This bug was fixed in the package ca-certificates -
20260816ubuntu0.22.04.2
---------------
ca-certificates (20260816ubuntu0.22.04.2) jammy-security; urgency=medium
* debian/ca-certificates.postinst: only populate /etc/ssl/certs without
running the hooks on initial installs. On upgrades, running
update-ca-certificates synchronously with an empty hooksdir consumed
the pending changes, so the deferred update-ca-certificates trigger
reported "0 added, 0 removed" and the hooks in
/etc/ca-certificates/update.d (ca-certificates-java,
ca-certificates-mono) were never told which certificates were added
or removed. Their keystores drifted from the system trust store and
kept trusting CAs removed from /etc/ssl/certs, including the eMudhra
root blacklisted in 20260816ubuntu0.22.04.1 (LP: #2061817,
Debian #1069251).
-- Vyom Yadav <[email protected]> Thu, 22 Oct 2026 18:52:38
+0530
** Changed in: ca-certificates-java (Ubuntu Resolute)
Status: New => Fix Released
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2061817
Title:
[regression][security] ca-certificates.postinst does not feed
adds/removes to hooks
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ca-certificates/+bug/2061817/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
