pysec - pysec-2022-42986

pysec-2022-42986

Vulnerability from pysec

Published

2022-12-07 22:15

Modified

2023-05-04 03:49

Details

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "certifi",
        "purl": "pkg:pypi/certifi"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2017.11.5"
            },
            {
              "fixed": "2022.12.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2017.11.5",
        "2018.1.18",
        "2018.10.15",
        "2018.11.29",
        "2018.4.16",
        "2018.8.13",
        "2018.8.24",
        "2019.11.28",
        "2019.3.9",
        "2019.6.16",
        "2019.9.11",
        "2020.11.8",
        "2020.12.5",
        "2020.4.5",
        "2020.4.5.1",
        "2020.4.5.2",
        "2020.6.20",
        "2021.10.8",
        "2021.5.30",
        "2022.5.18",
        "2022.5.18.1",
        "2022.6.15",
        "2022.6.15.1",
        "2022.6.15.2",
        "2022.9.14",
        "2022.9.24"
      ]
    }
  ],
  "aliases": [
    "CVE-2022-23491",
    "GHSA-43fp-rhv2-5gv8"
  ],
  "details": "Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from \"TrustCor\" from the root store. These are in the process of being removed from Mozilla\u0027s trust store. TrustCor\u0027s root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor\u0027s ownership also operated a business that produced spyware. Conclusions of Mozilla\u0027s investigation can be found in the linked google group discussion.",
  "id": "PYSEC-2022-42986",
  "modified": "2023-05-04T03:49:45.039819Z",
  "published": "2022-12-07T22:15:00Z",
  "references": [
    {
      "type": "ARTICLE",
      "url": "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ"
    },
    {
      "type": "WEB",
      "url": "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8"
    }
  ]
}

cve-2022-23491

Vulnerability from cvelistv5

Published

2022-12-07 21:15

Modified

2024-08-03 03:43

Severity ?

6.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

Summary

Removal of TrustCor root certificate

References

▼	URL	Tags
	https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8	x_refsource_CONFIRM
	https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ	x_refsource_MISC

Impacted products

▼	Vendor	Product
	certifi	python-certifi

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T03:43:46.116Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20230223-0010/"
          },
          {
            "name": "https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8"
          },
          {
            "name": "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "python-certifi",
          "vendor": "certifi",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2022.12.07"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from \"TrustCor\" from the root store. These are in the process of being removed from Mozilla\u0027s trust store. TrustCor\u0027s root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor\u0027s ownership also operated a business that produced spyware. Conclusions of Mozilla\u0027s investigation can be found in the linked google group discussion."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "CWE-345: Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-07T21:15:53.804Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8"
        },
        {
          "name": "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ"
        }
      ],
      "source": {
        "advisory": "GHSA-43fp-rhv2-5gv8",
        "discovery": "UNKNOWN"
      },
      "title": "Removal of TrustCor root certificate"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-23491",
    "datePublished": "2022-12-07T21:15:53.804Z",
    "dateReserved": "2022-01-19T21:23:53.763Z",
    "dateUpdated": "2024-08-03T03:43:46.116Z",
    "requesterUserId": "c184a3d9-dc98-4c48-a45b-d2d88cf0ac74",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

ghsa-43fp-rhv2-5gv8

Vulnerability from github

Published

2022-12-07 23:05

Modified

2024-09-13 17:46

Severity ?

6.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
5.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Summary

Certifi removing TrustCor root certificate

Details

Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store.

TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found here.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "certifi"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2017.11.05"
            },
            {
              "fixed": "2022.12.07"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-23491"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-345"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-07T23:05:18Z",
    "nvd_published_at": "2022-12-07T22:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Certifi 2022.12.07 removes root certificates from \"TrustCor\" from the root store. These are in the process of being removed from Mozilla\u0027s trust store.\n\nTrustCor\u0027s root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor\u0027s ownership also operated a business that produced spyware. Conclusions of Mozilla\u0027s investigation can be found [here](https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ).",
  "id": "GHSA-43fp-rhv2-5gv8",
  "modified": "2024-09-13T17:46:06Z",
  "published": "2022-12-07T23:05:18Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23491"
    },
    {
      "type": "WEB",
      "url": "https://github.com/certifi/python-certifi/commit/9e9e840925d7b8e76c76fdac1fab7e6e88c1c3b8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/certifi/python-certifi"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/certifi/PYSEC-2022-42986.yaml"
    },
    {
      "type": "WEB",
      "url": "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Certifi removing TrustCor root certificate"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

pysec-2022-42986

Vulnerability from pysec

cve-2022-23491

Vulnerability from cvelistv5

ghsa-43fp-rhv2-5gv8

Vulnerability from github

Tags

Sightings

Nomenclature