CVE-2023-37920: Certifi's removal of e-Tugra root certificate
First published: Tue Jul 25 2023(Updated: )
An unspecified error with the removal of e-Tugra root certificate in Certifi has an unknown impact and attack vector.
Credit: security-advisories@github.com security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/certifi | <2023.07.22 | 2023.07.22 |
| IBM Cognos Analytics | <=12.0.0-12.0.4 | |
| IBM Cognos Analytics | <=11.2.0-11.2.4 FP4 | |
| certifi | >=2015.04.28<2023.07.22 | |
| pip/certifi | >=2015.4.28<2023.7.22 | 2023.7.22 |
| Certifi | >=2015.4.28<2023.7.22 | |
| Fedora | =38 | |
| netapp active iq unified manager vsphere | ||
| netapp active iq unified manager windows | ||
| netapp management services for element software | ||
| NetApp Management Services for NetApp HCI | ||
| Netapp Ontap Mediator | ||
| NetApp ONTAP Select Deploy | ||
| netapp solidfire \& hci storage node |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/C-HrP1SEq1A
- https://github.com/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp7
- https://github.com/certifi/python-certifi/commit/8fb96ed81f71e7097ed11bc4d9b19afd7ea5c909
- https://nvd.nist.gov/vuln/detail/CVE-2023-37920
- https://github.com/pypa/advisory-database/tree/main/vulns/certifi/PYSEC-2023-135.yaml
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EX6NG7WUFNUKGFHLM35KHHU3GAKXRTG/
- https://github.com/advisories/GHSA-xqr8-7jwr-rhp7 (Advisory)
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2227191
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2227190
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2227187
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2227196
- https://access.redhat.com/errata/RHSA-2023:6812
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2248948
- https://access.redhat.com/errata/RHSA-2023:7378
- https://access.redhat.com/errata/RHSA-2023:7385
- https://access.redhat.com/errata/RHSA-2023:7407
- https://access.redhat.com/errata/RHSA-2023:7435
- https://access.redhat.com/errata/RHSA-2023:7523
- https://access.redhat.com/errata/RHSA-2023:7528
- https://access.redhat.com/errata/RHSA-2023:7753
- https://access.redhat.com/errata/RHSA-2024:0133
- https://access.redhat.com/errata/RHSA-2024:8228
- https://bugzilla.redhat.com/show_bug.cgi?id=2226586
- https://www.ibm.com/support/pages/node/7181480 (Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EX6NG7WUFNUKGFHLM35KHHU3GAKXRTG
- https://security.netapp.com/advisory/ntap-20240912-0002
- https://security.netapp.com/advisory/ntap-20240912-0002/
Frequently Asked Questions
What is the severity of CVE-2023-37920?
The severity of CVE-2023-37920 is currently unknown due to an unspecified error regarding the removal of the e-Tugra root certificate in Certifi.
What impact does CVE-2023-37920 have on affected software?
CVE-2023-37920 may lead to unknown impacts and attack vectors related to the removal of the e-Tugra root certificate.
How do I fix CVE-2023-37920?
To remediate CVE-2023-37920, upgrade Certifi to version 2023.07.22 or later.
Which software versions are affected by CVE-2023-37920?
CVE-2023-37920 affects Certifi versions prior to 2023.07.22.
Is my IBM software vulnerable to CVE-2023-37920?
IBM Cognos Dashboards on Cloud Pak for Data versions up to 5.0.0 and 4.8.0 are affected by CVE-2023-37920.
- collector/nvd-latest
- agent/type
- agent/first-publish-date
- agent/author
- agent/remedy
- agent/weakness
- agent/description
- agent/title
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-37920
- agent/software-canonical-lookup
- agent/trending
- agent/severity
- collector/ibm-support
- source/IBM
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-xqr8-7jwr-rhp7
- agent/source
- agent/references
- agent/event
- agent/last-modified-date
- agent/softwarecombine
- collector/github-advisory
- agent/tags
- collector/nvd-api
- source/NVD
- collector/nvd-cve
- package-manager/redhat
- vendor/ibm
- canonical/ibm cognos analytics
- version/ibm cognos analytics/12.0.0-12.0.4
- version/ibm cognos analytics/11.2.0-11.2.4 fp4
- vendor/kennethreitz
- canonical/certifi
- version/certifi/2015.04.28
- package-manager/pip
- vendor/certifi
- version/certifi/2015.4.28
- vendor/fedoraproject
- canonical/fedora
- version/fedora/38
- vendor/netapp
- canonical/netapp active iq unified manager vsphere
- canonical/netapp active iq unified manager windows
- canonical/netapp management services for element software
- canonical/netapp management services for netapp hci
- canonical/netapp ontap mediator
- canonical/netapp ontap select deploy
- canonical/netapp solidfire \& hci storage node