Blacklist fraudulent UTN-USERFirst-Hardware certificates

[giff gill]

Binary package hint: firefox

Blacklist fraudulent UTN-USERFirst-Hardware certificates

http://blog.mozilla.com/security/2011/03/22/firefox-blocking-fraudulent-certificates/
https://blog.torproject.org/blog/detecting-certificate-authority-compromises-and-web-browser-collusion
Fixed upstream in 3.6.16 and 4.0

for nss: http://groups.google.com/group/mozilla.dev.tech.crypto/browse_thread/thread/de5774217cc33669#

Other packages are affected as well, e.g. ca-certificates, openssl, kdelibs, qt-x11, Java...?
and everything that depends on those: epiphany, konqueror, rekonq, wget, curl...

[Paul Bryan (pbryan)]

Does Ubuntu have a working group to determine which certificates should be included in its distributed software?

[giff gill (giffgilll-deactivatedaccount)]

As I understand it the debian ca-certificates is shipped more or less unmodified so no
also Bug #103074

[Jamie Strandboge (jdstrand)]

Firefox was fixed yesterday: https://lists.ubuntu.com/archives/ubuntu-security-announce/2011-March/001283.html

[Jamie Strandboge (jdstrand)]

3.12.9+ckbi-1.82-0ubuntu1 uploaded to Natty.

[Jamie Strandboge (jdstrand)]

qt4-x11 is being tracked in bug #742377.

[Launchpad Janitor (janitor)]

This bug was fixed in the package nss - 3.12.9+ckbi-1.82-0ubuntu0.8.04.1

---------------
nss (3.12.9+ckbi-1.82-0ubuntu0.8.04.1) hardy-security; urgency=low

  * New upstream release v3.12.9 with updated ckbi module
    (NSS_3_12_9_WITH_CKBI_1_82_RTM)
    - SECURITY UPDATE: Update "builtin certificates" module (ckbi) to
      explicitly mark the recently issued and revoked fraudulent certificates
      as explicitly not trusted; NSS will report SEC_ERROR_UNTRUSTED_CERT when
      attempting to verify one of these fraudulent certificates (LP: #741729)
  * Add new symbols
    - update debian/libnss3-1d.symbols
 -- Micah Gersten <email address hidden> Mon, 28 Mar 2011 03:30:20 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package nss - 3.12.9+ckbi-1.82-0ubuntu0.10.04.1

---------------
nss (3.12.9+ckbi-1.82-0ubuntu0.10.04.1) lucid-security; urgency=low

  * New upstream release v3.12.9 with updated ckbi module
    (NSS_3_12_9_WITH_CKBI_1_82_RTM)
    - SECURITY UPDATE: Update "builtin certificates" module (ckbi) to
      explicitly mark the recently issued and revoked fraudulent certificates
      as explicitly not trusted; NSS will report SEC_ERROR_UNTRUSTED_CERT when
      attempting to verify one of these fraudulent certificates (LP: #741729)
  * Add new symbols
    - update debian/libnss3-1d.symbols
 -- Micah Gersten <email address hidden> Mon, 28 Mar 2011 14:55:05 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package nss - 3.12.9+ckbi-1.82-0ubuntu0.10.10.1

---------------
nss (3.12.9+ckbi-1.82-0ubuntu0.10.10.1) maverick-security; urgency=low

  * New upstream release v3.12.9 with updated ckbi module
    (NSS_3_12_9_WITH_CKBI_1_82_RTM)
    - SECURITY UPDATE: Update "builtin certificates" module (ckbi) to
      explicitly mark the recently issued and revoked fraudulent certificates
      as explicitly not trusted; NSS will report SEC_ERROR_UNTRUSTED_CERT when
      attempting to verify one of these fraudulent certificates (LP: #741729)
  * Add new symbols
    - update debian/libnss3-1d.symbols
 -- Micah Gersten <email address hidden> Tue, 29 Mar 2011 03:13:10 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package nss - 3.12.9+ckbi-1.82-0ubuntu0.9.10.1

---------------
nss (3.12.9+ckbi-1.82-0ubuntu0.9.10.1) karmic-security; urgency=low

  * New upstream release v3.12.9 with updated ckbi module
    (NSS_3_12_9_WITH_CKBI_1_82_RTM)
    - SECURITY UPDATE: Update "builtin certificates" module (ckbi) to
      explicitly mark the recently issued and revoked fraudulent certificates
      as explicitly not trusted; NSS will report SEC_ERROR_UNTRUSTED_CERT when
      attempting to verify one of these fraudulent certificates (LP: #741729)
  * Add new symbols
    - update debian/libnss3-1d.symbols
 -- Micah Gersten <email address hidden> Mon, 28 Mar 2011 04:04:10 -0500

[Micah Gersten (micahg)]

Marking tasks as Won't Fix for now since ca-certificates has no blacklist functionality at the moment and we don't want to diverge from Debian. If Debian adds this functionality, we will revisit this.

[Micah Gersten (micahg)]

qt4-x11 was fixed in bug #742377

[jochen (jbecker)]

how can i unsubscribe this ?

greatings
jochen

[Jamie Strandboge (jdstrand)]

Thank you for reporting this bug to Ubuntu. karmic has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against karmic is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.

[Jamie Strandboge (jdstrand)]

Thank you for reporting this bug to Ubuntu. maverick has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against maverick is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.

[Rolf Leggewie (r0lf)]

lucid has seen the end of its life and is no longer receiving any updates. Marking the lucid task for this ticket as "Won't Fix".