re-ran locally with a local sbuild of this branch on bionic
csmith@downtown:~/ $ lxc exec test-27-b -- cloud-init status --wait --long

status: done
time: Wed, 28 Apr 2021 00:09:04 +0000
detail:
DataSourceNoCloud [seed=/var/lib/cloud/seed/nocloud-net][dsmode=net]
csmith@downtown:~/ $ 
csmith@downtown:~/ $ 
csmith@downtown:~/ $ 
csmith@downtown:~/ $ lxc exec test-27-b -- ua version
27.0~18.04.1 +allow_beta +extra_security_params
csmith@downtown:~/ $ lxc exec test-27-b -- ua status
SERVICE       AVAILABLE  DESCRIPTION
cc-eal        no         Common Criteria EAL2 Provisioning Packages
cis           yes        Center for Internet Security Audit Tools
esm-apps      yes        UA Apps: Extended Security Maintenance (ESM)
esm-infra     yes        UA Infra: Extended Security Maintenance (ESM)
fips          yes        NIST-certified FIPS modules
fips-updates  yes        Uncertified security updates to FIPS modules
livepatch     yes        Canonical Livepatch service

This machine is not attached to a UA subscription.
See https://ubuntu.com/advantage
csmith@downtown:~/ $ lxc exec test-27-b -- ua attach <REDACTED_NO_APPS>
Enabling default service esm-infra
Updating package lists
UA Infra: ESM enabled
This machine is now attached to '<email address hidden>'

SERVICE       ENTITLED  STATUS    DESCRIPTION
cc-eal        yes       n/a       Common Criteria EAL2 Provisioning Packages
cis           yes       disabled  Center for Internet Security Audit Tools
esm-apps      no        —         UA Apps: Extended Security Maintenance (ESM)
esm-infra     yes       enabled   UA Infra: Extended Security Maintenance (ESM)
fips          yes       n/a       NIST-certified FIPS modules
fips-updates  yes       n/a       Uncertified security updates to FIPS modules
livepatch     yes       n/a       Canonical Livepatch service

NOTICES
Operation in progress: ua attach

Enable services with: ua enable <service>

     Account: <email address hidden>
Subscription: <email address hidden>
csmith@downtown:~/ $ lxc exec test-27-b -- ua enable esm-apps
One moment, checking your subscription first
This subscription is not entitled to UA Apps: ESM
For more information see: https://ubuntu.com/advantage.
csmith@downtown:~/ $ lxc exec test-27-b -- grep Traceback /var/log/ubuntu-advantage.log
csmith@downtown:~/ $ lxc exec test-27-b -- ua detach
Detach will disable the following service:
    esm-infra
Are you sure? (y/N) y
Updating package lists
This machine is now detached.
csmith@downtown:~/ $ lxc exec test-27-b -- ua attach <REDACTED_WITH_APPS>
Enabling default service esm-apps
Updating package lists
UA Apps: ESM enabled
Enabling default service esm-infra
Updating package lists
UA Infra: ESM enabled
This machine is now attached to 'UA Applications - Essential (Physical)'

SERVICE       ENTITLED  STATUS    DESCRIPTION
cc-eal        yes       n/a       Common Criteria EAL2 Provisioning Packages
cis           yes       disabled  Center for Internet Security Audit Tools
esm-apps      yes       enabled   UA Apps: Extended Security Maintenance (ESM)
esm-infra     yes       enabled   UA Infra: Extended Security Maintenance (ESM)
fips          yes       n/a       NIST-certified FIPS modules
fips-updates  yes       n/a       Uncertified security updates to FIPS modules
livepatch     yes       n/a       Canonical Livepatch service

NOTICES
Operation in progress: ua attach

Enable services with: ua enable <service>

                Account: 
           Subscription: UA Applications - Essential (Physical)
            Valid until: 3999-12-31 00:00:00
Technical support level: essential
csmith@downtown:~/ $ lxc exec test-27-b -- grep Traceback /var/log/ubuntu-advantage.log
csmith@downtown:~/ $ lxc exec test-27-b -- apt install krb5-locales=1.16-2build1
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following package was automatically installed and is no longer required:
  libfreetype6
Use 'apt autoremove' to remove it.
The following packages will be DOWNGRADED:
  krb5-locales
0 upgraded, 0 newly installed, 1 downgraded, 0 to remove and 3 not upgraded.
Need to get 13.8 kB of archives.
After this operation, 171 kB disk space will be freed.
Do you want to continue? [Y/n] y
Get:1 http://archive.ubuntu.com/ubuntu bionic/main amd64 krb5-locales all 1.16-2build1 [13.8 kB]
Fetched 13.8 kB in 0s (41.2 kB/s)        
dpkg: warning: downgrading krb5-locales from 1.16-2ubuntu0.2+esm1 to 1.16-2build
1
(Reading database ... 28931 files and directories currently installed.)
Preparing to unpack .../krb5-locales_1.16-2build1_all.deb ...
Unpacking krb5-locales (1.16-2build1) over (1.16-2ubuntu0.2+esm1) ...
Setting up krb5-locales (1.16-2build1) ...
csmith@downtown:~/ $ lxc exec test-27-b -- ua fix USN-4850
Error: issue "USN-4850" is not recognized.
Usage: "ua fix CVE-yyyy-nnnn" or "ua fix USN-nnnn"
csmith@downtown:~/ $ lxc exec test-27-b -- ua fix USN-4850-1
USN-4850-1: Kerberos vulnerabilities
Found CVEs:
https://ubuntu.com/security/CVE-2018-20217
https://ubuntu.com/security/CVE-2020-28196
1 affected package is installed: krb5
(1/1) krb5:
A fix is available in UA Apps.
{ apt update && apt install --only-upgrade -y krb5-locales }
✔ USN-4850-1 is resolved.