caseyweederman , 3 months ago

Not quite. It wasn’t confirmed to be affected, but they can’t prove that the build environment itself wasn’t compromised, thus the rebuild.

As a result of CVE-2024-3094 332, Canonical made the decision to remove and rebuild all binary packages that had been built for Noble Numbat after the CVE-2024-3094 332 code was committed to xz-utils (February 26th), on newly provisioned build environments. This provides us with confidence that no binary in our builds could have been affected by this emerging threat.

https://discourse.ubuntu.com/t/noble-numbat-beta-delayed-xz-liblzma-security-update/43827

And in the follow-up:

Was the vulnerable library ever in the Ubuntu 24.04 LTS (Noble Numbat) daily builds?

<span style="color:#323232;">No.  
</span>

https://discourse.ubuntu.com/t/xz-liblzma-security-update-post-2/43801