Bug 2226586 (CVE-2023-37920)

Summary:	CVE-2023-37920 python-certifi: Removal of e-Tugra root certificate
Product:	[Other] Security Response	Reporter:	Sandipan Roy <saroy>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	adudiak, amctagga, aoconnor, bbuckingham, bcourt, bniver, davidn, dfreiber, dhughes, eglynn, ehelms, epacific, flucifre, gmeno, gtanzill, jburrell, jcammara, jhardy, jjoyce, jneedle, jobarker, jsherril, kshier, lhh, lzap, mabashia, mbenjamin, mburns, mgarciac, mhackett, mhulan, mminar, myarboro, nmoumoul, orabin, osapryki, pcreech, pgrist, rbiba, rchan, rhos-maint, rogbas, simaishi, smcdonal, sostapov, sskracic, stcannon, teagle, tfister, vereddy, vkumar, yguenane, zsadeh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	certifi 2023.07.22	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the python-certifi package. This issue occurs when the e-Tugra root certificate in Certifi is removed, resulting in an unspecified error that has an unknown impact and attack vector.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2226588, 2226589, 2226590, 2226592, 2227188, 2227189, 2227196, 2226591, 2227187, 2227190, 2227191, 2227192, 2227193, 2227194, 2227195
Bug Blocks:	2226587

Description Sandipan Roy 2023-07-26 03:42:12 UTC

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store.

https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/C-HrP1SEq1A
https://github.com/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp7
https://github.com/certifi/python-certifi/commit/8fb96ed81f71e7097ed11bc4d9b19afd7ea5c909

Comment 3 Avinash Hanwate 2023-07-28 09:33:58 UTC

Created mingw-python-certifi tracking bugs for this issue:

Affects: fedora-all [bug 2227191]


Created python-certifi tracking bugs for this issue:

Affects: epel-all [bug 2227190]
Affects: fedora-all [bug 2227187]
Affects: openstack-rdo [bug 2227196]