ubuntu-security-status
is not ESM aware. It is referring to regular updates and not security patches. If ESM is enabled, you can check status with sudo ua status
, and a new feature on ua which is in beta:
sudo ua security-status --format yaml --beta
For example, in 18.04 Pro, support status gives you:
ubuntu@ip-172-31-91-xx:~$ ubuntu-support-status --show-unsupported
Support status summary of 'ip-172-31-91-97':
You have 499 packages (99.0%) supported until April 2023 (Canonical - 5y)
You have 0 packages (0.0%) that can not/no-longer be downloaded
You have 5 packages (1.0%) that are unsupported
No longer downloadable:
Unsupported:
krb5-locales libgssapi-krb5-2 libk5crypto3 libkrb5-3 libkrb5support0
And shows that it is on half of life, but, ESM will maintain security updates even for those packages.
In the same machine sudo ua security-status --format yaml --beta
gives me:
summary:
num_esm_apps_updates: 5
num_esm_infra_updates: 0
num_installed_packages: 504
num_standard_security_updates: 16
ua:
attached: true
enabled_services:
- esm-apps
- esm-infra
entitled_services:
- esm-apps
- esm-infra
Guess which 5 packages are shown under ESM updates :)
universe
andmultiverse
are not covered by any such guarantees. So in theory such packages could already have been outdated (possibly with security problems) on the day the currently installed version of Ubuntu was released.