Removal of TrustCor root certificate
Priority LOW 33CWE-345Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 2 fixed, 6 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-345.
Summary
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0053 45th percentileScored 2026-11-07
Fix Partial python-certifi (certifi): 2022.12.07certifi (PyPI): 2022.12.07Red Hat: 2 advisoriesRed Hat: 2 fixed, 6 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| certifi | python-certifi | before 2022.12.07 | 2022.12.07 | Patch available | CNA |
| — | certifi (PyPI) | 2017.11.05 to before 2022.12.07 | 2022.12.07 | Patch available | GHSA-43fp-rhv2-5gv8 |
- python-certifi Vendorcertifi Affected before 2022.12.07 Fixed in 2022.12.07 Patch available CNA
- certifi (PyPI) Vendor— Affected 2017.11.05 to before 2022.12.07 Fixed in 2022.12.07 Patch available GHSA-43fp-rhv2-5gv8
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:certifi:certifi:*:*:*:*:*:python:*:* | 2017.11.5 to before 2022.12.7 | Vulnerable | certifi |
| cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:management_services_for_netapp_hci:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:certifi:certifi:*:*:*:*:*:python:*:* Versions 2017.11.5 to before 2022.12.7 Vulnerable ·certifi
- cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:management_services_for_netapp_hci:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · CNA python-certifi (certifi) Fixed in 2022.12.07
- Fix · GHSA-43fp-rhv2-5gv8 certifi (PyPI) Fixed in 2022.12.07 Advisory →
Red Hat 2 advisories
- RHSA-2025:9776 Released 2025-06-26 · Red Hat rating ImportantNew RHCS 8.1 container image is now available in the Red Hat Ecosystem Catalog.
- Red Hat Ceph Storage 8.1 Tools rhceph/grafana-rhel9, rhceph/keepalived-rhel9, rhceph/oauth2-proxy-rhel9 +4
- RHSA-2025:9775 Released 2025-06-26 · Red Hat rating ImportantRed Hat Ceph Storage 8.1 security, bug fix, and enhancement updates
- Red Hat Ceph Storage 8.1 Tools ceph-2:19.2.1-222.el9cp, ceph-base-2:19.2.1-222.el9cp, ceph-common-2:19.2.1-222.el9cp +28
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Ceph Storage 5 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Out of support scope |
| Red Hat Openshift Container Storage 4 | Affected | No fix planned: Out of support scope |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2.3 for RHEL 8 | Fixed | — |
| Red Hat Ceph Storage 8.1 Tools | Fixed | RHSA-2025:9775, RHSA-2025:9776 |
Not affected: 8 products
- Red Hat Ansible Automation Platform 2.3 for RHEL 8
- Red Hat Ansible Automation Platform 2.3 for RHEL 9
- Red Hat Ceph Storage 4
- Red Hat OpenStack Platform 16.1
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.0
- Red Hat Openshift Data Foundation 4
- Red Hat Update Infrastructure 4 for Cloud Providers
Timeline
- 2026-10-02 Threatist record created from CVE-2022-23491
- 2026-10-03 Alias added: GHSA-43fp-rhv2-5gv8
References
Advisory 4
More Certifi vulnerabilities
- TI-2023-19353 Certifi's removal of e-Tugra root certificate CVSS 3.1CRITICAL 9.8
- TI-2024-26613 Certifi removes GLOBALTRUST root certificate CVSS 3.1HIGH 7.5
Sources
- CVE-2022-23491 · CVE Program
- CVE-2022-23491 · NVD
- FIRST EPSS
- GHSA-43fp-rhv2-5gv8 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-23491 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences