Merge lp://staging/~lsandecki/ubuntu-motd/cve-2023-2650 into lp://staging/ubuntu-motd

Should we be revving the start date now that the listed date is in the past?

I would say there is no need to. The past date is fine - the client will understand that this should be active immediately.

I'm not sure either of these is really "recently fixed", 18 days and 41 days old:

30 May 2023 https://ubuntu.com/security/notices/USN-6119-1
22 June 2023 https://ubuntu.com/security/notices/USN-6188-1

These banners will be better received if they're relevant.

I expect that this will instead be read as "oh no a new openssl issue? why isn't the update available yet?" followed by a few minutes looking for more information, and then finding out that this is old news and unattended-upgrades handled it weeks ago. That's not likely to leave a pleasant impression.

Thanks

The message doesn't make all that much sense because the context you see it in is when you are upgrading, so it's somewhat redundant, either it was already upgraded before or the call you see the message in is upgrading it.

There's effectively no way to see the message without getting an upgraded OpenSSL.

In addition, the CVE mentioned is a pretty benign issue, I'm not sure why it is relevant...

This message was reported as a bug inhttps://bugs.launchpad.net/bugs/2027674