CVE-2023-32803: Amazon Linux 2 Certificate Store Vulnerability

CVE-2023-32803 Overview

CVE-2023-32803 affects the ca-certificates package on Amazon Linux 2 (AL2). Versions before ca-certificates-2021.2.50-72 fail to properly remove certain TrustCor root certificates from the system root store. The flaw results from an incomplete fix for CVE-2022-23491, leaving distrusted TrustCor roots trusted on affected hosts. Attackers holding a certificate chained to one of the retained TrustCor roots can present TLS certificates that clients accept as valid. This weakens the integrity guarantees of TLS on affected systems and enables man-in-the-middle scenarios against outbound connections.

Critical Impact
TrustCor root certificates that Mozilla and downstream distributions distrusted remain in the AL2 root store, allowing adversaries with a chain to those roots to impersonate arbitrary TLS endpoints.

Affected Products

Amazon Linux 2 (AL2)
ca-certificates package versions prior to ca-certificates-2021.2.50-72
Applications and services on AL2 that rely on the system root trust store for TLS validation

Discovery Timeline

2026-09-14 - CVE-2023-32803 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2023-32803

Vulnerability Analysis

The issue is categorized under [CWE-669] Incorrect Resource Transfer Between Spheres. The ca-certificates package on Amazon Linux 2 curates the operating system's set of trusted root Certificate Authorities (CAs). Following disclosures about TrustCor's operational practices, upstream trust stores removed several TrustCor root CAs. The AL2 fix intended to mirror that removal did not fully purge the targeted TrustCor roots from the distributed trust bundle. As a result, TLS clients on AL2, including curl, wget, language runtimes, and package managers, continue to treat certificates issued under those TrustCor roots as trusted. The scope is limited to integrity of TLS trust decisions; confidentiality and availability are not directly impacted by the packaging defect itself, though downstream impersonation can lead to data interception.

Root Cause

The original remediation for CVE-2022-23491 did not correctly transfer the distrust decision into the AL2 CA bundle build process. Specific TrustCor root certificates remained included in /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem and related trust artifacts after the intended fix was applied.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction on the affected system. An attacker capable of presenting a TLS certificate chained to a retained TrustCor root, whether through a rogue intermediate, misissuance, or on-path interception, can convince AL2 clients that the certificate is valid. This enables man-in-the-middle attacks against outbound HTTPS, package repository fetches, and any other TLS-dependent workflow on the host.

No verified public exploit code exists for this specific packaging defect. See the AWS Security Advisory ALAS-2023-1957 for technical details.

Detection Methods for CVE-2023-32803

Indicators of Compromise

Presence of TrustCor root certificates in /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem on AL2 hosts running ca-certificates older than 2021.2.50-72.
Successful TLS handshakes from AL2 workloads to endpoints whose certificate chains terminate at a TrustCor root.
Unexpected TLS certificate chain anomalies in outbound traffic logs from AL2 systems.

Detection Strategies

Query installed package versions with rpm -q ca-certificates and flag any version older than ca-certificates-2021.2.50-72.
Inspect the extracted CA bundle for TrustCor issuer strings using grep -i trustcor /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem.
Correlate host inventory data with the AWS advisory to prioritize AL2 hosts that have not received the fixed package.

Monitoring Recommendations

Ingest TLS metadata from network sensors and endpoint agents to identify certificates chaining to TrustCor issuers.
Alert on package inventory drift when hosts remain on vulnerable ca-certificates versions after patch cycles.
Track outbound TLS destinations from AL2 systems and investigate connections presenting distrusted root anchors.

How to Mitigate CVE-2023-32803

Immediate Actions Required

Update the ca-certificates package on all Amazon Linux 2 hosts to ca-certificates-2021.2.50-72 or later.
Rebuild AL2 golden images and container base images that ship ca-certificates to include the fixed version.
Rotate any long-lived AL2 instances through configuration management to enforce package updates.

Patch Information

Amazon Web Services published the fix in AWS Security Advisory ALAS-2023-1957. Install the patched package with yum update ca-certificates on Amazon Linux 2. Additional context is available on the AWS CVE-2023-32803 exploration page.

Workarounds

Manually blacklist TrustCor roots using trust anchor --remove on the specific certificate files under /etc/pki/ca-trust/source/blacklist/, then run update-ca-trust extract.
Pin certificate authorities at the application layer for critical TLS clients rather than relying solely on the system trust store.
Restrict outbound TLS from AL2 workloads to known destinations through egress proxies that perform independent chain validation.

bash

# Configuration example
sudo yum update -y ca-certificates
rpm -q ca-certificates
grep -c -i trustcor /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
sudo update-ca-trust extract