GHSA-43fp-rhv2-5gv8 CVE-2022-23491 PYSEC-2022-42986
Certifi removing TrustCor root certificate
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.53%
- Chance of exploitation in the next 30 days. Higher than 44.84% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-345 Insufficient Verification of Data Authenticity
- Fix
2022.12.07- Upgrade certifi to this version or later
Description
Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store.
TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found here.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| certifi | >= 2017.11.05, < 2022.12.07 |
2022.12.07 |
| certifi | >= 2017.11.5, < 2022.12.7 |
2022.12.7 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
certifi PyPI → 2022.12.07
- pip
pip install --upgrade "certifi>=2022.12.07"- poetry
poetry add "certifi>=2022.12.07"- uv
uv add "certifi>=2022.12.07"
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- High
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 6.8
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- High
- User interaction
- None
- Scope
- Changed
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Weakness
CWE-345: Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
References
Advisories
Packages
Other links
- github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8
- github.com/certifi/python-certifi/commit/9e9e840925d7b8e76c76fdac1fab7e6e88c1c3b8
- github.com/pypa/advisory-database/tree/main/vulns/certifi/PYSEC-2022-42986.yaml
- groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ
- security.netapp.com/advisory/ntap-20230223-0010
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-6q48-6c7w-9gw2 certifi bundles emSign root CAs with compromised intermediate CA keys | Critical | Also affects certifi |
| GHSA-248v-346w-9cwc Certifi removes GLOBALTRUST root certificate | High | Also affects certifi |
| GHSA-xqr8-7jwr-rhp7 Removal of e-Tugra root certificate | Critical | Also affects certifi |
| GHSA-rfpc-qcw5-3pc4 filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker | Medium | Same weakness, CWE-345 |
| GHSA-7hp6-4w63-5g45 LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key | Critical | Same weakness, CWE-345 |
| GHSA-p92p-rxj5-7p2x vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine | High | Same weakness, CWE-345 |
| GHSA-r4xp-prcw-77qf better-auth: OAuth Proxy lets an attacker sign in as another user | Critical | Same weakness, CWE-345 |
| GHSA-xv7q-fvmc-jx96 Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover | High | Same weakness, CWE-345 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor