USN-8947-1: Ubuntu removes compromised emSign and Comodo CAs from NSS

Ubuntu published security notice USN-8947-1 on 21 October 2026, updating the nss package (Network Security Services library) across all supported releases, from 14.04 LTS to 26.10. The update removes from the NSS trust store the certificate authorities "emSign ECC Root CA - G3" and "Comodo AAA Services root", because intermediate CAs depending on them have had their private keys compromised. This affects anyone running servers with Firefox, Thunderbird or other applications that directly rely on libnss3, not just websites served from that server.

Why this is a separate package update from the one already addressed

Ubuntu had already resolved the same issue for the system bundle through ca-certificates update. However, NSS maintains its own list of trusted CAs, separate from the one used by OpenSSL and curl: this is why a second update is needed. As explained by the Ubuntu security team, two cross-signed root CAs, emSign Root TLS CA – G3 and Comodo AAA Certificate Services, have been removed from the trust store because they granted trust to the compromised eMudhra CA, creating a limited but real risk that some hosts could become unreachable due to the use of revoked certificates.

According to InfoQ's analysis, the root cause is that the private keys of eight intermediate eMudhra CA certificates were found to be compromised, making it possible to forge certificates for any website; the keys were identified through low entropy analysis, not through a known breach.

Patched versions by release

Release	Codename	Package	Patched version	Notes
26.10	stonking	libnss3	2:3.127-1ubuntu0.1	—
26.04 LTS	resolute	libnss3	2:3.120-1ubuntu2.2	—
24.04 LTS	noble	libnss3	2:3.98-1ubuntu0.3	—
22.04 LTS	jammy	libnss3	2:3.98-0ubuntu0.22.04.5	—
20.04 LTS	focal	libnss3	2:3.98-0ubuntu0.20.04.2+esm2	requires Ubuntu Pro
18.04 LTS	bionic	libnss3	2:3.35-2ubuntu2.16+esm2	requires Ubuntu Pro
16.04 LTS	xenial	libnss3 / libnss3-1d / libnss3-nssdb	2:3.28.4-0ubuntu0.16.04.14+esm6	Ubuntu Pro, Legacy Support add-on
14.04 LTS	trusty	libnss3 / libnss3-1d / libnss3-nssdb	2:3.28.4-0ubuntu0.14.04.5+esm14	Ubuntu Pro, Legacy Support add-on

On systems running 22.04 LTS and later, the sudo apt update && sudo apt upgrade command or guided update is sufficient. The reference bug is tracked on Launchpad under issue number 2171737. Anyone managing servers with releases older than 22.04 must verify they have an active Ubuntu Pro subscription, which is necessary to receive the patch.