Skip to content
OpenAdvisories
High ALAS2-2023-1957 1 CVE

Important: ca-certificates security update (Amazon Linux 2)

Published Feb 17, 2023 · Updated Feb 22, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-23491: Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2 ca-certificates 0:2021.2.50-72.amzn2.0.5

Vulnerabilities 1

  • Medium 6.8
    CVE-2022-23491

    Removal of TrustCor root certificate

    Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process o…

    certifi python-certifi certifi python-certifi Debian Ubuntu PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-23491.html