PT-2022-16025 · Certifi+4 · Certifi+4

Published 2022-12-05 · Updated 2026-06-03 · CVE-2022-23491

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Certifi versions prior to 2022.12.07

Description The issue is related to the presence of TrustCor's root certificates in the list of root certificates, which has been removed due to TrustCor's involvement in producing spyware. This removal is part of an investigation prompted by media reports. The exploitation of this issue may allow an attacker to compromise any checks based on digital signatures.

Recommendations For Certifi versions prior to 2022.12.07, disable bundled Trustcor root certificate signatures generated after Wednesday, November 30, 2022.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

ALT-PU-2023-8446

ALT-PU-2024-17878

CVE-2022-23491

ECHO-2096-02CB-109F

GHSA-43FP-RHV2-5GV8

MGASA-2023-0140

OESA-2023-1457

OPENSUSE-SU-2023_0119-1

OPENSUSE-SU-2023_0139-1

OPENSUSE-SU-2024:13237-1

PYSEC-2022-42986

RHSA-2025:9775

SUSE-SU-2023:0118-1

SUSE-SU-2023:0119-1

SUSE-SU-2023:0130-1

SUSE-SU-2023:0139-1

SUSE-SU-2023_0118-1

SUSE-SU-2023_0119-1

SUSE-SU-2023_0130-1

SUSE-SU-2023_0139-1

USN-5761-1

USN-5761-2

Affected Products

Alt Linux

Certifi

Debian

Red Os

Suse

References · 50

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23491.json · Exploit
• https://osv.dev/vulnerability/PYSEC-2022-42986 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13237-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-23491 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5761-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5761-2 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/689938 · Security Note
• https://osv.dev/vulnerability/OESA-2023-1457 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23491 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-23491 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23491 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-43fp-rhv2-5gv8 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5761-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37920 · Security Note
• https://ubuntu.com/security/notices/USN-5761-2 · Vendor Advisory