GitHub Advisoryadvisory · PyPI
GHSA-43fp-rhv2-5gv8 Certifi removing TrustCor root certificate
MEDIUM
Official page ↗
- Aliases
- CVE-2022-23491
- Ecosystem
- PyPI
- Packages
- certifi
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
- Weaknesses
- CWE-345
- Reviewed
- 2022-12-07
Affected packages
• PyPI certifi: >= 2017.11.05, < 2022.12.07 → fixed in 2022.12.07
Description
Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store.
TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found here.
Related
Alias · CVE (1)
- CVE-2022-23491 Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of… vulnerability
Weakness · CWE (1)
- CWE-345 Insufficient Verification of Data Authenticity weakness
References
- https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8 web
- https://nvd.nist.gov/vuln/detail/CVE-2022-23491 advisory
- https://github.com/certifi/python-certifi/commit/9e9e840925d7b8e76c76fdac1fab7e6e88c1c3b8 web
- https://github.com/certifi/python-certifi package
- https://github.com/pypa/advisory-database/tree/main/vulns/certifi/PYSEC-2022-42986.yaml web
- https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ web
- https://security.netapp.com/advisory/ntap-20230223-0010 web