Security Bulletin: IBM Cinder plug-in is affected by a vulnerability in the Python certifi-2022.12.7 package [CVE-2023-37920]

Summary

The Python certifi package, which is collection of root certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts, is used by IBM Cinder plug-in. certifi package is impacted by vulnerability CVE-2023-37920.

Vulnerability Details

CVEID:CVE-2023-37920
**DESCRIPTION:**An unspecified error with the removal of e-Tugra root certificate in Certifi has an unknown impact and attack vector.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/261639 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Affected Products and Versions

Remediation/Fixes

Update Python to version >= 3.6
Update certifi library to version >= 2023.7.22

Please note:
The plugin will still work on Python < 3.6, but it is necessary to update to fix this vulnerability, as the fixed version of certifi library is not supported on Python < 3.6
IBM Cinder SVf driver has been tested using non-vulnerable version of certifi library

Workarounds and Mitigations

None