A new release of the Ubuntu Cloud Images for stable Ubuntu release 18.04 LTS (Bionic Beaver) is available at [1]. These new images superseded the existing images [2]. Images are available for download or immediate use on EC2 via publish AMI ids. Users who wish to update their existing installations can do so with:
   'sudo apt-get update && sudo apt-get dist-upgrade && sudo reboot'.

The following packages have been updated. Please see the full changelogs
for a complete listing of changes:
 * freetype: 2.8.1-2ubuntu2.1 => 2.8.1-2ubuntu2.2 
 * git: 1:2.17.1-1ubuntu0.11 => 1:2.17.1-1ubuntu0.12 
 * gnutls28: 3.5.18-1ubuntu1.5 => 3.5.18-1ubuntu1.6 
 * libxml2: 2.9.4+dfsg1-6.1ubuntu1.6 => 2.9.4+dfsg1-6.1ubuntu1.7 
 * linux-meta: 4.15.0.189.174 => 4.15.0.191.176 
 * linux-signed: 4.15.0-189.200 => 4.15.0-191.202 
 * pyjwt: 1.5.3+ds1-1 => 1.5.3+ds1-1ubuntu0.1 
 * python3.6: 3.6.9-1~18.04ubuntu1.7 => 3.6.9-1~18.04ubuntu1.8 


The following is a complete changelog for this image.
new: {'linux-headers-4.15.0-191': '4.15.0-191.202', 'linux-headers-4.15.0-191-generic': '4.15.0-191.202', 'linux-modules-4.15.0-191-generic': '4.15.0-191.202'}
removed: {'linux-headers-4.15.0-189': '4.15.0-189.200', 'linux-modules-4.15.0-189-generic': '4.15.0-189.200', 'linux-headers-4.15.0-189-generic': '4.15.0-189.200'}
changed: ['git', 'git-man', 'libfreetype6:amd64', 'libgnutls30:amd64', 'libpython3.6-minimal:amd64', 'libpython3.6-stdlib:amd64', 'libpython3.6:amd64', 'libxml2:amd64', 'linux-headers-generic', 'linux-headers-virtual', 'linux-image-4.15.0-191-generic', 'linux-image-virtual', 'linux-virtual', 'python3-jwt', 'python3.6', 'python3.6-minimal']
new snaps: {}
removed snaps: {}
changed snaps: []
==== freetype: 2.8.1-2ubuntu2.1 => 2.8.1-2ubuntu2.2 ====
====     libfreetype6:amd64
  * SECURITY UPDATE: Heap buffer overflow in sfnt_init_face
    - debian/patches-freetype/CVE-2022-27404.patch: avoid invalid face
      index in src/sfnt/sfobjs.c.
    - CVE-2022-27404
  * SECURITY UPDATE: Segmentation violation in FNT_Size_Request
    - debian/patches-freetype/CVE-2022-27405.patch: properly guard
      face_index in src/base/ftobjs.c.
    - CVE-2022-27405
  * SECURITY UPDATE: Segmentation violation in FT_Request_Size
    - debian/patches-freetype/CVE-2022-27406.patch: guard face->size in
      src/base/ftobjs.c.
    - CVE-2022-27406
  * SECURITY UPDATE: Heap-based buffer overflow in ftbench demo
    - debian/patches-ft2demos/CVE-2022-31782.patch: check the number of
      glyphs in src/ftbench.c.
    - CVE-2022-31782
==== git: 1:2.17.1-1ubuntu0.11 => 1:2.17.1-1ubuntu0.12 ====
====     git git-man
  * SECURITY UPDATE: Potential arbitrary code execution
    - debian/patches/CVE-2022-29187-1.patch: adds test to
      regression git needs safe.directory when using sudo in
      t/t0034-root-safe-directory.sh.
    - debian/patches/CVE-2022-29187-2.patch: avoid failing dir ownership
      checks if running privileged in git-compat-util.h,
      t/t0034-root-safe-directory.sh.
    - debian/patches/CVE-2022-29187-3.patch: add negative tests
      and allow git init to mostly work under sudo in
      t/lib-sudo.sh b/t/lib-sudo.sh.
    - debian/patches/CVE-2022-29187-4.patch: allow root
      to access both SUDO_UID and root owned in git-compat-util.h,
      t/t0034-root-safe-directory.sh.
    - debian/patches/CVE-2022-29187-5.patch: add tests for safe.directory
      in t/t0033-safe-directory.sh, setup.c.
    - debian/patches/CVE-2022-29187-6.patch: tighten ownership checks
      post CVE-2022-24765 in setup.c.
    - CVE-2022-29187
==== gnutls28: 3.5.18-1ubuntu1.5 => 3.5.18-1ubuntu1.6 ====
====     libgnutls30:amd64
  * SECURITY UPDATE: Null pointer dereference in MD_UPDATE
    - debian/patches/CVE-2021-4209.patch: avoid calling _update with
      zero-length input in lib/nettle/mac.c.
    - CVE-2021-4209
  * SECURITY UPDATE: Double free in verification of pkcs7 signatures
    - debian/patches/CVE-2022-2509.patch: fix double free during
      gnutls_pkcs7_verify in lib/x509/pkcs7.c,
      tests/pkcs7-verify-double-free.c, tests/Makefile.am.
    - CVE-2022-2509
==== libxml2: 2.9.4+dfsg1-6.1ubuntu1.6 => 2.9.4+dfsg1-6.1ubuntu1.7 ====
====     libxml2:amd64
  * SECURITY UPDATE: Possible cross-site scripting
    - debian/patches/CVE-2016-3709.patch: Revert "do not URI escape
      in server side includes" in HTMLtree.c.
    - CVE-2016-3709
==== linux-meta: 4.15.0.189.174 => 4.15.0.191.176 ====
====     linux-headers-generic linux-headers-virtual linux-image-virtual linux-virtual
  * Bump ABI 4.15.0-191
  * Bump ABI 4.15.0-190
==== linux-signed: 4.15.0-189.200 => 4.15.0-191.202 ====
====     linux-image-4.15.0-191-generic
  * Master version: 4.15.0-191.202
  * Master version: 4.15.0-190.201
==== pyjwt: 1.5.3+ds1-1 => 1.5.3+ds1-1ubuntu0.1 ====
====     python3-jwt
  * SECURITY UPDATE: Signing key confusion via public key signature
    - debian/patches/CVE-2022-29217.patch: update jwt/algorithms.py to
      disallow using SSH keys as a HMAC secret.
    - CVE-2022-29217
==== python3.6: 3.6.9-1~18.04ubuntu1.7 => 3.6.9-1~18.04ubuntu1.8 ====
====     libpython3.6-minimal:amd64 libpython3.6-stdlib:amd64 libpython3.6:amd64 python3.6 python3.6-minimal
  * SECURITY UPDATE: Injection Attack
    - debian/patches/CVE-2015-20107.patch: Make mailcap refuse to match unsafe
      filenames/types/param in Lib/mailcap.py, Lib/test/test_mailcap.py.
    - CVE-2015-20107

--
[1] http://cloud-images.ubuntu.com/releases/bionic/release-20220810/
[2] http://cloud-images.ubuntu.com/releases/bionic/release-20220712/