Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.
References
| Link | Resource |
|---|---|
| https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8 | Third Party Advisory |
| https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ | Mailing List Third Party Advisory |
Configurations
History
23 Dec 2022, 17:00
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:certifi_project:certifi:*:*:*:*:*:*:*:* |
13 Dec 2022, 16:13
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:certifi_project:certifi:2022.12.07:*:*:*:*:*:*:* | |
| First Time |
Certifi Project certifi
Certifi Project |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| References | (MISC) https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ - Mailing List, Third Party Advisory | |
| References | (MISC) https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8 - Third Party Advisory |
08 Dec 2022, 00:08
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-12-07 22:15
Updated : 2023-12-10 14:48
NVD link : CVE-2022-23491
Mitre link : CVE-2022-23491
CVE.ORG link : CVE-2022-23491
JSON object : View
Products Affected
certifi_project
- certifi
CWE
CWE-345
Insufficient Verification of Data Authenticity