CVE-2022-23491: Removal of TrustCor root certificate
Vulnerability summary
CVE-2022-23491 is a high (CVSS 7.5) vulnerability in certifi. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 44.8% of scored vulnerabilities.
Not severe (CVSS 6.8, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 5 · Related 6Timeline
- 07-12-2022PublishedVulnerability first disclosed.
- 23-04-2025Last modifiedVulnerability information updated.
Description
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.
CVSS metrics
7 scores · 6 sources · 2 versions- CVE.orgCNA6.8MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:NDiffers
- OSV · PypiEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:NDiffers
- OSV · Red hatEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:NDiffers
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
0.53%
Chance of exploitation in the next 30 days
Percentile
45%
Versus all other CVEs
30-day change
Increase +0.02 pp
From 0.51% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Suse21 products
- python-certifi&distro=SUSE Enterprise Storage 6< 2018.1.18-150000.3.3.1
- python-certifi&distro=SUSE Enterprise Storage 7< 2018.1.18-150000.3.3.1
- python-certifi&distro=SUSE Enterprise Storage 7.1< 2018.1.18-150000.3.3.1
- python-certifi&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 2018.1.18-150000.3.3.1
- python-certifi&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 2018.1.18-150000.3.3.1
Opensuse4 products
- python-certifi&distro=openSUSE Leap 15.4< 2018.1.18-150000.3.3.1
- python-certifi&distro=openSUSE Leap Micro 5.2< 2018.1.18-150000.3.3.1
- python-certifi&distro=openSUSE Leap Micro 5.3< 2018.1.18-150000.3.3.1
- python-certifi&distro=openSUSE Tumbleweed< 2023.7.22-2.1
Netapp3 products
Certifi2 products
- certifi≥ 2017.11.5, < 2022.12.7
- python-certifi< 2022.12.07
Debian1 product
- python-certifiAll versions (No fix recorded) | < 2023.7.22-1
Mageia1 product
- python-certifi< 2022.12.7-1.mga8
PyPI1 product
- certifi≥ 2017.11.05, < 2022.12.07 | ≥ 2017.11.5, < 2022.12.7
Redhat1 product
- python39-certifi< 0:2022.12.7-1.el8ap
Ubuntu1 product
- ca-certificates< 20211016~14.04.1~esm1 | < 20211016~16.04.1~esm2 | < 20211016ubuntu0.18.04.1 | < 20211016ubuntu0.20.04.1 | < 20211016ubuntu0.22.04.1
9 vendors · 35 products
References
26 links- github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8X Refsource CONFIRMAdvisoryWEBARTICLEREPORTThird Party Advisory
- groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJX Refsource MISCWEBREPORTMailing ListThird Party Advisory
- security.netapp.com/advisory/ntap-20230223-0010/Third Party Advisory
