CVE-2023-37920: certifi
Vulnerability summary
CVE-2023-37920 is a critical (CVSS 9.8) vulnerability in certifi. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 45.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 9 · Related 3Timeline
- 25-07-2023PublishedVulnerability first disclosed.
- 05-03-2025Last modifiedVulnerability information updated.
Description
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store.
CVSS metrics
9 scores · 9 sources · 1 version- CVE.orgCNA7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NDiffers
- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · PypiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NDiffers
- OSV · Red hatEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NDiffers
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NDiffers
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NDiffers
EPSS trend
Probability
0.57%
Chance of exploitation in the next 30 days
Percentile
46%
Versus all other CVEs
30-day change
0.00 pp
From 0.57% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Netapp6 products
- active_iq_unified_managerna
- management_services_for_element_softwarena
- management_services_for_netapp_hcina
- ontap_mediatorna
- ontap_select_deploy_administration_utilityna
Chainguard3 products
- conda< 23.7.2-r1
- graalvm-24-graalpy-venvAll versions (No fix recorded)
- kube-downscaler< 23.2.0-r3
Certifi2 products
- certifi≥ 2015.4.28, < 2023.7.22
- python-certifi≥ 2015.04.28, < 2023.07.22
Ubuntu2 products
- python-certifiAll versions (No fix recorded)
- python-pipAll versions (No fix recorded)
Wolfi2 products
- conda< 23.7.2-r1
- kube-downscaler< 23.2.0-r3
Alpine1 product
- py3-certifi≥ 2015.4.28, < 2023.7.22-r0
Debian1 product
- python-certifiAll versions (No fix recorded) | < 2023.7.22-1
Fedoraproject1 product
- fedoraEOL38
PyPI1 product
- certifi≥ 2015.4.28, < 2023.7.22
Redhat1 product
- ca-certificates< 0:2024.2.69_v8.0.303-91.4.el9_4 | < 0:2024.2.69_v8.0.303-80.0.el8_10
10 vendors · 20 products
References
21 links- github.com/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp7X Refsource CONFIRMWEBAdvisoryREPORTVendor Advisory
- github.com/certifi/python-certifi/commit/8fb96ed81f71e7097ed11bc4d9b19afd7ea5c909X Refsource MISCWEBFIXPatch
- groups.google.com/a/mozilla.org/g/dev-security-policy/c/C-HrP1SEq1AX Refsource MISCWEBREPORTMailing ListThird Party Advisory
