CVE-2023-37920
HIGHcertifi >=2015.4.28 <2023.7.22 - Insufficient Verification of Data Authenticity
Title source: llmDescription
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store.
References (5)
Core 5
Core References
Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/5EX6NG7WUFNUKGFHLM35KHHU3GAKXRTG/
Third Party Advisory
https://security.netapp.com/advisory/ntap-20240912-0002/
Vendor Advisory x_refsource_confirm
https://github.com/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp7
Patch x_refsource_misc
https://github.com/certifi/python-certifi/commit/8fb96ed81f71e7097ed11bc4d9b19afd7ea5c909
Mailing List, Third Party Advisory x_refsource_misc
https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/C-HrP1SEq1A
Scores
CVSS v3
7.5
EPSS
0.0047
EPSS Percentile
37.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-345
Status
published
Products (9)
certifi/certifi
2015.4.28 - 2023.7.22
fedoraproject/fedora
38
netapp/active_iq_unified_manager
(2 CPE variants)
netapp/management_services_for_element_software
netapp/management_services_for_netapp_hci
netapp/ontap_mediator
netapp/ontap_select_deploy_administration_utility
netapp/solidfire_\&_hci_storage_node
pypi/certifi
2015.4.28 - 2023.7.22PyPI
Published
Jul 25, 2023
Tracked Since
Feb 18, 2026