Improper Following of a Certificate's Chain of Trust Affecting certifi package, versions [2015.04.28,2023.7.22)
Threat Intelligence
EPSS
0.15% (52nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-CERTIFI-5805047
- published 25 Jul 2023
- disclosed 25 Jul 2023
- credit Ben Wilson
Introduced: 25 Jul 2023
CVE-2023-37920 Open this link in a new tabHow to fix?
Upgrade certifi to version 2023.7.22 or higher.
Overview
Affected versions of this package are vulnerable to Improper Following of a Certificate's Chain of Trust. E-Tugra's root certificates are being removed pursuant to an investigation prompted by reporting of security issues in their systems. Conclusions of Mozilla's investigation can be found here.
Note:
This issue is not an inherent vulnerability in the package, but a security measure against potential harmful effects of trusting the now-revoked root certificates.
References
CVSS Scores
version 3.1