Yes. For some reason people, even those running Ubuntu servers, are surprised to learn that universe has no guarantee to get updates for known vulnerabilities.

Yes. For some reason people, even those running Ubuntu servers, are surprised to learn that universe has no guarantee to get updates for known vulnerabilities. Ubuntu is currently divided into four components: main, restricted, universe and multiverse. All binary packages in main and restricted are supported by the Ubuntu Security team for the life of an Ubuntu release, while binary packages in universe and multiverse are supported by the Ubuntu community. https://wiki.ubuntu.com/SecurityTeam/FAQ https://wiki.ubuntu.com/SecurityTeam/FAQ If you care about security, disable universe and multiverse on servers, or use Debian Stable if you want a Debian-based distribution.