Ubuntu USN-8947-1 Removes Compromised CA Trust from NSS
Tech GuruQuick Answer
Ubuntu USN-8947-1 updates NSS trust stores from Ubuntu 14.04 ESM through 26.10 after intermediate CA compromise. Install the release-specific NSS package, restart long-running NSS consumers, verify the affected roots are no longer trusted, test TLS, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Ubuntu NSS packages, trust stores, NSS-linked applications, release and entitlement, and owners; install the USN-listed build; restart long-running consumers; verify the affected roots are removed or distrusted; test representative TLS paths; and retain evidence.
Last verified: 2026-10-22 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | NSS trust-store packages on Ubuntu 14.04 ESM through Ubuntu 26.10 |
|---|---|
| Advisory | USN-8947-1 |
| CVEs | |
| Authoritative release date | 2026-10-21 17:40:27.038401 UTC |
| Authority revision date | 2026-10-21 17:40:27.038401 UTC |
| Affected versions | Ubuntu NSS packages before the advisory-listed builds that still trust emSign ECC Root CA - G3 or Comodo AAA Services root; software with an independent bundled trust store requires separate review. |
| Fixed version | bionic: nss 2:3.35-2ubuntu2.16+esm2; focal: nss 2:3.98-0ubuntu0.20.04.2+esm2; jammy: nss 2:3.98-0ubuntu0.22.04.5; noble: nss 2:3.98-1ubuntu0.3; resolute: nss 2:3.120-1ubuntu2.2; stonking: nss 2:3.127-1ubuntu0.1; trusty: nss 2:3.28.4-0ubuntu0.14.04.5+esm14; xenial: nss 2:3.28.4-0ubuntu0.16.04.14+esm6 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Ubuntu does not state that this issue is being maliciously exploited.; no exploitation claim is inferred. |
What Changed
Ubuntu updated NSS to remove emSign ECC Root CA - G3 and Comodo AAA Services root after intermediate CA certificates were compromised.
What To Validate Now
- Inventory. Identify NSS trust-store packages on Ubuntu 14.04 ESM through Ubuntu 26.10, exact Ubuntu release and package version, workload or service dependencies, exposure, owner, and maintenance constraints.
- Establish applicability. Match each host to USN-8947-1 and its release-specific package scope. Ubuntu NSS packages before the advisory-listed builds that still trust emSign ECC Root CA - G3 or Comodo AAA Services root; software with an independent bundled trust store requires separate review. Do not infer applicability from the package family alone.
- Remediate. Install the advisory-listed package through the supported Ubuntu or Ubuntu Pro channel, then restart or reload dependent services when required by normal operations.
- Validate. Confirm the installed package version and active process state, exercise representative dependent workflows, monitor for regressions, and retain package, change, restart, and validation evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
An NSS package update does not change applications that bundle another trust store. Older fixes require Ubuntu Pro or Legacy Support entitlements, and long-running processes may continue using cached trust state until restarted.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
