to the RFC specification expectations. A remote attacker could possibly use this issue to bypass certain authentication checks and restrictions. Update Instructions: Run sudo pro fix USN-8133-1 to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: python3-jwt - 2.3.0-1ubuntu0.3 No subscription required
CVEs:

• https://ubuntu.com/security/CVE-2026-32597

What's Changed

• Enable stemcell builds on apple silicon (jammy) by @julian-hj in #496
• Prevent systemd-binfmt from running in containers (Jammy) by @mkocher in #500
• Enable building stemcells on apple silicon with vz/rosetta (Jammy) by @mkocher in #501
• Add cgroups v2 support for Jammy stemcells by @mkocher in #468
• Merge stemcells ci by @aramprice in #509
• General cleanup by @aramprice in #512
• CI: consolidate pipeline config script by @aramprice in #513
• CI: reloacte pipelines to ci/pipelines/ by @aramprice in #515
• Update readme et al by @aramprice in #517
• CI: dockerfile creation uses current versions of utils by @aramprice in #518
• CI: do not try to install un-needed yq for task by @aramprice in #519
• CI: tasks always come from bosh-stemcells-ci by @aramprice in #520

Full Changelog: ubuntu-jammy/v1.1123...ubuntu-jammy/v1.1143