CVE-2023-37920 Certifi's removal of e-Tugra root certificate

2023-07-2520:45:35

CWE-345

GitHub_M

www.cve.org

certifi

e-tugra

root certificate

ssl

tls

security issues

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

9.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.9%

JSON

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes “e-Tugra” root certificates. e-Tugra’s root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from “e-Tugra” from the root store.

CNA Affected

[
  {
    "vendor": "certifi",
    "product": "python-certifi",
    "versions": [
      {
        "version": ">= 2015.04.28, < 2023.07.22",
        "status": "affected"
      }
    ]
  }
]