Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS00M2ZwLXJodjItNWd2OM4AAwM2

Certifi removing TrustCor root certificate

Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store.

TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found here.

Permalink: https://github.com/advisories/GHSA-43fp-rhv2-5gv8
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00M2ZwLXJodjItNWd2OM4AAwM2
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: 3 months ago

CVSS Score: 6.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

EPSS Percentage: 0.00057
EPSS Percentile: 0.24522

Identifiers: GHSA-43fp-rhv2-5gv8, CVE-2022-23491
References:

• https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8
• https://github.com/certifi/python-certifi/commit/9e9e840925d7b8e76c76fdac1fab7e6e88c1c3b8
• https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ
• https://nvd.nist.gov/vuln/detail/CVE-2022-23491
• https://github.com/pypa/advisory-database/tree/main/vulns/certifi/PYSEC-2022-42986.yaml
• https://github.com/advisories/GHSA-43fp-rhv2-5gv8

Repository: https://github.com/certifi/python-certifi
Blast Radius: 38.2

Affected Packages