package upgrade should replace /etc/ssl/certs/ca-certificates.crt atomically

[ysth]

While upgrading the ca-certificates package, a process got the error:

SSL_ca_file /etc/ssl/certs/ca-certificates.crt does not exist

This file should be replaced atomically, with no time gap where the file does not exist.

(I am flagging this as a security vulnerability because, while I did not experience any security issue, I can imagine at least the possibility of this being exploitable in some way in some circumstances.)

[Steve Beattie (sbeattie)]

Ah yes, /usr/sbin/update-ca-certificates is deleting the ca-certificates.crt shortly before atomically moving the new version into place.

It looks like a fic was committed in debian for this a couple of weeks ago:

 https://salsa.debian.org/debian/ca-certificates/-/commit/8f8f4a525bd6a6c8a8d13530cda194d60275313d

but has not landed there.

[Simon Déziel (sdeziel)]

This was fixed in ca-certificates version 20211016 which is what Jammy released with. As of today, all Ubuntu releases from Bionic onward ship 20230311 so marking as fix released.