Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.
References
Link | Resource |
---|---|
https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8 | Third Party Advisory |
https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ | Mailing List Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: GitHub_M
Published: 2022-12-07T21:15:53.804Z
Updated:
Reserved: 2022-01-19T21:23:53.763Z
Link: CVE-2022-23491
JSON object: View
NVD Information
Status : Analyzed
Published: 2022-12-07T22:15:09.870
Modified: 2023-03-24T18:12:24.360
Link: CVE-2022-23491
JSON object: View
Redhat Information
No data.
CWE