As for why it isn't in Ubuntu 22.04 - perhaps because the Ubuntu release schedule does not match debian's.
Debian buster was released in september 2022 - Ubuntu's April tagging is probably based off of the prior debian release which only gets critical updates.
Comments
The fix is in debian (and in devian derivatives like devuan) https://security-tracker.debian.org/tracker/CVE-2022-42252
As for why it isn't in Ubuntu 22.04 - perhaps because the Ubuntu release schedule does not match debian's. Debian buster was released in september 2022 - Ubuntu's April tagging is probably based off of the prior debian release which only gets critical updates.