CVE-2023-37920

Published: 25 July 2023

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store.

Notes

Priority reason:
python-certifi in Debian and Ubuntu is patched to use the system CA certificates

the python-pip package bundles python-certifi binaries
when built. After updating python-certifi, a no-change
rebuild of python-pip is required.

python-certifi in Debian and Ubuntu is patched to use the
system CA certificates

While the cacert.pem file is shipped in binary packages, it is
not used in any way, the actual application is patched to
use the system ca-certificates. There is a Debian bug filed to
remove the cert store here:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=947287

I'm marking this 'ignored', we don't wish to give the impression
that this certificate bundle is supported.

Status

Severity score breakdown

References

• https://github.com/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp7
• https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/C-HrP1SEq1A
• https://www.cve.org/CVERecord?id=CVE-2023-37920
• NVD
• Launchpad
• Debian