CVE-2023-37920
High
Description
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Certifi
PublishedJul 25, 2023
First seenJul 25, 2023
Weakness typeCWE-345CWE-345
How to fix
Update
- certifi certifi2023.7.22 or later
- certifi2023.7.22 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| certifi certifi | 2015.4.28 ≤ v < 2023.7.22 | 2023.7.22 |
| fedoraproject fedora | 38 | — |
| netapp active_iq_unified_manager | No range specified | — |
| netapp management_services_for_element_software | No range specified | — |
| netapp management_services_for_netapp_hci | No range specified | — |
| netapp ontap_mediator | No range specified | — |
| netapp ontap_select_deploy_administration_utility | No range specified | — |
| netapp solidfire_\&_hci_storage_node | No range specified | — |
| certifiPyPI | 2015.4.28 ≤ v < 2023.7.22 | 2023.7.22 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.