Description
The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certificates from the root store. NOTE: this issue exists because of an incorrect fix for CVE-2022-23491.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Amazon | ca-certificates | < 2021.2.50-72 | 2021.2.50-72 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | ca-certificates +1 | 2025.2.80_v9.0.304-9.hum1 | RHSA-2026:40570 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | ca-certificates | 2023.2.60-1.0.amzn2023.0.2 | ALAS2023-2023-281 |
| Amazon Linux 2 | ca-certificates | 2021.2.50-72.amzn2.0.7 | ALAS2-2023-2203 |
Advisories 3
- RHSA-2026:40570 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- ALAS2023-2023-281 Important: ca-certificates security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 9, 2023
- ALAS2-2023-2203 Important: ca-certificates security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 8, 2023