CVE-2023-32803: Amzn/ca-certificates vulnerability
The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certificates from the root store. NOTE: this issue exists because of an incorrect fix for CVE-2022-23491.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ca-certificates (Amazon Linux 2)to a version that resolves this vulnerability.Fixed in ca-certificates-2021.2.50-72
Event History
Frequently Asked Questions
Which systems are affected?
Amazon Linux 2 systems with a ca-certificates package version earlier than ca-certificates-2021.2.50-72 are affected.
What is the practical impact of the incomplete certificate removal?
Certain TrustCor root certificates remain in the system root store when they should have been removed. Applications that rely on that root store may continue to trust certificates chaining to those roots.
How can I determine whether a system is remediated?
Check the installed ca-certificates package version. Systems running ca-certificates-2021.2.50-72 or later are not affected by this issue.