Skip to content
NewA calmer, faster ZeroHour
StoryAdvisorymedium

Ubuntu Java keystore updates drop CAs removed from the system bundle

1 source · 3 articlesFirst reported Updated ()
What's new

November 10: USN-9036-1 says ca-certificates-java failed to drop removed system CAs from the JKS keystore in certain system languages, and the update resyncs the keystore.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Ubuntu resyncs the Java JKS keystore so removed system CAs are no longer trusted, including a language-specific fix.

Ubuntu says the ca-certificates Java integration failed to delete certificates after they left the system CA bundle, so those CAs could remain in the JKS keystore. USN-9001-1 corrects the integration and resynchronizes the keystore with the system CA list. USN-9001-2 extends the same ca-certificates and ca-certificates-java fix to Ubuntu 18.04 LTS and 20.04 LTS. USN-9036-1 separately fixes ca-certificates-java mishandling JKS updates in certain system languages, with the same leftover-certificate effect. None of the notices names a CVE or reports exploitation.

Key facts
  • USN-9001-1 fixes JKS retention of CAs removed from the system bundle.
  • USN-9001-2 brings that fix to Ubuntu 18.04 LTS and 20.04 LTS.
  • USN-9036-1 covers JKS mishandling under certain system languages.
  • The updates resync the Java keystore with the system CA list.
  • Notices name no CVE and do not report exploitation.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 5, 2026USN-9001-1 corrects JKS retention of removed CAs. · Ubuntu Security Notices
  2. Nov 9, 2026USN-9001-2 extends the fix to 18.04 and 20.04 LTS. · Ubuntu Security Notices
  3. Nov 10, 2026USN-9036-1 fixes language-specific JKS update mishandling. · Ubuntu Security Notices

What each outlet adds

beyond the shared facts
  • Ubuntu Security NoticesUSN-9001-1 first describes leftover CAs in the JKS keystore.
  • Ubuntu Security NoticesUSN-9001-2 covers Ubuntu 18.04 LTS and 20.04 LTS.
  • Ubuntu Security NoticesUSN-9036-1 limits the defect to certain system languages.
Vendors
Ubuntu
Products
ca-certificatesca-certificates-java

Coverage

oldest first · one row per article · UTC
  1. · 5d ago Ubuntu Security NoticesFirst report

    Ubuntu ca-certificates update resyncs JKS after CA removals

    CAs deleted from the system bundle could stay trusted in the Java JKS keystore until the resync.

  2. · 1d ago Ubuntu Security Notices

    Ubuntu 18.04 and 20.04 get ca-certificates JKS keystore fix

    CA certificates removed from the system bundle could remain in the Java JKS keystore until this resync.

  3. · 12h ago Ubuntu Security Notices

    Ubuntu fixes ca-certificates-java leaving removed CAs in JKS

    In some system languages, certificates dropped from the system bundle stayed trusted in the Java keystore.