There is a bug in diskimage-builder I reported it at 2017-03-10 as 'private security'. I think this bug is a medium severity. So far there was no reaction at all. I plan to change this bug to public security on next Monday. If someone is interested in bumping up CVE count for DIB, please look at https://bugs.launchpad.net/diskimage-builder/+bug/1671842 (private-walled for security group).