PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-32803 Amazon CVE debrief

The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certificates from the root store. This issue exists because of an incorrect fix for CVE-2022-23491. Affected product deployments should be confirmed in managed environments, and an owner should be assigned for follow-up. The vulnerability class involves improper removal of TrustCor root certificates, which could lead to potential security risks. The source confidence is limited to the information provided in the CVE record and NVD entry. Review context is necessary to validate affected scope, severity, and vendor guidance.

Vendor
Amazon
Product
ca-certificates
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-14
Original CVE updated
2026-09-22
Advisory published
2026-09-14
Advisory updated
2026-09-22

Who should care

Defenders responsible for Amazon Linux 2 systems, particularly those managing certificate trust stores and security configurations, should assess exposure and verify remediation efforts.

Why it matters

CVE-2023-32803 requires verification of ca-certificates versions and assessment of exposure in Amazon Linux 2 environments to mitigate potential security risks.

  • Verification of certificate trust stores is required to ensure secure connections.
  • Potential security risks may arise from unremoved TrustCor root certificates.
  • Remediation efforts should focus on updating ca-certificates to the latest version.

Technical summary

The ca-certificates package in Amazon Linux 2 did not properly remove certain TrustCor root certificates, potentially allowing for security risks due to an incorrect fix for CVE-2022-23491. This issue may impact defenders responsible for Amazon Linux 2 systems, particularly those managing certificate trust stores and security configurations. Verification of certificate trust stores is required to ensure secure connections. The defensive impact involves prioritizing verification of the presence of updated ca-certificates and assessing exposure in Amazon Linux 2. A

Defensive priority

Defenders should prioritize verifying the presence of updated ca-certificates and assessing exposure in Amazon Linux 2 environments.

Recommended defensive actions

  • Verify the version of ca-certificates installed on Amazon Linux 2 systems
  • Assess exposure to potential risks associated with unremoved TrustCor root certificates
  • Update ca-certificates to version 2021.2.50-72 or later if necessary

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional verification is required to determine the full scope of affected systems and remediation efforts.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-32803 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-32803

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-32803 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-32803

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.