CVE-2023-32803

The ca-certificates package before version 2021.2.50-72 on Amazon Linux 2 fails to properly remove distrusted TrustCor root certificates from the system trust store, because the fix for CVE-2022-23491 was incomplete. A network attacker who can obtain a certificate chaining to a TrustCor root (or otherwise control that trust path) can impersonate any TLS/HTTPS endpoint to affected hosts, since applications relying on the OS trust bundle will accept the forged certificate as valid. The impact is on integrity: man-in-the-middle interception of encrypted connections without any privileges or user interaction, affecting any AL2 host or container that performs TLS validation with the vulnerable package. No public proof of concept exists, the flaw is not in CISA's KEV catalog, and no exploitation has been reported.

What to do: Run 'sudo yum update ca-certificates' on all Amazon Linux 2 hosts and rebuild any AL2-based container images, confirming you are at ca-certificates-2021.2.50-72 or later. Verify TrustCor entries are gone from the trust bundle (e.g., grep for 'TrustCor' in /etc/pki/tls/certs/ca-bundle.crt or the extracted trust store) and restart long-running services that cache the trust store. Consider migrating to Amazon Linux 2023 and watch TLS logs for unexpected certificate chains issued via TrustCor intermediates.