p PatchFirst

CVE-2022-23491

CVE-2022-23491 · Removal of TrustCor root certificate

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.

CVSS 6.8 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • python-certifi

    Versions
    • < 2022.12.07: Affected

    No fix published

  • python-certifi Debian:12

    Versions
    • 2022.9.24-1
    • 2023.11.17-1
    • 2023.7.22-1
    • 2024.12.14+ds-1
    • 2024.6.2-1
    • 2024.8.30+dfsg-1
    • 2024.8.30-1
    • 2025.1.31+ds-1
    • 2025.11.12+ds-1
    • 2026.1.4+ds-1
    • 2026.2.25+ds-1
    • 2026.4.22+ds-1
    • 2026.5.20+ds-1
    • 2026.6.17+ds-1
    • 2026.7.22+ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-certifi Debian:13

    Affected ranges
    • ECOSYSTEM: < 2023.7.22-1

    Update to 2023.7.22-1

  • python-certifi Debian:14

    Affected ranges
    • ECOSYSTEM: < 2023.7.22-1

    Update to 2023.7.22-1

  • certifi PyPI

    Versions
    • 2017.11.5
    • 2018.1.18
    • 2018.10.15
    • 2018.11.29
    • 2018.4.16
    • 2018.8.13
    • 2018.8.24
    • 2019.11.28
    • 2019.3.9
    • 2019.6.16
    • 2019.9.11
    • 2020.11.8
    • 2020.12.5
    • 2020.4.5
    • 2020.4.5.1
    • 2020.4.5.2
    • 2020.6.20
    • 2021.10.8
    • 2021.5.30
    • 2022.5.18
    • 2022.5.18.1
    • 2022.6.15
    • 2022.6.15.1
    • 2022.6.15.2
    • 2022.9.14
    • 2022.9.24
    Affected ranges
    • ECOSYSTEM: ≥ 2017.11.05, < 2022.12.07

    Update to 2022.12.07

  • certifi PyPI

    Versions
    • 2017.11.5
    • 2018.1.18
    • 2018.10.15
    • 2018.11.29
    • 2018.4.16
    • 2018.8.13
    • 2018.8.24
    • 2019.11.28
    • 2019.3.9
    • 2019.6.16
    • 2019.9.11
    • 2020.11.8
    • 2020.12.5
    • 2020.4.5
    • 2020.4.5.1
    • 2020.4.5.2
    • 2020.6.20
    • 2021.10.8
    • 2021.5.30
    • 2022.5.18
    • 2022.5.18.1
    • 2022.6.15
    • 2022.6.15.1
    • 2022.6.15.2
    • 2022.9.14
    • 2022.9.24
    Affected ranges
    • ECOSYSTEM: ≥ 2017.11.5, < 2022.12.7

    Update to 2022.12.7

  • ca-certificates Ubuntu:Pro:14.04:LTS

    Versions
    • 20130610
    • 20130906
    • 20130906ubuntu1
    • 20130906ubuntu2
    • 20141019ubuntu0.14.04.1
    • 20160104ubuntu0.14.04.1
    • 20170717~14.04.1
    • 20170717~14.04.2
    • 20190110~14.04.1~esm1
    • 20190110~14.04.1~esm2
    Affected ranges
    • ECOSYSTEM: < 20211016~14.04.1~esm1

    Update to 20211016~14.04.1~esm1

  • ca-certificates Ubuntu:Pro:16.04:LTS

    Versions
    • 20150426ubuntu1
    • 20160104ubuntu1
    • 20170717~16.04.1
    • 20170717~16.04.2
    • 20190110~16.04.1
    • 20201027ubuntu0.16.04.1
    • 20210119~16.04.1
    • 20210119~16.04.1ubuntu0.1~esm1
    • 20211016~16.04.1~esm1
    Affected ranges
    • ECOSYSTEM: < 20211016~16.04.1~esm2

    Update to 20211016~16.04.1~esm2

  • ca-certificates Ubuntu:18.04:LTS

    Versions
    • 20170717
    • 20180409
    • 20190110~18.04.1
    • 20201027ubuntu0.18.04.1
    • 20210119~18.04.1
    • 20210119~18.04.2
    • 20211016~18.04.1
    Affected ranges
    • ECOSYSTEM: < 20211016ubuntu0.18.04.1

    Update to 20211016ubuntu0.18.04.1

  • ca-certificates Ubuntu:20.04:LTS

    Versions
    • 20190110
    • 20190110ubuntu1
    • 20190110ubuntu1.1
    • 20201027ubuntu0.20.04.1
    • 20210119~20.04.1
    • 20210119~20.04.2
    • 20211016~20.04.1
    Affected ranges
    • ECOSYSTEM: < 20211016ubuntu0.20.04.1

    Update to 20211016ubuntu0.20.04.1

  • ca-certificates Ubuntu:22.04:LTS

    Versions
    • 20210119ubuntu1
    • 20211016
    Affected ranges
    • ECOSYSTEM: < 20211016ubuntu0.22.04.1

    Update to 20211016ubuntu0.22.04.1

Original sources

Check your server →