UnratedFix available
ca-certificates update
Type: advisorySources: OSV
This update removes the "emSign ECC Root CA - G3" CA certificate due to intermediate CA certificates being compromised. In addition, in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS, the ca-certificates package contained outdated CA certificates. This update refreshes the included certificates to those contained in the 2.90 version of the Mozilla certificate authority bundle.
- Products
- ca-certificates
- Affected versions
- 20210119ubuntu1, 20211016, 20211016ubuntu0.22.04.1, 20230311ubuntu0.22.04.1, 20230311ubuntu1, 20240203, 20240203~22.04.1, 20250419, 20250419build1, 20260223, 20260601, 20260601~22.04.1, 20260601~24.04.1, 20260601~26.04.1, 20260816
- Fixed versions
- 20260816ubuntu0.22.04.1, 20260816ubuntu0.24.04.1, 20260816ubuntu0.26.04.1, 20260816ubuntu0.26.10.1
- CVEs
- Not specified
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 13:26 UTC · Revision 1
Source evidence
This update removes the "emSign ECC Root CA - G3" CA certificate due to intermediate CA certificates being compromised. In addition, in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS, the ca-certificates package contained outdated CA certificates. This update refreshes the included certificates to those contained in the 2.90 version of the Mozilla certificate authority bundle.
osv:USN-8944-1
ca-certificates
Fixed versions: 20260816ubuntu0.22.04.1
ca-certificates
Fixed versions: 20260816ubuntu0.24.04.1
ca-certificates
Fixed versions: 20260816ubuntu0.26.10.1
ca-certificates
Fixed versions: 20260816ubuntu0.26.04.1
Complete source record
{
"id": "2e4babecbe3196d7e70a3703e64777ba08072afac00aa92474ed50849814157d",
"url": "https://osv.dev/vulnerability/USN-8944-1",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "ca-certificates update",
"summary": "This update removes the \"emSign ECC Root CA - G3\" CA certificate due to intermediate CA certificates being compromised. In addition, in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS, the ca-certificates package contained outdated CA certificates. This update refreshes the included certificates to those contained in the 2.90 version of the Mozilla certificate authority bundle.",
"evidence": "osv:USN-8944-1",
"products": [
{
"name": {
"value": "ca-certificates",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "20260816ubuntu0.22.04.1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "20210119ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "20211016",
"evidence": "/affected/0/versions"
},
{
"value": "20211016ubuntu0.22.04.1",
"evidence": "/affected/0/versions"
},
{
"value": "20230311ubuntu0.22.04.1",
"evidence": "/affected/0/versions"
},
{
"value": "20240203~22.04.1",
"evidence": "/affected/0/versions"
},
{
"value": "20260601~22.04.1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "ca-certificates",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "20260816ubuntu0.24.04.1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "20230311ubuntu1",
"evidence": "/affected/1/versions"
},
{
"value": "20240203",
"evidence": "/affected/1/versions"
},
{
"value": "20260601~24.04.1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "ca-certificates",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "20260816ubuntu0.26.10.1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "20260223",
"evidence": "/affected/2/versions"
},
{
"value": "20260601",
"evidence": "/affected/2/versions"
},
{
"value": "20260816",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "ca-certificates",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "20260816ubuntu0.26.04.1",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": [
{
"value": "20250419",
"evidence": "/affected/3/versions"
},
{
"value": "20250419build1",
"evidence": "/affected/3/versions"
},
{
"value": "20260223",
"evidence": "/affected/3/versions"
},
{
"value": "20260601~26.04.1",
"evidence": "/affected/3/versions"
}
]
}
],
"severity": "unknown",
"structured": {
"id": "USN-8944-1",
"aliases": [
"USN-8944-1"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "20260816ubuntu0.22.04.1"
}
]
}
],
"package": {
"name": "ca-certificates",
"purl": "pkg:deb/ubuntu/ca-certificates?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"20210119ubuntu1",
"20211016",
"20211016ubuntu0.22.04.1",
"20230311ubuntu0.22.04.1",
"20240203~22.04.1",
"20260601~22.04.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8944-1.json",
"cves_map": {
"cves": [],
"ecosystem": "Ubuntu:22.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "ca-certificates",
"binary_version": "20260816ubuntu0.22.04.1"
}
],
"availability": "No subscription required"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "20260816ubuntu0.24.04.1"
}
]
}
],
"package": {
"name": "ca-certificates",
"purl": "pkg:deb/ubuntu/ca-certificates?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"20230311ubuntu1",
"20240203",
"20260601~24.04.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8944-1.json",
"cves_map": {
"cves": [],
"ecosystem": "Ubuntu:24.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "ca-certificates",
"binary_version": "20260816ubuntu0.24.04.1"
}
],
"availability": "No subscription required"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "20260816ubuntu0.26.10.1"
}
]
}
],
"package": {
"name": "ca-certificates",
"purl": "pkg:deb/ubuntu/ca-certificates?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"20260223",
"20260601",
"20260816"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8944-1.json",
"cves_map": {
"cves": [],
"ecosystem": "Ubuntu:26.10"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "ca-certificates",
"binary_version": "20260816ubuntu0.26.10.1"
}
],
"availability": "No subscription required"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "20260816ubuntu0.26.04.1"
}
]
}
],
"package": {
"name": "ca-certificates",
"purl": "pkg:deb/ubuntu/ca-certificates?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"20250419",
"20250419build1",
"20260223",
"20260601~26.04.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8944-1.json",
"cves_map": {
"cves": [],
"ecosystem": "Ubuntu:26.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "ca-certificates",
"binary_version": "20260816ubuntu0.26.04.1"
}
],
"availability": "No subscription required"
}
}
],
"modified": "2026-10-20T22:45:16.295288409Z",
"provider": "osv",
"references": [
"https://ubuntu.com/security/notices/USN-8944-1",
"https://bugs.launchpad.net/bugs/2171507"
]
},
"related_cves": [],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 390728,
"published_at": "2026-10-20T15:52:06+00:00"
}