Receive security updates for every installed package, including universe (Ubuntu Pro esm-apps)

Description

Ubuntu standard security maintenance covers the main and restricted components only. Packages of the universe component (and multiverse) get fixes from the community, on a best-effort basis, and many known vulnerabilities in universe stay unfixed. Expanded Security Maintenance for Applications (esm-apps), part of Ubuntu Pro, extends Canonical's security maintenance to universe, from the release of an LTS to the end of its ESM period.

pro security-status counts the installed packages per component and shows which Ubuntu Pro services are enabled. The control fails only when packages from universe are installed and esm-apps is not enabled. A system with packages from main and restricted only passes without Ubuntu Pro.

The check needs the Ubuntu Pro client (ubuntu-pro-client, installed by default on every release) and fresh package lists. A single universe package is enough to fail, for example qemu-guest-agent installed on virtual machines. Multiverse packages (not free software) are not counted.

Rationale

Universe holds most of the archive, including common server software (web and database servers, language runtimes, agents). A universe package installed for one need is as exposed as a main package, but without a commitment to fix it. With esm-apps, the fixes are published in the <codename>-apps-security pocket and installed by unattended-upgrades like the others.

Impact

Needs an Ubuntu Pro subscription for each system (free for a few personal machines). Without it, remove the universe packages or replace them with packages from main, a vendor repository or a supported snap. The esm-apps repository needs access to esm.ubuntu.com (or an internal mirror).

Setting

Audit

1. Run pro security-status. If it reports no package from Universe/Multiverse, or only from multiverse (pro security-status --format json, num_universe_packages is 0), the control passes.
2. Otherwise pro status must show the system attached and esm-apps enabled. pro security-status --esm-apps lists the universe packages concerned.

Automated: every check must pass. Scanners report each check by its id.

esm-apps

Installed universe packages and the esm-apps service, from pro security-status.

script: |
  command -v pro >/dev/null || { echo "Ubuntu Pro client (pro) is not installed"; exit 3; }
  j=$(pro security-status --format json 2>/dev/null) || { echo "pro security-status failed"; exit 3; }
  printf '%s' "$j" | python3 -c '
  import json, sys
  s = json.load(sys.stdin)["summary"]
  n = s.get("num_universe_packages", 0) + s.get("num_esm_apps_packages", 0)
  on = "esm-apps" in s.get("ua", {}).get("enabled_services", [])
  print("%d packages from universe, attached to Ubuntu Pro: %s, esm-apps %s" % (n, s.get("ua", {}).get("attached"), "enabled" if on else "not enabled"))
  sys.exit(1 if n and not on else 0)'

Remediation

1. Attach the system to Ubuntu Pro: pro attach <token> (token from https://ubuntu.com/pro or the organisation's Ubuntu Pro account), or use an Ubuntu Pro image of the cloud provider, or Landscape.
2. Run pro enable esm-apps if it is not enabled by the attachment, then apt-get update and apt-get upgrade to install the pending ESM fixes.
3. Without a subscription, remove the universe packages that are not needed (pro security-status --esm-apps lists them), and document the remaining ones as an accepted risk in the tailoring file.

No automated fix: attaching needs the organisation's token, which must not be stored in the baseline.

References

• Ubuntu Pro Client - About Expanded Security Maintenance Canonical, vendor-doc, accessed 2026-10-19
• Ubuntu - Expanded Security Maintenance Canonical, vendor-doc, accessed 2026-10-19
• Ubuntu Pro Canonical, vendor-doc, accessed 2026-10-19
• pro(1), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-UBU-PKG-009 Run an Ubuntu release that still receives security updates
• related CB-UBU-PKG-010 Install only the packages the system needs

People and lifecycle