CVE-2023-32803CWE-669

CVE-2023-32803

High · published September 14, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
7.5
In the wild
Unconfirmed
What it is

The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certificates from the root store. NOTE: this issue exists because of an incorrect fix for CVE-2022-23491.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00183 · 7.5th percentile
Weakness
CWE-669 · Incorrect Resource Transfer Between Spheres
Published
2026-09-14T09:16Z
References (2)
https://alas.aws.amazon.com/AL2/ALAS-2023-1957.html · [email protected]https://explore.alas.aws.amazon.com/CVE-2023-32803.html · [email protected]
EPSS history
Timeline
  • 15 SEP 03:12Z
    EPSS moved — → 0%
    epss
  • 14 SEP 00:00Z
    The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certificates from the…
    cvelistv5