USN-9036-1: ca-certificates-java update
It was discovered that the ca-certificates-java JKS handling was not working properly in certain system languages, resulting in CA certificates removed from the system bundle not being removed from the JKS keystore. This update corrects the feature and resyncs the keystore with the system CA certificates list.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/ca-certificates-javato a version that resolves this vulnerability.Fixed in 20190909ubuntu1.5 - Upgrade
Upgrade
ubuntu/ca-certificates-javato a version that resolves this vulnerability.Fixed in 20240118ubuntu0.24.04.2 - Upgrade
Upgrade
ubuntu/ca-certificates-javato a version that resolves this vulnerability.Fixed in 20260311ubuntu0.26.10.2 - Upgrade
Upgrade
ubuntu/ca-certificates-javato a version that resolves this vulnerability.Fixed in 20260311ubuntu0.26.04.2
Event History
Frequently Asked Questions
Which systems are affected by the JKS keystore synchronization problem?
The issue occurs on systems using ca-certificates-java where JKS handling is performed in certain system languages. The provided information does not identify the specific languages or Ubuntu releases affected.
What is the practical impact of an out-of-sync JKS keystore?
CA certificates removed from the system CA bundle may remain trusted in the Java JKS keystore. Java applications relying on that keystore could therefore continue to trust certificates that were removed from the system bundle.
What does the update do?
The update corrects the JKS handling behavior and resynchronizes the Java keystore with the current system CA certificate list.