Yes, this is a fuckup by Canonical

But it doesn't sound too hard to backport a patch from Debian to Ubuntu yourself.

So if it's a critical security concern to your company, open your laptop and get to work.