CVE-2023-37920 json
Certifi's removal of e-Tugra root certificate
published 2023-07-25 3 y ago modified 2026-09-10 1 mo ago also GHSA-xqr8-7jwr-rhp7 , PYSEC-2023-135 , EUVD-2023-0052
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 47%
- public exploits
- 0
- none known
Summary
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store.
Patch / fix
- pypi certifi 2023.7.22
- certifi certifi 2023.7.22
- python-certifi Debian 14, Debian 13 2023.7.22-1
debian advisories DEBIAN-CVE-2023-37920
- ca-certificates RHEL 8 2024.2.69_v8.0.303-80.0.el8_10
- ca-certificates RHEL 9 2024.2.69_v8.0.303-91.4.el9_4
- fence-agents RHEL 9 4.10.0-55.el9_3.2
- fence-virt RHEL 9 4.10.0-55.el9_3.2
- fence-virtd RHEL 9 4.10.0-55.el9_3.2
- fence-virtd-cpg RHEL 9 4.10.0-55.el9_3.2
- fence-virtd-tcp RHEL 9 4.10.0-55.el9_3.2
- fence-agents-all RHEL 9 4.10.0-55.el9_3.2
red hat advisories RHBA-2024:5736RHBA-2024:5691RHSA-2023:7753RHSA-2024:0133RHSA-2023:7523RHSA-2023:7385
- ca-certificates AlmaLinux 8 2024.2.69_v8.0.303-80.0.el8_10
- fence-agents-all AlmaLinux 8 4.2.1-121.el8_9.2
- fence-agents-apc AlmaLinux 8 4.2.1-121.el8_9.2
- fence-agents-aws AlmaLinux 8 4.2.1-121.el8_9.2
- fence-agents-eps AlmaLinux 8 4.2.1-121.el8_9.2
- fence-agents-gce AlmaLinux 8 4.2.1-121.el8_9.2
- fence-agents-rsa AlmaLinux 8 4.2.1-121.el8_9.2
- fence-agents-rsb AlmaLinux 8 4.2.1-121.el8_9.2
almalinux advisories ALBA-2024:5736ALSA-2024:0133ALSA-2023:7753
- py3-certifi Alpine 3.18 2023.7.22-r0
alpine advisories ALPINE-CVE-2023-37920
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- python-certifi Azure Linux 3.0 2023.05.07-1.cm2
azure linux advisories AZL-35126
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2023-37920 updated cvss 9.1
python-certifi: Removal of e-Tugra root certificate
-
Red Hat Ceph Storage 6 python-certifiaffected: no fix available
-
Red Hat Enterprise Linux 6 ca-certificates Red Hat Enterprise Linux 7 ca-certificates Red Hat OpenShift Container Platform 3.11 python-certifi, python2-certifiaffected: no fix planned “Out of support scope”
-
Red Hat Openshift Container Storage 4 python-certifiaffected: no fix available
-
Red Hat Enterprise Linux AppStream (v. 8) fence-agents 4.2.1-121.el8_9.2, fence-agents-all 4.2.1-121.el8_9.2, fence-agents-apc 4.2.1-121.el8_9.2, fence-agents-eps 4.2.1-121.el8_9.2, fence-agents-rsa 4.2.1-121.el8_9.2, fence-agents-rsb 4.2.1-121.el8_9.2, +37 morefixed: vendor fix RHSA-2024:0133
-
Red Hat Enterprise Linux AppStream (v. 9) fence-virt 4.10.0-55.el9_3.2, fence-virtd 4.10.0-55.el9_3.2, fence-agents 4.10.0-55.el9_3.2, fence-virtd-cpg 4.10.0-55.el9_3.2, fence-virtd-tcp 4.10.0-55.el9_3.2, fence-agents-virsh 4.10.0-55.el9_3.2, +8 morefixed: vendor fix RHSA-2023:7753
-
Red Hat Enterprise Linux AppStream AUS (v. 8.2) fence-agents 4.2.1-41.el8_2.12, fence-agents-all 4.2.1-41.el8_2.12, fence-agents-apc 4.2.1-41.el8_2.12, fence-agents-eps 4.2.1-41.el8_2.12, fence-agents-rsa 4.2.1-41.el8_2.12, fence-agents-rsb 4.2.1-41.el8_2.12, +32 morefixed: vendor fix RHSA-2023:7435
-
Red Hat Enterprise Linux AppStream AUS (v.8.4) fence-agents 4.2.1-65.el8_4.13, fence-agents-all 4.2.1-65.el8_4.13, fence-agents-apc 4.2.1-65.el8_4.13, fence-agents-eps 4.2.1-65.el8_4.13, fence-agents-rsa 4.2.1-65.el8_4.13, fence-agents-rsb 4.2.1-65.el8_4.13, +36 morefixed: vendor fix RHSA-2023:7523
-
Red Hat Enterprise Linux AppStream E4S (v. 8.1) fence-agents 4.2.1-30.el8_1.10, fence-agents-all 4.2.1-30.el8_1.10, fence-agents-apc 4.2.1-30.el8_1.10, fence-agents-eps 4.2.1-30.el8_1.10, fence-agents-rsa 4.2.1-30.el8_1.10, fence-agents-rsb 4.2.1-30.el8_1.10, +33 morefixed: vendor fix RHSA-2023:6812
show 29 moreshow fewer
-
Red Hat Enterprise Linux AppStream E4S (v. 8.2) fence-agents 4.2.1-41.el8_2.12, fence-agents-all 4.2.1-41.el8_2.12, fence-agents-apc 4.2.1-41.el8_2.12, fence-agents-eps 4.2.1-41.el8_2.12, fence-agents-rsa 4.2.1-41.el8_2.12, fence-agents-rsb 4.2.1-41.el8_2.12, +33 morefixed: vendor fix RHSA-2023:7435
-
Red Hat Enterprise Linux AppStream E4S (v.8.4) fence-agents 4.2.1-65.el8_4.13, fence-agents-all 4.2.1-65.el8_4.13, fence-agents-apc 4.2.1-65.el8_4.13, fence-agents-eps 4.2.1-65.el8_4.13, fence-agents-rsa 4.2.1-65.el8_4.13, fence-agents-rsb 4.2.1-65.el8_4.13, +37 morefixed: vendor fix RHSA-2023:7523
-
Red Hat Enterprise Linux AppStream EUS (v.8.6) fence-agents 4.2.1-89.el8_6.10, fence-agents-all 4.2.1-89.el8_6.10, fence-agents-apc 4.2.1-89.el8_6.10, fence-agents-eps 4.2.1-89.el8_6.10, fence-agents-rsa 4.2.1-89.el8_6.10, fence-agents-rsb 4.2.1-89.el8_6.10, +37 morefixed: vendor fix RHSA-2023:7407
-
Red Hat Enterprise Linux AppStream EUS (v.8.8) fence-agents 4.2.1-112.el8_8.2, fence-agents-all 4.2.1-112.el8_8.2, fence-agents-apc 4.2.1-112.el8_8.2, fence-agents-eps 4.2.1-112.el8_8.2, fence-agents-rsa 4.2.1-112.el8_8.2, fence-agents-rsb 4.2.1-112.el8_8.2, +37 morefixed: vendor fix RHSA-2023:7528
-
Red Hat Enterprise Linux AppStream EUS (v.9.0) fence-virt 4.10.0-20.el9_0.10, fence-virtd 4.10.0-20.el9_0.10, fence-agents 4.10.0-20.el9_0.10, fence-virtd-cpg 4.10.0-20.el9_0.10, fence-virtd-tcp 4.10.0-20.el9_0.10, fence-agents-virsh 4.10.0-20.el9_0.10, +9 morefixed: vendor fix RHSA-2023:7385
-
Red Hat Enterprise Linux AppStream EUS (v.9.2) fence-virt 4.10.0-43.el9_2.2, fence-virtd 4.10.0-43.el9_2.2, fence-agents 4.10.0-43.el9_2.2, fence-virtd-cpg 4.10.0-43.el9_2.2, fence-virtd-tcp 4.10.0-43.el9_2.2, fence-agents-virsh 4.10.0-43.el9_2.2, +8 morefixed: vendor fix RHSA-2023:7378
-
Red Hat Enterprise Linux AppStream TUS (v. 8.2) fence-agents 4.2.1-41.el8_2.12, fence-agents-all 4.2.1-41.el8_2.12, fence-agents-apc 4.2.1-41.el8_2.12, fence-agents-eps 4.2.1-41.el8_2.12, fence-agents-rsa 4.2.1-41.el8_2.12, fence-agents-rsb 4.2.1-41.el8_2.12, +32 morefixed: vendor fix RHSA-2023:7435
-
Red Hat Enterprise Linux AppStream TUS (v.8.4) fence-agents 4.2.1-65.el8_4.13, fence-agents-all 4.2.1-65.el8_4.13, fence-agents-apc 4.2.1-65.el8_4.13, fence-agents-eps 4.2.1-65.el8_4.13, fence-agents-rsa 4.2.1-65.el8_4.13, fence-agents-rsb 4.2.1-65.el8_4.13, +36 morefixed: vendor fix RHSA-2023:7523
-
Red Hat Enterprise Linux BaseOS (v. 8) ca-certificates 2024.2.69_v8.0.303-80.0.el8_10fixed: vendor fix RHBA-2024:5736
-
Red Hat Enterprise Linux BaseOS (v. 9) ca-certificates 2024.2.69_v8.0.303-91.4.el9_4fixed: vendor fix RHBA-2024:5691
-
Red Hat Enterprise Linux High Availability (v. 8) fence-agents-aws 4.2.1-121.el8_9.2, fence-agents-gce 4.2.1-121.el8_9.2, fence-agents-aliyun 4.2.1-121.el8_9.2, fence-agents-azure-arm 4.2.1-121.el8_9.2, fence-agents-openstack 4.2.1-121.el8_9.2fixed: vendor fix RHSA-2024:0133
-
Red Hat Enterprise Linux High Availability (v. 9) fence-agents-all 4.10.0-55.el9_3.2, fence-agents-apc 4.10.0-55.el9_3.2, fence-agents-aws 4.10.0-55.el9_3.2, fence-agents-eps 4.10.0-55.el9_3.2, fence-agents-gce 4.10.0-55.el9_3.2, fence-agents-rsa 4.10.0-55.el9_3.2, +36 morefixed: vendor fix RHSA-2023:7753
-
Red Hat Enterprise Linux High Availability AUS (v.8.4) fence-agents-aws 4.2.1-65.el8_4.13, fence-agents-gce 4.2.1-65.el8_4.13, fence-agents-aliyun 4.2.1-65.el8_4.13, fence-agents-azure-arm 4.2.1-65.el8_4.13fixed: vendor fix RHSA-2023:7523
-
Red Hat Enterprise Linux High Availability E4S (v. 8.1) fence-agents-aws 4.2.1-30.el8_1.10, fence-agents-gce 4.2.1-30.el8_1.10, fence-agents-aliyun 4.2.1-30.el8_1.10, fence-agents-azure-arm 4.2.1-30.el8_1.10fixed: vendor fix RHSA-2023:6812
-
Red Hat Enterprise Linux High Availability E4S (v. 8.2) fence-agents-aws 4.2.1-41.el8_2.12, fence-agents-gce 4.2.1-41.el8_2.12, fence-agents-aliyun 4.2.1-41.el8_2.12, fence-agents-azure-arm 4.2.1-41.el8_2.12fixed: vendor fix RHSA-2023:7435
-
Red Hat Enterprise Linux High Availability EUS (v.8.6) fence-agents-aws 4.2.1-89.el8_6.10, fence-agents-gce 4.2.1-89.el8_6.10, fence-agents-aliyun 4.2.1-89.el8_6.10, fence-agents-azure-arm 4.2.1-89.el8_6.10fixed: vendor fix RHSA-2023:7407
-
Red Hat Enterprise Linux High Availability EUS (v.8.8) fence-agents-aws 4.2.1-112.el8_8.2, fence-agents-gce 4.2.1-112.el8_8.2, fence-agents-aliyun 4.2.1-112.el8_8.2, fence-agents-azure-arm 4.2.1-112.el8_8.2, fence-agents-openstack 4.2.1-112.el8_8.2fixed: vendor fix RHSA-2023:7528
-
Red Hat Enterprise Linux High Availability EUS (v.9.0) fence-agents-all 4.10.0-20.el9_0.10, fence-agents-apc 4.10.0-20.el9_0.10, fence-agents-aws 4.10.0-20.el9_0.10, fence-agents-eps 4.10.0-20.el9_0.10, fence-agents-gce 4.10.0-20.el9_0.10, fence-agents-rsa 4.10.0-20.el9_0.10, +36 morefixed: vendor fix RHSA-2023:7385
-
Red Hat Enterprise Linux High Availability EUS (v.9.2) fence-agents-all 4.10.0-43.el9_2.2, fence-agents-apc 4.10.0-43.el9_2.2, fence-agents-aws 4.10.0-43.el9_2.2, fence-agents-eps 4.10.0-43.el9_2.2, fence-agents-gce 4.10.0-43.el9_2.2, fence-agents-rsa 4.10.0-43.el9_2.2, +36 morefixed: vendor fix RHSA-2023:7378
-
Red Hat Enterprise Linux High Availability TUS (v. 8.2) fence-agents-aws 4.2.1-41.el8_2.12, fence-agents-gce 4.2.1-41.el8_2.12, fence-agents-aliyun 4.2.1-41.el8_2.12, fence-agents-azure-arm 4.2.1-41.el8_2.12fixed: vendor fix RHSA-2023:7435
-
Red Hat Enterprise Linux HighAvailability E4S (v.8.4) fence-agents-aws 4.2.1-65.el8_4.13, fence-agents-gce 4.2.1-65.el8_4.13, fence-agents-aliyun 4.2.1-65.el8_4.13, fence-agents-azure-arm 4.2.1-65.el8_4.13 Red Hat Enterprise Linux HighAvailability TUS (v.8.4) fence-agents-aws 4.2.1-65.el8_4.13, fence-agents-gce 4.2.1-65.el8_4.13, fence-agents-aliyun 4.2.1-65.el8_4.13, fence-agents-azure-arm 4.2.1-65.el8_4.13fixed: vendor fix RHSA-2023:7523
-
Red Hat Enterprise Linux Resilient Storage (v. 8) fence-agents-aws 4.2.1-121.el8_9.2, fence-agents-gce 4.2.1-121.el8_9.2, fence-agents-aliyun 4.2.1-121.el8_9.2, fence-agents-azure-arm 4.2.1-121.el8_9.2, fence-agents-openstack 4.2.1-121.el8_9.2fixed: vendor fix RHSA-2024:0133
-
Red Hat Enterprise Linux Resilient Storage (v. 9) fence-agents-all 4.10.0-55.el9_3.2, fence-agents-apc 4.10.0-55.el9_3.2, fence-agents-aws 4.10.0-55.el9_3.2, fence-agents-eps 4.10.0-55.el9_3.2, fence-agents-gce 4.10.0-55.el9_3.2, fence-agents-rsa 4.10.0-55.el9_3.2, +36 morefixed: vendor fix RHSA-2023:7753
-
Red Hat Enterprise Linux Resilient Storage EUS (v.8.6) fence-agents-aws 4.2.1-89.el8_6.10, fence-agents-gce 4.2.1-89.el8_6.10, fence-agents-aliyun 4.2.1-89.el8_6.10, fence-agents-azure-arm 4.2.1-89.el8_6.10fixed: vendor fix RHSA-2023:7407
-
Red Hat Enterprise Linux Resilient Storage EUS (v.8.8) fence-agents-aws 4.2.1-112.el8_8.2, fence-agents-gce 4.2.1-112.el8_8.2, fence-agents-aliyun 4.2.1-112.el8_8.2, fence-agents-azure-arm 4.2.1-112.el8_8.2, fence-agents-openstack 4.2.1-112.el8_8.2fixed: vendor fix RHSA-2023:7528
-
Red Hat Enterprise Linux Resilient Storage EUS (v.9.0) fence-agents-all 4.10.0-20.el9_0.10, fence-agents-apc 4.10.0-20.el9_0.10, fence-agents-aws 4.10.0-20.el9_0.10, fence-agents-eps 4.10.0-20.el9_0.10, fence-agents-gce 4.10.0-20.el9_0.10, fence-agents-rsa 4.10.0-20.el9_0.10, +36 morefixed: vendor fix RHSA-2023:7385
-
Red Hat Enterprise Linux Resilient Storage EUS (v.9.2) fence-agents-all 4.10.0-43.el9_2.2, fence-agents-apc 4.10.0-43.el9_2.2, fence-agents-aws 4.10.0-43.el9_2.2, fence-agents-eps 4.10.0-43.el9_2.2, fence-agents-gce 4.10.0-43.el9_2.2, fence-agents-rsa 4.10.0-43.el9_2.2, +36 morefixed: vendor fix RHSA-2023:7378
-
Red Hat OpenShift AI 8 rhoai/odh-rhel8-operator v2.13.1-2, rhoai/odh-dashboard-rhel8 v2.13.1-1, rhoai/odh-modelmesh-rhel8 v2.13.1-1, rhoai/odh-operator-bundle v2.13.1-2, rhoai/odh-rhel8-operator v2.14.0-24, rhoai/odh-dashboard-rhel8 v2.14.0-11, +56 morefixed: vendor fix RHBA-2024:8413
-
Red Hat OpenShift Container Platform 4.17 openshift4/ose-ansible-rhel9-operator v4.17.0-202410112132.p0.g1d4d62e.assembly.stream.el9fixed: vendor fix RHSA-2024:8228
13 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-24-046-11 updated cvss 7.5
Siemens SCALANCE XCM-/XRM-300
-
Siemens SCALANCE XCH328 (6GK5328-4TS01-2EC2) <V2.4 Siemens SCALANCE XCM324 (6GK5324-8TS01-2AC2) <V2.4 Siemens SCALANCE XCM328 (6GK5328-4TS01-2AC2) <V2.4 Siemens SCALANCE XCM332 (6GK5332-0GA01-2AC2) <V2.4 Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) <V2.4 Siemens SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) <V2.4affected: fixed in V2.4 support.industry.siemens.com
+5 more productsfewer
Siemens SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) <V2.4
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 20 mo ago
Exploit prediction
0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | certifi | >=2015.4.28, <2023.7.22 |
2023.7.22 |
Affected products
- certifi python-certifi
Classification
- Weakness
-
- CWE-345 Insufficient Verification of Data Authenticity
References
-
github.com
/certifi/python-certifi/commit/8fb96ed81f71e7097ed11bc4d9b19afd7ea5c909
web, patch
-
github.com
/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp7
web, vendor-advisory, advisory
-
groups.google.com
/a/mozilla.org/g/dev-security-policy/c/C-HrP1SEq1A
web, mailing-list, third-party-advisory
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/5EX6NG7WUFNUKGFHLM35KHHU3GAKXRTG/
mailing-list
-
security.netapp.com
/advisory/ntap-20240912-0002/
third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-37920
advisory
-
github.com
/certifi/python-certifi
package
-
github.com
/pypa/advisory-database/tree/main/vulns/certifi/PYSEC-2023-135.yaml
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/5EX6NG7WUFNUKGFHLM35KHHU3GAKXRTG
web
-
security.netapp.com
/advisory/ntap-20240912-0002
web
Sources
- CVE List CVE-2023-37920
- GitHub Advisory GHSA-xqr8-7jwr-rhp7
- NVD CVE-2023-37920
- OSV PYSEC-2023-135
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.