{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for ca-certificates is now available for Red Hat Enterprise Linux 9.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The ca-certificates package contains a set of Certificate Authority (CA) certificates chosen by the Mozilla Foundation for use with the Internet Public Key Infrastructure (PKI).\n\nBug Fix(es) and Enhancement(s):\n\n* Annual 2024 ca-certificates update version 2.69 from NSS 3.101.1 for Firefox 128 [rhel-9.4.z] (JIRA:RHEL-44988)\n\n* Provide ca-certificates in directory format to resolve Application performance regression in OpenSSL [rhel-9.4.z] (JIRA:RHEL-48129)\n\n* calling update-ca-trust on RHEL-9 should be supported with just about any argument [rhel-9.4.z] (JIRA:RHEL-54698)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHBA-2024:5691",
        "url": "https://access.redhat.com/errata/RHBA-2024:5691"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhba-2024_5691.json"
      }
    ],
    "title": "Red Hat Bug Fix Advisory: ca-certificates bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2024-11-05T16:05:23+00:00",
      "generator": {
        "date": "2024-11-05T16:05:23+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.1.1"
        }
      },
      "id": "RHBA-2024:5691",
      "initial_release_date": "2024-08-21T12:01:36+00:00",
      "revision_history": [
        {
          "date": "2024-08-21T12:01:36+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-08-21T12:01:36+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-05T16:05:23+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS (v. 9)",
                  "product_id": "BaseOS-9.4.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:9::baseos"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ca-certificates-0:2024.2.69_v8.0.303-91.4.el9_4.src",
                "product": {
                  "name": "ca-certificates-0:2024.2.69_v8.0.303-91.4.el9_4.src",
                  "product_id": "ca-certificates-0:2024.2.69_v8.0.303-91.4.el9_4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ca-certificates@2024.2.69_v8.0.303-91.4.el9_4?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ca-certificates-0:2024.2.69_v8.0.303-91.4.el9_4.noarch",
                "product": {
                  "name": "ca-certificates-0:2024.2.69_v8.0.303-91.4.el9_4.noarch",
                  "product_id": "ca-certificates-0:2024.2.69_v8.0.303-91.4.el9_4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ca-certificates@2024.2.69_v8.0.303-91.4.el9_4?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ca-certificates-0:2024.2.69_v8.0.303-91.4.el9_4.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.4.0.Z.MAIN.EUS:ca-certificates-0:2024.2.69_v8.0.303-91.4.el9_4.noarch"
        },
        "product_reference": "ca-certificates-0:2024.2.69_v8.0.303-91.4.el9_4.noarch",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ca-certificates-0:2024.2.69_v8.0.303-91.4.el9_4.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.4.0.Z.MAIN.EUS:ca-certificates-0:2024.2.69_v8.0.303-91.4.el9_4.src"
        },
        "product_reference": "ca-certificates-0:2024.2.69_v8.0.303-91.4.el9_4.src",
        "relates_to_product_reference": "BaseOS-9.4.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-37920",
      "cwe": {
        "id": "CWE-345",
        "name": "Insufficient Verification of Data Authenticity"
      },
      "discovery_date": "2023-07-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2226586"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the python-certifi package. This issue occurs when the e-Tugra root certificate in Certifi is removed, resulting in an unspecified error that has an unknown impact and attack vector.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python-certifi: Removal of e-Tugra root certificate",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "While eTurgra certificates being marked as untrusted by Mozilla is significant from a trust and security standpoint, this is still considered a low severity issue. The certificates were removed from Mozilla\u0027s root store in July 2023, indicating a proactive response to security concerns. Additionally, Red Hat does not run its own root store program, but depends on Mozilla for ssl certificates and Microsoft for signing certificates. \nThese certs are included and marked as don\u0027t trust and will not be removed until Mozilla removes them. Browsers are most at risk, which already understand and parse \u0027don\u0027t trust after\u0027. If python-fi is required not to trust these certs, they should parse the \u0027don\u0027t trust after\u0027 attribute.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-9.4.0.Z.MAIN.EUS:ca-certificates-0:2024.2.69_v8.0.303-91.4.el9_4.noarch",
          "BaseOS-9.4.0.Z.MAIN.EUS:ca-certificates-0:2024.2.69_v8.0.303-91.4.el9_4.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-37920"
        },
        {
          "category": "external",
          "summary": "RHBZ#2226586",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2226586"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-37920",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-37920"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-37920",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37920"
        }
      ],
      "release_date": "2023-07-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-08-21T12:01:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-9.4.0.Z.MAIN.EUS:ca-certificates-0:2024.2.69_v8.0.303-91.4.el9_4.noarch",
            "BaseOS-9.4.0.Z.MAIN.EUS:ca-certificates-0:2024.2.69_v8.0.303-91.4.el9_4.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2024:5691"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "BaseOS-9.4.0.Z.MAIN.EUS:ca-certificates-0:2024.2.69_v8.0.303-91.4.el9_4.noarch",
            "BaseOS-9.4.0.Z.MAIN.EUS:ca-certificates-0:2024.2.69_v8.0.303-91.4.el9_4.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "python-certifi: Removal of e-Tugra root certificate"
    }
  ]
}