USN-8947-1: NSS update

Publication date

21 October 2026

Overview

The CA certificates in the nss package were updated.


Packages

  • nss - Network Security Service library

Details

This update removes the "emSign ECC Root CA - G3" and "Comodo AAA Services
root" CA certificate due to intermediate CA certificates being compromised.

This update removes the "emSign ECC Root CA - G3" and "Comodo AAA Services
root" CA certificate due to intermediate CA certificates being compromised.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
26.10 stonking libnss3 –  2:3.127-1ubuntu0.1
26.04 LTS resolute libnss3 –  2:3.120-1ubuntu2.2
24.04 LTS noble libnss3 –  2:3.98-1ubuntu0.3
22.04 LTS jammy libnss3 –  2:3.98-0ubuntu0.22.04.5
20.04 LTS focal libnss3 –  2:3.98-0ubuntu0.20.04.2+esm2  
18.04 LTS bionic libnss3 –  2:3.35-2ubuntu2.16+esm2  
16.04 LTS xenial libnss3 –  2:3.28.4-0ubuntu0.16.04.14+esm6  
libnss3-1d –  2:3.28.4-0ubuntu0.16.04.14+esm6  
libnss3-nssdb –  2:3.28.4-0ubuntu0.16.04.14+esm6  
14.04 LTS trusty libnss3 –  2:3.28.4-0ubuntu0.14.04.5+esm14  
libnss3-1d –  2:3.28.4-0ubuntu0.14.04.5+esm14  
libnss3-nssdb –  2:3.28.4-0ubuntu0.14.04.5+esm14  

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.


Have additional questions?

Talk to a member of the team ›