High severity · published Dec 7, 2022
CVE-2022-23491
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
Certifi · Certifi
2017.11.5 before 2022.12.7 · source: NVD
EP
E-series Performance Analyzer · Netapp
All versions, or not specified · source: NVD
MS
Management Services For Element Software · Netapp
All versions, or not specified · source: NVD
MS
Management Services For Netapp Hci · Netapp
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-23491
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-23491
Third Party Advisory
https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8
Mailing List
https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ
Third Party Advisory
https://security.netapp.com/advisory/ntap-20230223-0010/
More from Certifi
9.8
CVE-2023-37920
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts
7.5
CVE-2024-39689
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts
