Vulnerabilites related to certifi - python-certifi
cve-2023-37920
Vulnerability from cvelistv5
Published
2023-07-25 20:45
Modified
2025-03-05 18:47
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Summary
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store.
References
https://github.com/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp7x_refsource_CONFIRM
https://github.com/certifi/python-certifi/commit/8fb96ed81f71e7097ed11bc4d9b19afd7ea5c909x_refsource_MISC
https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/C-HrP1SEq1Ax_refsource_MISC
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EX6NG7WUFNUKGFHLM35KHHU3GAKXRTG/
Impacted products
Vendor Product Version
certifi python-certifi Version: >= 2015.04.28, < 2023.07.22
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-09-12T16:02:55.011Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "https://github.com/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp7",
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp7",
               },
               {
                  name: "https://github.com/certifi/python-certifi/commit/8fb96ed81f71e7097ed11bc4d9b19afd7ea5c909",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/certifi/python-certifi/commit/8fb96ed81f71e7097ed11bc4d9b19afd7ea5c909",
               },
               {
                  name: "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/C-HrP1SEq1A",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/C-HrP1SEq1A",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EX6NG7WUFNUKGFHLM35KHHU3GAKXRTG/",
               },
               {
                  url: "https://security.netapp.com/advisory/ntap-20240912-0002/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-37920",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-05T18:38:32.972572Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-05T18:47:15.819Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "python-certifi",
               vendor: "certifi",
               versions: [
                  {
                     status: "affected",
                     version: ">= 2015.04.28, < 2023.07.22",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes \"e-Tugra\" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from \"e-Tugra\" from the root store.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-345",
                     description: "CWE-345: Insufficient Verification of Data Authenticity",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-08-12T05:07:57.236Z",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               name: "https://github.com/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp7",
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp7",
            },
            {
               name: "https://github.com/certifi/python-certifi/commit/8fb96ed81f71e7097ed11bc4d9b19afd7ea5c909",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/certifi/python-certifi/commit/8fb96ed81f71e7097ed11bc4d9b19afd7ea5c909",
            },
            {
               name: "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/C-HrP1SEq1A",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/C-HrP1SEq1A",
            },
            {
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EX6NG7WUFNUKGFHLM35KHHU3GAKXRTG/",
            },
         ],
         source: {
            advisory: "GHSA-xqr8-7jwr-rhp7",
            discovery: "UNKNOWN",
         },
         title: "Certifi's removal of e-Tugra root certificate",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2023-37920",
      datePublished: "2023-07-25T20:45:35.286Z",
      dateReserved: "2023-07-10T17:51:29.612Z",
      dateUpdated: "2025-03-05T18:47:15.819Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2024-39689
Vulnerability from cvelistv5
Published
2024-07-05 18:39
Modified
2025-02-14 23:19
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Summary
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.7.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."
References
https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwcx_refsource_CONFIRM
https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463x_refsource_MISC
https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dIx_refsource_MISC
Impacted products
Vendor Product Version
certifi python-certifi Version: >= 2021.5.30, < 2024.7.4
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-39689",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-07-05T20:06:09.735041Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-07-05T20:06:22.343Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-12-06T13:09:31.501Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc",
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc",
               },
               {
                  name: "https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463",
               },
               {
                  name: "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI",
               },
               {
                  url: "https://security.netapp.com/advisory/ntap-20241206-0001/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "python-certifi",
               vendor: "certifi",
               versions: [
                  {
                     status: "affected",
                     version: ">= 2021.5.30, < 2024.7.4",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.7.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified \"long-running and unresolved compliance issues.\"",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-345",
                     description: "CWE-345: Insufficient Verification of Data Authenticity",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-02-14T23:19:13.111Z",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               name: "https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc",
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc",
            },
            {
               name: "https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463",
            },
            {
               name: "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI",
            },
         ],
         source: {
            advisory: "GHSA-248v-346w-9cwc",
            discovery: "UNKNOWN",
         },
         title: "Certifi removes GLOBALTRUST root certificate",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2024-39689",
      datePublished: "2024-07-05T18:39:33.202Z",
      dateReserved: "2024-06-27T18:44:13.035Z",
      dateUpdated: "2025-02-14T23:19:13.111Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-23491
Vulnerability from cvelistv5
Published
2022-12-07 21:15
Modified
2024-08-03 03:43
Severity ?
6.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
Summary
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.
References
https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8x_refsource_CONFIRM
https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJx_refsource_MISC
Impacted products
Vendor Product Version
certifi python-certifi Version: < 2022.12.07
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T03:43:46.116Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  url: "https://security.netapp.com/advisory/ntap-20230223-0010/",
               },
               {
                  name: "https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8",
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8",
               },
               {
                  name: "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "python-certifi",
               vendor: "certifi",
               versions: [
                  {
                     status: "affected",
                     version: "< 2022.12.07",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from \"TrustCor\" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 6.8,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "HIGH",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-345",
                     description: "CWE-345: Insufficient Verification of Data Authenticity",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-12-07T21:15:53.804Z",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               name: "https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8",
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8",
            },
            {
               name: "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ",
            },
         ],
         source: {
            advisory: "GHSA-43fp-rhv2-5gv8",
            discovery: "UNKNOWN",
         },
         title: "Removal of TrustCor root certificate",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2022-23491",
      datePublished: "2022-12-07T21:15:53.804Z",
      dateReserved: "2022-01-19T21:23:53.763Z",
      dateUpdated: "2024-08-03T03:43:46.116Z",
      requesterUserId: "c184a3d9-dc98-4c48-a45b-d2d88cf0ac74",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}