A failure in the ca-certificates package for Amazon Linux 2 prevents the removal of specific root certificates, creating a potential trust-based security risk.

This issue is classified as improper resource transfer between spheres (CWE-669). The package fails to correctly purge TrustCor root certificates from the root store, stemming from an incorrect previous remediation attempt. This affects the overall integrity of the system trust store, which is critical for verifying secure connections.

The retention of untrusted or deprecated root certificates can lead to successful man-in-the-middle attacks, as the system may erroneously trust malicious certificates. Given the CVSS score of 7.5, this vulnerability represents a significant risk to the confidentiality and integrity of communications originating from affected Amazon Linux 2 instances.

Immediate Action: Update the ca-certificates package to version 2021.2.50-72 or later on all Amazon Linux 2 instances.

Proactive Monitoring: Audit the system trust store on critical servers to ensure that expected root certificates are present and that unauthorized or untrusted certificates have been successfully removed.

Compensating Controls: Utilize network-level traffic inspection and ensure that applications use pinned certificates where possible to mitigate reliance on the system-wide root store.

Public Exploit Available: No

Patching this vulnerability is essential to maintain the integrity of certificate-based authentication and encryption. Administrators should deploy the updated package across all affected Amazon Linux 2 environments as part of their standard maintenance cycle.