Certifi's removal of e-Tugra root certificate
Priority MEDIUM 49CWE-345Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 36 fixed, 5 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-345.
Summary
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00568 47th percentileScored 2026-11-07
Fix Partial python-certifi (certifi): 2023.07.22certifi (PyPI): 2023.7.22Red Hat: 10 advisoriesRed Hat: 36 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| certifi | python-certifi | 2015.04.28 to before 2023.07.22 | 2023.07.22 | Patch available | CNA |
| — | certifi (PyPI) | 2015.4.28 to before 2023.7.22 | 2023.7.22 | Patch available | GHSA-xqr8-7jwr-rhp7 |
- python-certifi Vendorcertifi Affected 2015.04.28 to before 2023.07.22 Fixed in 2023.07.22 Patch available CNA
- certifi (PyPI) Vendor— Affected 2015.4.28 to before 2023.7.22 Fixed in 2023.7.22 Patch available GHSA-xqr8-7jwr-rhp7
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:certifi:certifi:*:*:*:*:*:python:*:* | 2015.4.28 to before 2023.7.22 | Vulnerable | certifi |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:management_services_for_netapp_hci:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:ontap_mediator:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:solidfire_\&_hci_storage_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:certifi:certifi:*:*:*:*:*:python:*:* Versions 2015.4.28 to before 2023.7.22 Vulnerable ·certifi
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:management_services_for_netapp_hci:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:ontap_mediator:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:solidfire_\&_hci_storage_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · CNA python-certifi (certifi) Fixed in 2023.07.22
- Fix · GHSA-xqr8-7jwr-rhp7 certifi (PyPI) Fixed in 2023.7.22 Advisory →
Red Hat 10 advisories
- RHSA-2024:8228 Released 2024-10-22 · Red Hat rating LowOpenShift Container Platform 4.17.2 security and extras update
- Red Hat OpenShift Container Platform 4.17 openshift4/ose-ansible-rhel9-operator
- RHSA-2024:0133 Released 2024-01-10 · Red Hat rating Moderatefence-agents security update
- Red Hat Enterprise Linux AppStream (v. 8) fence-agents-4.2.1-121.el8_9.2, fence-agents-all-4.2.1-121.el8_9.2, fence-agents-amt-ws-4.2.1-121.el8_9.2 +40
- Red Hat Enterprise Linux High Availability (v. 8) fence-agents-aliyun-4.2.1-121.el8_9.2, fence-agents-aws-4.2.1-121.el8_9.2, fence-agents-azure-arm-4.2.1-121.el8_9.2 +2
- Red Hat Enterprise Linux Resilient Storage (v. 8) fence-agents-aliyun-4.2.1-121.el8_9.2, fence-agents-aws-4.2.1-121.el8_9.2, fence-agents-azure-arm-4.2.1-121.el8_9.2 +2
- RHSA-2023:7753 Released 2023-12-12 · Red Hat rating Moderatefence-agents security update
- Red Hat Enterprise Linux AppStream (v. 9) fence-agents-4.10.0-55.el9_3.2, fence-agents-common-4.10.0-55.el9_3.2, fence-agents-compute-4.10.0-55.el9_3.2 +11
- Red Hat Enterprise Linux High Availability (v. 9) fence-agents-aliyun-4.10.0-55.el9_3.2, fence-agents-all-4.10.0-55.el9_3.2, fence-agents-amt-ws-4.10.0-55.el9_3.2 +39
- Red Hat Enterprise Linux Resilient Storage (v. 9) fence-agents-aliyun-4.10.0-55.el9_3.2, fence-agents-all-4.10.0-55.el9_3.2, fence-agents-amt-ws-4.10.0-55.el9_3.2 +39
Show 7 more Red Hat advisories
- RHSA-2023:7528 Released 2023-11-28 · Red Hat rating Moderatefence-agents security update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) fence-agents-4.2.1-112.el8_8.2, fence-agents-all-4.2.1-112.el8_8.2, fence-agents-amt-ws-4.2.1-112.el8_8.2 +40
- Red Hat Enterprise Linux High Availability EUS (v.8.8) fence-agents-aliyun-4.2.1-112.el8_8.2, fence-agents-aws-4.2.1-112.el8_8.2, fence-agents-azure-arm-4.2.1-112.el8_8.2 +2
- Red Hat Enterprise Linux Resilient Storage EUS (v.8.8) fence-agents-aliyun-4.2.1-112.el8_8.2, fence-agents-aws-4.2.1-112.el8_8.2, fence-agents-azure-arm-4.2.1-112.el8_8.2 +2
- RHSA-2023:7523 Released 2023-11-28 · Red Hat rating Moderatefence-agents security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) fence-agents-4.2.1-65.el8_4.13, fence-agents-all-4.2.1-65.el8_4.13, fence-agents-amt-ws-4.2.1-65.el8_4.13 +39
- Red Hat Enterprise Linux AppStream E4S (v.8.4) fence-agents-4.2.1-65.el8_4.13, fence-agents-all-4.2.1-65.el8_4.13, fence-agents-amt-ws-4.2.1-65.el8_4.13 +40
- Red Hat Enterprise Linux AppStream TUS (v.8.4) fence-agents-4.2.1-65.el8_4.13, fence-agents-all-4.2.1-65.el8_4.13, fence-agents-amt-ws-4.2.1-65.el8_4.13 +39
- Red Hat Enterprise Linux High Availability AUS (v.8.4) fence-agents-aliyun-4.2.1-65.el8_4.13, fence-agents-aws-4.2.1-65.el8_4.13, fence-agents-azure-arm-4.2.1-65.el8_4.13 +1
- Red Hat Enterprise Linux HighAvailability E4S (v.8.4) fence-agents-aliyun-4.2.1-65.el8_4.13, fence-agents-aws-4.2.1-65.el8_4.13, fence-agents-azure-arm-4.2.1-65.el8_4.13 +1
- Red Hat Enterprise Linux HighAvailability TUS (v.8.4) fence-agents-aliyun-4.2.1-65.el8_4.13, fence-agents-aws-4.2.1-65.el8_4.13, fence-agents-azure-arm-4.2.1-65.el8_4.13 +1
- RHSA-2023:7435 Released 2023-11-21 · Red Hat rating Moderatefence-agents security update
- Red Hat Enterprise Linux AppStream AUS (v. 8.2) fence-agents-4.2.1-41.el8_2.12, fence-agents-all-4.2.1-41.el8_2.12, fence-agents-amt-ws-4.2.1-41.el8_2.12 +35
- Red Hat Enterprise Linux AppStream E4S (v. 8.2) fence-agents-4.2.1-41.el8_2.12, fence-agents-all-4.2.1-41.el8_2.12, fence-agents-amt-ws-4.2.1-41.el8_2.12 +36
- Red Hat Enterprise Linux AppStream TUS (v. 8.2) fence-agents-4.2.1-41.el8_2.12, fence-agents-all-4.2.1-41.el8_2.12, fence-agents-amt-ws-4.2.1-41.el8_2.12 +35
- Red Hat Enterprise Linux High Availability E4S (v. 8.2) fence-agents-aliyun-4.2.1-41.el8_2.12, fence-agents-aws-4.2.1-41.el8_2.12, fence-agents-azure-arm-4.2.1-41.el8_2.12 +1
- Red Hat Enterprise Linux High Availability TUS (v. 8.2) fence-agents-aliyun-4.2.1-41.el8_2.12, fence-agents-aws-4.2.1-41.el8_2.12, fence-agents-azure-arm-4.2.1-41.el8_2.12 +1
- RHSA-2023:7407 Released 2023-11-21 · Red Hat rating Moderatefence-agents security update
- Red Hat Enterprise Linux AppStream EUS (v.8.6) fence-agents-4.2.1-89.el8_6.10, fence-agents-all-4.2.1-89.el8_6.10, fence-agents-amt-ws-4.2.1-89.el8_6.10 +40
- Red Hat Enterprise Linux High Availability EUS (v.8.6) fence-agents-aliyun-4.2.1-89.el8_6.10, fence-agents-aws-4.2.1-89.el8_6.10, fence-agents-azure-arm-4.2.1-89.el8_6.10 +1
- Red Hat Enterprise Linux Resilient Storage EUS (v.8.6) fence-agents-aliyun-4.2.1-89.el8_6.10, fence-agents-aws-4.2.1-89.el8_6.10, fence-agents-azure-arm-4.2.1-89.el8_6.10 +1
- RHSA-2023:7385 Released 2023-11-21 · Red Hat rating Moderatefence-agents security update
- Red Hat Enterprise Linux AppStream EUS (v.9.0) fence-agents-4.10.0-20.el9_0.10, fence-agents-common-4.10.0-20.el9_0.10, fence-agents-compute-4.10.0-20.el9_0.10 +12
- Red Hat Enterprise Linux High Availability EUS (v.9.0) fence-agents-aliyun-4.10.0-20.el9_0.10, fence-agents-all-4.10.0-20.el9_0.10, fence-agents-amt-ws-4.10.0-20.el9_0.10 +39
- Red Hat Enterprise Linux Resilient Storage EUS (v.9.0) fence-agents-aliyun-4.10.0-20.el9_0.10, fence-agents-all-4.10.0-20.el9_0.10, fence-agents-amt-ws-4.10.0-20.el9_0.10 +39
- RHSA-2023:7378 Released 2023-11-21 · Red Hat rating Moderatefence-agents security update
- Red Hat Enterprise Linux AppStream EUS (v.9.2) fence-agents-4.10.0-43.el9_2.2, fence-agents-common-4.10.0-43.el9_2.2, fence-agents-compute-4.10.0-43.el9_2.2 +11
- Red Hat Enterprise Linux High Availability EUS (v.9.2) fence-agents-aliyun-4.10.0-43.el9_2.2, fence-agents-all-4.10.0-43.el9_2.2, fence-agents-amt-ws-4.10.0-43.el9_2.2 +39
- Red Hat Enterprise Linux Resilient Storage EUS (v.9.2) fence-agents-aliyun-4.10.0-43.el9_2.2, fence-agents-all-4.10.0-43.el9_2.2, fence-agents-amt-ws-4.10.0-43.el9_2.2 +39
- RHSA-2023:6812 Released 2023-11-08 · Red Hat rating Moderatefence-agents bug fix, enhancement, and security update
- Red Hat Enterprise Linux AppStream E4S (v. 8.1) fence-agents-4.2.1-30.el8_1.10, fence-agents-all-4.2.1-30.el8_1.10, fence-agents-amt-ws-4.2.1-30.el8_1.10 +36
- Red Hat Enterprise Linux High Availability E4S (v. 8.1) fence-agents-aliyun-4.2.1-30.el8_1.10, fence-agents-aws-4.2.1-30.el8_1.10, fence-agents-azure-arm-4.2.1-30.el8_1.10 +1
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ceph Storage 6 | Affected | No fix yet |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat Openshift Container Storage 4 | Affected | No fix yet |
| RHOAI-2.13-RHEL-8 | Fixed | — |
| RHOAI-2.14-RHEL-8 | Fixed | — |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:0133 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:7753 |
| Red Hat Enterprise Linux AppStream AUS (v. 8.2) | Fixed | RHSA-2023:7435 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2023:7523 |
| Red Hat Enterprise Linux AppStream E4S (v. 8.1) | Fixed | RHSA-2023:6812 |
| Red Hat Enterprise Linux AppStream E4S (v. 8.2) | Fixed | RHSA-2023:7435 |
| Red Hat Enterprise Linux AppStream E4S (v.8.4) | Fixed | RHSA-2023:7523 |
| Red Hat Enterprise Linux AppStream EUS (v.8.6) | Fixed | RHSA-2023:7407 |
| Red Hat Enterprise Linux AppStream EUS (v.8.8) | Fixed | RHSA-2023:7528 |
| Red Hat Enterprise Linux AppStream EUS (v.9.0) | Fixed | RHSA-2023:7385 |
| Red Hat Enterprise Linux AppStream EUS (v.9.2) | Fixed | RHSA-2023:7378 |
| Red Hat Enterprise Linux AppStream TUS (v. 8.2) | Fixed | RHSA-2023:7435 |
| Red Hat Enterprise Linux AppStream TUS (v.8.4) | Fixed | RHSA-2023:7523 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | — |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | — |
| Red Hat Enterprise Linux High Availability (v. 8) | Fixed | RHSA-2024:0133 |
| Red Hat Enterprise Linux High Availability (v. 9) | Fixed | RHSA-2023:7753 |
| Red Hat Enterprise Linux High Availability AUS (v.8.4) | Fixed | RHSA-2023:7523 |
| Red Hat Enterprise Linux High Availability E4S (v. 8.1) | Fixed | RHSA-2023:6812 |
| Red Hat Enterprise Linux High Availability E4S (v. 8.2) | Fixed | RHSA-2023:7435 |
| Red Hat Enterprise Linux High Availability EUS (v.8.6) | Fixed | RHSA-2023:7407 |
| Red Hat Enterprise Linux High Availability EUS (v.8.8) | Fixed | RHSA-2023:7528 |
| Red Hat Enterprise Linux High Availability EUS (v.9.0) | Fixed | RHSA-2023:7385 |
| Red Hat Enterprise Linux High Availability EUS (v.9.2) | Fixed | RHSA-2023:7378 |
| Red Hat Enterprise Linux High Availability TUS (v. 8.2) | Fixed | RHSA-2023:7435 |
| Red Hat Enterprise Linux HighAvailability E4S (v.8.4) | Fixed | RHSA-2023:7523 |
| Red Hat Enterprise Linux HighAvailability TUS (v.8.4) | Fixed | RHSA-2023:7523 |
| Red Hat Enterprise Linux Resilient Storage (v. 8) | Fixed | RHSA-2024:0133 |
| Red Hat Enterprise Linux Resilient Storage (v. 9) | Fixed | RHSA-2023:7753 |
| Red Hat Enterprise Linux Resilient Storage EUS (v.8.6) | Fixed | RHSA-2023:7407 |
| Red Hat Enterprise Linux Resilient Storage EUS (v.8.8) | Fixed | RHSA-2023:7528 |
| Red Hat Enterprise Linux Resilient Storage EUS (v.9.0) | Fixed | RHSA-2023:7385 |
| Red Hat Enterprise Linux Resilient Storage EUS (v.9.2) | Fixed | RHSA-2023:7378 |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2024:8228 |
Not affected: 13 products
- Red Hat Ansible Automation Platform 2
- Red Hat Ceph Storage 4
- Red Hat Ceph Storage 5
- Red Hat Enterprise Linux 8
- Red Hat OpenShift Container Platform 4.17
- Red Hat OpenStack Platform 16.1
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.0
- Red Hat OpenStack Platform 17.1
- Red Hat OpenStack Platform 18.0
- Red Hat Openshift Data Foundation 4
- Red Hat Satellite 6
- Red Hat Update Infrastructure 4 for Cloud Providers
Timeline
- 2026-10-02 Threatist record created from CVE-2023-37920
- 2026-10-03 Alias added: GHSA-xqr8-7jwr-rhp7
- 2026-10-31 Fix available: RHOAI-2.13-RHEL-8, RHOAI-2.14-RHEL-8 · Red Hat
References
Advisory 4
Other 5
- https://lists.fedoraproject.org/archives/list/[email protected]/message/5EX6NG7WUFNUKGFHLM35KHHU3GAKXRTG/
- https://github.com/certifi/python-certifi
- https://github.com/pypa/advisory-database/tree/main/vulns/certifi/PYSEC-2023-135.yaml
- https://lists.fedoraproject.org/archives/list/[email protected]/message/5EX6NG7WUFNUKGFHLM35KHHU3GAKXRTG
- https://security.netapp.com/advisory/ntap-20240912-0002
More Certifi vulnerabilities
- TI-2024-26613 Certifi removes GLOBALTRUST root certificate CVSS 3.1HIGH 7.5
- TI-2022-07550 Removal of TrustCor root certificate CVSS 3.1HIGH 7.5
Sources
- CVE-2023-37920 · CVE Program
- CVE-2023-37920 · NVD
- FIRST EPSS
- GHSA-xqr8-7jwr-rhp7 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-37920 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences