CVE-2023-32803

EUVD-2023-60651
The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certificates from the root store. NOTE: this issue exists because of an incorrect fix for CVE-2022-23491.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
ca-certificates
Amazon Linux 1
0:2018.2.22-65.1.30.amzn1
fixed
Amazon Linux 2
0:2021.2.50-72.amzn2.0.7
fixed
Amazon Linux 2023
0:2023.2.60-1.0.amzn2023.0.2
fixed
Common Weakness Enumeration
References
https://alas.aws.amazon.com/AL2/ALAS-2023-1957.html
https://explore.alas.aws.amazon.com/CVE-2023-32803.html