Ubuntu fixes ca-certificates-java leaving removed CAs in JKS
Original title: USN-9036-1: ca-certificates-java update
In some system languages, certificates dropped from the system bundle stayed trusted in the Java keystore.
Ubuntu security notice USN-9036-1 says ca-certificates-java mishandled JKS updates in certain system languages. CA certificates removed from the system bundle were not removed from the JKS keystore. The update corrects that behavior and resynchronizes the keystore with the system CA list. The notice names no CVE and does not describe exploitation.
- The defect is limited to JKS handling under certain system languages.
- Removed system CAs could remain present in the Java keystore.
- The package update resyncs the keystore with the system CA certificate list.
Impact: Removed system CAs can remain trusted in the JKS keystore
| Product | Affected |
|---|---|
| Ubuntu ca-certificates-java | — |
- 1.Install the updated ca-certificates-java package so the JKS keystore resyncs.
- Vendors
- Ubuntu
- Products
- ca-certificates-java
From the original article
It was discovered that the ca-certificates-java JKS handling was not working properly in certain system languages, resulting in CA certificates removed from the system bundle not being removed from the JKS keystore. This update corrects the feature and resyncs the keystore with the system CA certificates list.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.