The private keys of eight intermediate certificate authorities (CAs) operated
by eMudhra have been compromised. An attacker with access to these keys can
issue certificates for any domain, which UCS systems accept as valid. The root
CAs emSign ECC Root CA - G3 and Comodo AAA Services root, which these
intermediate CAs chain to, have been removed from the system trust store in
UCS 5.2-7 and 5.2-6 errata 640, UCS 5.0-10 extended security errata 150 and
UCS 4.4-9 extended security errata 1904.
If you can’t install the errata update yet, run the following command as root
on each UCS system to block these root certificates:
sed -i \
-e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
-e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
/etc/ca-certificates.conf && update-ca-certificates
The change persists across updates of the ca-certificates package. Apps from
the App Center and other Docker containers use their own trust stores and are
not covered by this update.