CVE-2023-32803

HighCVSS 7.5

Published: 14/09/2026(UTC)Updated: 22/09/2026(UTC)Translated: 14/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Summary

The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certificates from the root store. This issue exists because of an incorrect fix for CVE-2022-23491.

Risk Assessment

Unremoved TrustCor root certificates remain trusted on the system, potentially allowing an attacker to impersonate trusted services using those certificates.

Recommendation

Update the ca-certificates package to version ca-certificates-2021.2.50-72 or later on Amazon Linux 2.

Other vulnerabilities in ca-certificates

CVE-2026-114406Medium
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities that signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could exploit this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by TLS/SSL clients using the system CA store. Due to the inability to distrust only specific intermediate certificates in all clients, root CA certificates of authorities that signed weak intermediate certificates are being removed.

Original NVD description (English source)

The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certificates from the root store. NOTE: this issue exists because of an incorrect fix for CVE-2022-23491.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS