What’s Vulnerable › Vulnerabilities

CVE-2023-37920: Certifi's removal of e-Tugra root certificate

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-07-25 · updated 2026-06-17
• Weakness: CWE-345

Description

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store.

Affected products

• Certifi: from 2015.4.28 before 2023.7.22 — fixed in 2023.7.22
• Fedoraproject Fedora: 38
• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
• NetApp Management Services For Element Software: all versions
• NetApp Management Services For Netapp Hci: all versions
• NetApp ONTAP Mediator: all versions
• NetApp ONTAP Select Deploy administration utility: all versions
• NetApp Solidfire & Hci Storage Node: all versions
• Pypi Certifi: from 2015.4.28 before 2023.7.22; 2015.04.28, 2015.11.20, 2015.11.20.1, 2015.9.6, 2015.9.6.1, 2015.9.6.2 (+37) — fixed in 2023.7.22

How to fix

Upgrade to a fixed version: Certifi 2023.7.22; Pypi Certifi 2023.7.22. Check the vendor advisory for mitigations.

References

• https://github.com/certifi/python-certifi/commit/8fb96ed81f71e7097ed11bc4d9b19afd7ea5c909
• https://github.com/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp7
• https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/C-HrP1SEq1A
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EX6NG7WUFNUKGFHLM35KHHU3GAKXRTG/
• https://github.com/certifi/python-certifi/commit/8fb96ed81f71e7097ed11bc4d9b19afd7ea5c909
• https://github.com/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp7
• https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/C-HrP1SEq1A
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EX6NG7WUFNUKGFHLM35KHHU3GAKXRTG/
• https://security.netapp.com/advisory/ntap-20240912-0002/

Get alerted when CVE-2023-37920 or the next vulnerability affects your stack