Ubuntu 18.04 and 20.04 get ca-certificates JKS keystore fix
Original title: USN-9001-2: ca-certificates update
CA certificates removed from the system bundle could remain in the Java JKS keystore until this resync.
USN-9001-2 brings the earlier ca-certificates and ca-certificates-java fix to Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. The JKS integration did not drop certificates removed from the system CA bundle, so they stayed in the Java keystore. The update corrects that behavior and resynchronizes the keystore with the system CA list. The notice does not name a CVE or report exploitation.
Unconfirmed: The notice does not name a CVE or say whether stale certificates were exploited.
- USN-9001-1 previously fixed ca-certificates and ca-certificates-java.
- This notice covers Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
- Removed CAs stayed in the JKS keystore after leaving the system bundle.
- The update resyncs the keystore with the system CA certificates list.
Impact: Removed CAs can remain trusted in the Java keystore
| Product | Affected |
|---|---|
| Ubuntu ca-certificates | Ubuntu 18.04 LTS and Ubuntu 20.04 LTS |
| Ubuntu ca-certificates-java | Ubuntu 18.04 LTS and Ubuntu 20.04 LTS |
- 1.Install the USN-9001-2 ca-certificates updates on Ubuntu 18.04 LTS and 20.04 LTS.
From the original article
USN-9001-1 fixed a vulnerability in ca-certificates, ca-certificates-java. This update provides the corresponding fix for Ubuntu 18. 04 LTS and Ubuntu 20.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.