CVE-2026-42769
Publication date 9 June 2026
Last updated 9 June 2026
Ubuntu priority
Description
Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate
Read the notes from the security team
Why is this CVE low priority?
OpenSSL developers have rated this as being low severity
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| edk2 | 26.04 LTS resolute |
Needs evaluation
|
| 25.10 questing |
Needs evaluation
|
|
| 24.04 LTS noble |
Not affected
|
|
| 22.04 LTS jammy |
Not affected
|
|
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Not affected
|
|
| nodejs | 26.04 LTS resolute |
Not affected
|
| 25.10 questing |
Not affected
|
|
| 24.04 LTS noble |
Not affected
|
|
| 22.04 LTS jammy |
Vulnerable
|
|
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Not affected
|
|
| 14.04 LTS trusty |
Not affected
|
|
| openssl | 26.04 LTS resolute |
Fixed 3.5.5-1ubuntu3.2
|
| 25.10 questing |
Fixed 3.5.3-1ubuntu3.4
|
|
| 24.04 LTS noble |
Not affected
|
|
| 22.04 LTS jammy |
Not affected
|
|
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial |
Not affected
|
|
| 14.04 LTS trusty |
Not affected
|
|
| openssl-fips | 26.04 LTS resolute | Not in release |
| 25.10 questing | Not in release | |
| 24.04 LTS noble |
Not affected
|
|
| 22.04 LTS jammy |
Not affected
|
|
| openssl1.0 | 26.04 LTS resolute | Not in release |
| 25.10 questing | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 18.04 LTS bionic |
Not affected
|
Notes
mdeslaur
edk2 in jammy embeds OpenSSL 1.1.1j edk2 in noble embeds OpenSSL 3.0.9 edk2 in plucky embeds OpenSSL 3.4.0 edk2 in questing embeds OpenSSL 3.4.0 nodejs in jammy embeds OpenSSL 1.1.1m OpenSSL 4.0, 3.6, 3.5, and 3.4 are vulnerable to this issue.
References
Related Ubuntu Security Notices (USN)
- USN-8414-1
- OpenSSL vulnerabilities
- 9 June 2026