CVE-2023-37920

Publication date 25 July 2023

Last updated 24 July 2024

Ubuntu priority

Negligible

Why this priority?

Cvss 3 Severity Score

9.8 · Critical

Score breakdown

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store.

Read the notes from the security team

Why is this CVE negligible priority?

python-certifi in Debian and Ubuntu is patched to use the system CA certificates

Learn more about Ubuntu priority

Status

Package Ubuntu Release Status
python-certifi 23.10 mantic Ignored end of life, was ignored [see notes]
23.04 lunar Ignored end of life, was ignored [see notes]
22.10 kinetic Ignored end of life, was needs-triage
22.04 LTS jammy Ignored see notes
20.04 LTS focal Ignored see notes
18.04 LTS bionic Ignored see notes
16.04 LTS xenial Ignored see notes
14.04 LTS trusty Ignored end of standard support
python-pip 23.10 mantic Ignored end of life, was ignored [see notes]
23.04 lunar Ignored end of life, was ignored [see notes]
22.10 kinetic Ignored end of life, was needs-triage
22.04 LTS jammy Ignored see notes
20.04 LTS focal Ignored see notes
18.04 LTS bionic Ignored see notes
16.04 LTS xenial Ignored see notes
14.04 LTS trusty Ignored end of ESM support, was ignored [see notes]

Notes

mdeslaur

the python-pip package bundles python-certifi binaries when built. After updating python-certifi, a no-change rebuild of python-pip is required.

sbeattie

python-certifi in Debian and Ubuntu is patched to use the system CA certificates

mdeslaur

While the cacert.pem file is shipped in binary packages, it is not used in any way, the actual application is patched to use the system ca-certificates. There is a Debian bug filed to remove the cert store here: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=947287

seth-arnold

I'm marking this 'ignored', we don't wish to give the impression that this certificate bundle is supported.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
python-certifi

Severity score breakdown

Parameter Value
Base score 9.8 · Critical
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity impact High
Availability impact High
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H