TrustCor Root Certificate Removal in python-certifi: CVE-2022-23491
Summary
DEBIAN-CVE-2022-23491: Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Affects python-certifi versions < 2023.7.22-1. Fixed in 2023.7.22-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-certifi is a Python package that provides a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. It is widely used in applications that require secure communications over the internet. The package ensures that the SSL certificates presented by servers are valid and trusted, enhancing the security of data transmission. However, the package has faced a vulnerability due to the inclusion of TrustCor root certificates, which are under scrutiny for their association with spyware production.
Vulnerability Detail
The vulnerability, identified as CVE-2022-23491, arises from the inclusion of TrustCor root certificates in the python-certifi package. These certificates are being removed from Mozilla's trust store following an investigation into TrustCor's ownership and its alleged involvement in producing spyware. The presence of these certificates could lead to potential security risks, as they may undermine the trustworthiness of SSL certificate validation, exposing users to man-in-the-middle attacks and other security threats.
How To Fix
Minimum fixed version
2023.7.22-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-certifiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually remove the TrustCor root certificates from their local certificate store, but this is not a recommended long-term solution. It is advisable to update the package as soon as possible to ensure comprehensive security.
Conclusion
In summary, CVE-2022-23491 affects the python-certifi package due to the inclusion of TrustCor root certificates, which pose security risks. Users are strongly advised to update to the patched version to ensure the integrity of SSL certificate validation and protect their applications from potential threats.
See every vulnerability recorded for python-certifi →
FAQ
CVE-2022-23491 is a vulnerability in the python-certifi package related to the inclusion of TrustCor root certificates, which are under investigation for potential security risks.
This vulnerability can compromise the security of SSL certificate validation in your application, potentially exposing it to man-in-the-middle attacks.
You should update your python-certifi package to version 2023.7.22-1 or later to mitigate the vulnerability.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
Failing to address this vulnerability may leave your application susceptible to security breaches, including unauthorized access and data interception.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-certifi.
