Critical Vulnerability in python-certifi: Removal of e-Tugra Root Certificates
Summary
DEBIAN-CVE-2023-37920: Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Affects python-certifi versions < 2023.7.22-1. Fixed in 2023.7.22-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-certifi is a Python package that provides a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. It is widely used in applications that require secure communications over the internet. The package ensures that the connections made by applications are secure by validating SSL certificates against trusted root certificates. However, prior to version 2023.07.22, python-certifi included root certificates from 'e-Tugra', which were under investigation for security issues.
Vulnerability Detail
The vulnerability arises from the inclusion of 'e-Tugra' root certificates in python-certifi versions prior to 2023.07.22. These certificates were subject to scrutiny due to reported security issues, which raised concerns about their trustworthiness. The presence of these certificates could potentially allow malicious actors to exploit vulnerabilities in the SSL/TLS validation process, leading to man-in-the-middle attacks or unauthorized access to sensitive data.
How To Fix
Minimum fixed version
2023.7.22-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-certifiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually remove the e-Tugra root certificates from their system's trust store, but this is not recommended as it may lead to other trust issues. It is best to update to the patched version as soon as possible.
Conclusion
The vulnerability in python-certifi regarding the inclusion of e-Tugra root certificates poses significant security risks. Users are strongly encouraged to update to version 2023.07.22 or later to mitigate these risks. Regular monitoring of dependencies using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for python-certifi →
FAQ
python-certifi is a Python package that provides a collection of Root Certificates for validating SSL certificates, ensuring secure communications.
e-Tugra root certificates are certificates issued by a certificate authority that were found to have security issues, leading to their removal from python-certifi.
If your application uses an affected version of python-certifi, it may be vulnerable to man-in-the-middle attacks due to the inclusion of untrustworthy root certificates.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without signup.
If immediate updates are not possible, consider implementing additional security measures, such as using alternative SSL validation methods until you can update.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-certifi.
