Package "ubuntu-pro-client"

  ubuntu-advantage-tools (37.1ubuntu0~20.04.1) focal-security; urgency=medium

  * SECURITY UPDATE: Information disclosure
    - Remove credentials out of argv into apt's own auth.conf.d facility.
    - CVE-2026-9494
  * SECURITY UPDATE: Improper input validation
    - enforce StrictStringDataValue to applicable fields in directives
    - reject newline, carriage return, spaces, and shell meta characters
      in StrictStringDataValue
    - CVE-2026-11386
  * SECURITY UPDATE: Symlink attack
    - reject symlink log files in user-controlled directory trees during
      pro collect-logs
    - restrict pro collect-logs generated support archive permission to
      root only
    - CVE-2026-12391

 -- Eduardo Barretto <email address hidden> Mon, 06 Jul 2026 15:37:04 +0200