Description

The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certificates from the root store. NOTE: this issue exists because of an incorrect fix for CVE-2022-23491.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-14T05:16:57.290Z",
  "pubdate": "2026-09-14T05:16:57.290Z",
  "executiveSummary": "The ca-certificates package for Amazon Linux 2 (AL2) contains a vulnerability where specific TrustCor root certificates remain in the system trust store despite intended removal procedures.\nThis issue stems from an ineffective remediation for CVE-2022-23491, resulting in a persistent trust state for revoked or compromised certificates.\nThe vulnerability type is improper certificate revocation handling, which impacts the integrity of the TLS/SSL trust chain.\nAffected systems are running ca-certificates versions prior to 2021.2.50-72 on Amazon Linux 2.\nThe risk implication is significant, as it allows for the potential validation of malicious certificates signed by untrusted or compromised certificate authorities (CAs), facilitating Man-in-the-Middle (MitM) attacks.\nAn attacker capable of intercepting network traffic could exploit this lack of revocation to present fraudulent certificates that are implicitly trusted by the OS and applications relying on the system root store.\nNo specific authentication is required for an attacker to leverage this trust flaw; however, successful exploitation requires the attacker to position themselves in the network path of the target system's outgoing connections.",
  "technicalDetails": "The core issue is a failure in the certificate cleanup logic within the ca-certificates package on Amazon Linux 2. Specifically, the package fails to correctly purge TrustCor root certificates, which were meant to be removed from the system's trusted anchor store. This vulnerability is identified as a secondary failure resulting from an incorrect fix for CVE-2022-23491.\nWhen a root certificate is meant to be distrusted, it must be removed from the trust store (typically located in /etc/pki/ca-trust/source/ or /usr/share/pki/ca-trust-source/) and the system-wide certificate bundle must be regenerated using tools like update-ca-trust. Because the remediation for the predecessor CVE failed to fully remove the certificate entries or the corresponding trust flags, the affected system continues to treat TrustCor as a valid root of trust.\nThe attack flow relies on the trust anchor mechanism of TLS/SSL clients. When an application on the affected AL2 instance initiates an HTTPS or TLS connection, it references the local ca-certificates bundle to verify the server's certificate. Because the system still recognizes the TrustCor root as a valid anchor, an attacker can perform a Man-in-the-Middle (MitM) attack by presenting a certificate signed by a TrustCor-controlled intermediate or sub-CA. The victim system, seeing the chain terminates at a trusted root, erroneously verifies the attacker's connection as legitimate.\nThis does not require the attacker to compromise a legitimate server; rather, it allows them to intercept and decrypt secure traffic if they can force the target system's communication through an attacker-controlled proxy or network junction. The impact post-exploitation includes the ability to inspect sensitive data, intercept credentials, or inject malicious content into ostensibly secure sessions without triggering certificate warnings.\nAffected versions of ca-certificates include any release prior to 2021.2.50-72. The flaw exists because the packaging scripts failed to properly scrub the certificate store during the package update process. Even if security policies dictate that these certificates should not be trusted, the underlying file-based storage remains populated with the restricted certificates, ensuring that all subsequent calls to cryptographic libraries relying on this bundle inherit the insecure trust state.\nPrivilege escalation is not required to exploit the results of this vulnerability, as the trust store is globally readable by processes on the system. The failure is persistent across system reboots as the certificate store is static until updated by a subsequent, corrected package version."
}