Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS14cXI4LTdqd3ItcmhwN84AA04J

Removal of e-Tugra root certificate

Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store. These are in the process of being removed from Mozilla's trust store.

e-Tugra's root certificates are being removed pursuant to an investigation prompted by reporting of security issues in their systems. Conclusions of Mozilla's investigation can be found here.

Permalink: https://github.com/advisories/GHSA-xqr8-7jwr-rhp7
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14cXI4LTdqd3ItcmhwN84AA04J
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 1 year ago
Updated: about 1 year ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Identifiers: GHSA-xqr8-7jwr-rhp7, CVE-2023-37920
References:

• https://github.com/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp7
• https://github.com/certifi/python-certifi/commit/8fb96ed81f71e7097ed11bc4d9b19afd7ea5c909
• https://nvd.nist.gov/vuln/detail/CVE-2023-37920
• https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/C-HrP1SEq1A
• https://github.com/pypa/advisory-database/tree/main/vulns/certifi/PYSEC-2023-135.yaml
• https://lists.fedoraproject.org/archives/list/[email protected]/message/5EX6NG7WUFNUKGFHLM35KHHU3GAKXRTG/
• https://github.com/advisories/GHSA-xqr8-7jwr-rhp7

Repository: https://github.com/certifi/python-certifi
Blast Radius: 42.1

Affected Packages