GHSA-xqr8-7jwr-rhp7 CVE-2023-37920 PYSEC-2023-135
Removal of e-Tugra root certificate
- Severity
- 7.5 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 0.57%
- Chance of exploitation in the next 30 days. Higher than 47.08% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-345 Insufficient Verification of Data Authenticity
- Fix
2023.7.22- Upgrade certifi to this version or later
Description
Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store. These are in the process of being removed from Mozilla's trust store.
e-Tugra's root certificates are being removed pursuant to an investigation prompted by reporting of security issues in their systems. Conclusions of Mozilla's investigation can be found here.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| certifi | >= 2015.4.28, < 2023.7.22 |
2023.7.22 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
certifi PyPI → 2023.7.22
- pip
pip install --upgrade "certifi>=2023.7.22"- poetry
poetry add "certifi>=2023.7.22"- uv
uv add "certifi>=2023.7.22"
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Weakness
CWE-345: Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
References
Advisories
Packages
Other links
- github.com/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp7
- github.com/certifi/python-certifi/commit/8fb96ed81f71e7097ed11bc4d9b19afd7ea5c909
- github.com/pypa/advisory-database/tree/main/vulns/certifi/PYSEC-2023-135.yaml
- groups.google.com/a/mozilla.org/g/dev-security-policy/c/C-HrP1SEq1A
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EX6N…
- security.netapp.com/advisory/ntap-20240912-0002
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EX6N…
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-6q48-6c7w-9gw2 certifi bundles emSign root CAs with compromised intermediate CA keys | Critical | Also affects certifi |
| GHSA-248v-346w-9cwc Certifi removes GLOBALTRUST root certificate | High | Also affects certifi |
| GHSA-43fp-rhv2-5gv8 Certifi removing TrustCor root certificate | High | Also affects certifi |
| GHSA-rfpc-qcw5-3pc4 filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker | Medium | Same weakness, CWE-345 |
| GHSA-7hp6-4w63-5g45 LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key | Critical | Same weakness, CWE-345 |
| GHSA-p92p-rxj5-7p2x vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine | High | Same weakness, CWE-345 |
| GHSA-r4xp-prcw-77qf better-auth: OAuth Proxy lets an attacker sign in as another user | Critical | Same weakness, CWE-345 |
| GHSA-xv7q-fvmc-jx96 Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover | High | Same weakness, CWE-345 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor