GHSA-43fp-rhv2-5gv8

Certifi removing TrustCor root certificate

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-23491

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	certifi	>= 2017.11.05, < 2022.12.07	2022.12.07

Details

As written in the advisory (Markdown source, shown as plain text).

Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found [here](https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ).

References

External links from the advisory. They lead to third-party sites.

https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8 web
https://nvd.nist.gov/vuln/detail/CVE-2022-23491 advisory
https://github.com/certifi/python-certifi/commit/9e9e840925d7b8e76c76fdac1fab7e6e88c1c3b8 web
https://github.com/certifi/python-certifi package
https://github.com/pypa/advisory-database/tree/main/vulns/certifi/PYSEC-2022-42986.yaml web
https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ web
https://security.netapp.com/advisory/ntap-20230223-0010 web