GHSA-43fp-rhv2-5gv8
Certifi removing TrustCor root certificate
At a glance
- Published
- Updated
- CVE
- CVE-2022-23491
- Aliases
- PYSEC-2022-42986
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Description
Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found [here](https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ).
Affected packages
| Package | Versions |
|---|---|
| PyPI · certifi | introduced 2017.11.05, fixed 2022.12.07 |
References
- https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8 WEB
- https://nvd.nist.gov/vuln/detail/CVE-2022-23491 ADVISORY
- https://github.com/certifi/python-certifi/commit/9e9e840925d7b8e76c76fdac1fab7e6e88c1c3b8 WEB
- https://github.com/certifi/python-certifi PACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/certifi/PYSEC-2022-42986.yaml WEB
- https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ WEB
- https://security.netapp.com/advisory/ntap-20230223-0010 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |