What’s Vulnerable › Vulnerabilities

CVE-2022-23491: Removal of TrustCor root certificate

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-12-07 · updated 2026-06-17
• Weakness: CWE-345

Description

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.

Affected products

• Certifi: from 2017.11.5 before 2022.12.7 — fixed in 2022.12.7
• NetApp E-Series Performance Analyzer: all versions
• NetApp Management Services For Element Software: all versions
• NetApp Management Services For Netapp Hci: all versions
• Pypi Certifi: from 2017.11.05 before 2022.12.07; 2017.11.5, 2018.1.18, 2018.10.15, 2018.11.29, 2018.4.16, 2018.8.13 (+20) — fixed in 2022.12.07

How to fix

Upgrade to a fixed version: Certifi 2022.12.7; Pypi Certifi 2022.12.07. Check the vendor advisory for mitigations.

References

• https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8
• https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ
• https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8
• https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ
• https://security.netapp.com/advisory/ntap-20230223-0010/

Get alerted when CVE-2022-23491 or the next vulnerability affects your stack