Critical Vulnerability in Certifi and Python Pip Packages: CVE-2023-37920
Summary
UBUNTU-CVE-2023-37920: Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Affects python-pip versions 1.4.1-2 – 1.5.4-1ubuntu4+esm5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Certifi is a widely used Python package that provides a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Python Pip is a package management system for Python that allows users to install and manage software packages written in Python. The vulnerability in question affects multiple versions of these packages across various Ubuntu LTS distributions, exposing users to potential security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2023-37920, arises from Certifi's inclusion of 'e-Tugra' root certificates, which have been implicated in security issues. Prior to version 2023.07.22, Certifi recognized these root certificates, posing a risk of trustworthiness in SSL certificate validation. This could lead to unauthorized access or data breaches, as malicious actors could exploit the compromised certificates to impersonate legitimate services.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually remove the 'e-Tugra' root certificates from their certificate store, although this is not a recommended long-term solution. It is advisable to apply the patch as soon as possible.
Conclusion
CVE-2023-37920 represents a significant security risk for users of the Certifi and Python Pip packages. It is crucial to update to the patched versions to mitigate potential threats. Users are encouraged to monitor their systems and utilize tools like Vulert for ongoing vulnerability management.
See every vulnerability recorded for python-pip →
FAQ
CVE-2023-37920 is a critical vulnerability affecting the Certifi and Python Pip packages, which could allow attackers to exploit compromised root certificates.
If your system uses affected versions of Certifi or Python Pip, it may be at risk of SSL certificate validation failures, potentially leading to unauthorized access.
If immediate updates are not possible, consider removing the compromised root certificates as a temporary measure until you can apply the patch.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json. Visit Vulert Scanner to check your application without signup.
The CVSS score for CVE-2023-37920 is 9.8, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for python-pip.
