[USN-7966-1] Snowflake vulnerabilities
[USN-7966-2] Telegraf vulnerabilities
[USN-7967-1] Avahi vulnerabilities
[USN-7955-2] urllib3 regression
[USN-7968-1] Apache HTTP Server vulnerabilities
[USN-7966-1] Snowflake vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7966-1
January 19, 2026
snowflake vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
Summary:
Several security issues were fixed in Snowflake.
Software Description:
- snowflake: Cloud-based data platform.
Details:
It was discovered that Pion DTLS, vendored in Snowflake, did not impose a limit
on the amount of data that was buffered during the handshake. An attacker could
possibly use the issue to cause a denial of service. (CVE-2022-29189)
It was discovered that Pion DTLS, vendored in Snowflake, did not prevent the
fragmentBuffer from processing zero length fragments. An attacker could
possibly use the issue to cause a denial of service. (CVE-2022-29190)
It was discovered that Pion DTLS, vendored in Snowflake, did not require
CertificateVerify when Client Cert was sent. An attacker could
possibly use the issue to cause a denial of service. (CVE-2022-29222)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS
snowflake-client 1.1.0-2ubuntu0.1+esm2
Available with Ubuntu Pro
snowflake-proxy 1.1.0-2ubuntu0.1+esm2
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7966-1
CVE-2022-29189, CVE-2022-29190, CVE-2022-29222
[USN-7966-2] Telegraf vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7966-2
January 19, 2026
telegraf vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
Summary:
Several security issues were fixed in Telegraf
Software Description:
- telegraf: Agent for collecting, processing, aggregating, and writing metrics, logs, and other arbitrary data.
Details:
USN-7966-1 fixed vulnerabilities in Snowflake. This update provides the
corresponding updates for Telegraf.
Original advisory details:
It was discovered that Pion DTLS, vendored in Telegraf, did not impose a limit
on the amount of data that was buffered during the handshake. An attacker could
possibly use the issue to cause a denial of service. (CVE-2022-29189)
It was discovered that Pion DTLS, vendored in Telegraf, did not prevent the
fragmentBuffer from processing zero length fragments. An attacker could
possibly use the issue to cause a denial of service. (CVE-2022-29190)
It was discovered that Pion DTLS, vendored in Telegraf, did not require
CertificateVerify when Client Cert was sent. An attacker could
possibly use the issue to cause a denial of service. (CVE-2022-29222)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS
telegraf 1.21.4+ds1-0ubuntu2+esm2
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7966-2
https://ubuntu.com/security/notices/USN-7966-1
CVE-2022-29189, CVE-2022-29190, CVE-2022-29222
[USN-7967-1] Avahi vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7967-1
January 19, 2026
avahi vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 25.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in Avahi.
Software Description:
- avahi: IPv4LL network address configuration daemon
Details:
It was discovered that Avahi incorrectly terminated when processing browser
records with wide-area disabled. An attacker could possibly use this issue
to cause Avahi to crash, resulting in a denial of service. (CVE-2025-68276)
It was discovered that Avahi incorrectly terminated when processing
unsolicited CNAME records pointing to resource records with short TTLs. An
attacker could possibly use this issue to cause Avahi to crash, resulting
in a denial of service. (CVE-2025-68468)
It was discovered that Avahi incorrectly terminated when processing
unsolicited CNAME records in quick succession. An attacker could possibly
use this issue to cause Avahi to crash, resulting in a denial of service.
(CVE-2025-68471)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 25.10
avahi-daemon 0.8-16ubuntu3.1
Ubuntu 24.04 LTS
avahi-daemon 0.8-13ubuntu6.1
Ubuntu 22.04 LTS
avahi-daemon 0.8-5ubuntu5.4
Ubuntu 20.04 LTS
avahi-daemon 0.7-4ubuntu7.3+esm1
Available with Ubuntu Pro
Ubuntu 18.04 LTS
avahi-daemon 0.7-3.1ubuntu1.3+esm3
Available with Ubuntu Pro
Ubuntu 16.04 LTS
avahi-daemon 0.6.32~rc+dfsg-1ubuntu2.3+esm4
Available with Ubuntu Pro
Ubuntu 14.04 LTS
avahi-daemon 0.6.31-4ubuntu1.3+esm4
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7967-1
CVE-2025-68276, CVE-2025-68468, CVE-2025-68471
Package Information:
https://launchpad.net/ubuntu/+source/avahi/0.8-16ubuntu3.1
https://launchpad.net/ubuntu/+source/avahi/0.8-13ubuntu6.1
https://launchpad.net/ubuntu/+source/avahi/0.8-5ubuntu5.4
[USN-7955-2] urllib3 regression
==========================================================================
Ubuntu Security Notice USN-7955-2
January 19, 2026
python-urllib3 regression
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
USN-7955-1 introduced a regression in urllib3
Software Description:
- python-urllib3: HTTP library with thread-safe connection pooling
Details:
USN-7955-1 fixed vulnerabilities in urllib3. The update introduced a
regression in response streaming on Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that urllib3 incorrectly handled decompression during
HTTP redirects. An attacker could possibly use this issue to cause urllib3
to use excessive resources, causing a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS
python3-urllib3 1.26.5-1~exp1ubuntu0.6
Ubuntu 20.04 LTS
python3-urllib3 1.25.8-2ubuntu0.4+esm4
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7955-2
https://ubuntu.com/security/notices/USN-7955-1
CVE-2026-21441, https://bugs.launchpad.net/bugs/2138420
Package Information:
https://launchpad.net/ubuntu/+source/python-urllib3/1.26.5-1~exp1ubuntu0.6
[USN-7968-1] Apache HTTP Server vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7968-1
January 19, 2026
apache2 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 25.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
Summary:
Several security issues were fixed in Apache HTTP Server.
Software Description:
- apache2: Apache HTTP server
Details:
It was discovered that the Apache HTTP Server incorrectly handled failed
ACME certificate renewals. This could result in renewal attempts to be
repeated without delays, possibly leading to a denial of service.
(CVE-2025-55753)
Anthony Parfenov discovered that the Apache HTTP Server would pass the
query string to cmd directives when configured with Server Side Includes
(SSI) enabled and mod_cgid. An attacker could possibly use this issue to
execute arbitrary code. (CVE-2025-58098)
Mattias Åsander discovered that the Apache HTTP Server incorrectly
neutralized certain environment variables. This could result in
unexpectedly superseding variables calculated by the server for CGI
programs. (CVE-2025-65082)
Mattias Åsander discovered that the Apache HTTP Server incorrectly
handled AllowOverride FileInfo configurations when using mod_userdir with
suexec. An attacker with access to use the RequestHeader directive in
htaccess can cause some CGI scripts to run under an unexpected userid.
(CVE-2025-66200)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 25.10
apache2 2.4.64-1ubuntu3.2
Ubuntu 24.04 LTS
apache2 2.4.58-1ubuntu8.10
Ubuntu 22.04 LTS
apache2 2.4.52-1ubuntu4.18
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7968-1
CVE-2025-55753, CVE-2025-58098, CVE-2025-65082, CVE-2025-66200
Package Information:
https://launchpad.net/ubuntu/+source/apache2/2.4.64-1ubuntu3.2
https://launchpad.net/ubuntu/+source/apache2/2.4.58-1ubuntu8.10
https://launchpad.net/ubuntu/+source/apache2/2.4.52-1ubuntu4.18
