PT-2023-4949 · Certifi+7 · Certifi+7

Ian Carroll · Published 2023-07-25 · Updated 2025-12-29 · CVE-2023-37920

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Certifi versions prior to 2023.07.22

Description The issue is related to the recognition of "e-Tugra" root certificates by Certifi, a collection of Root Certificates for validating SSL certificates. e-Tugra's root certificates were subject to an investigation due to reported security issues. The problem is associated with insufficient authentication data verification, which could allow a remote attacker to implement a "man-in-the-middle" attack.

Recommendations For Certifi versions prior to 2023.07.22, update to version 2023.07.22 or later, which removes the "e-Tugra" root certificates from the root store. As a temporary workaround, consider disabling the use of "e-Tugra" root certificates until the update is applied.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

ALSA-2023:7753

ALSA-2024:0133

ALT-PU-2024-17376

ALT-PU-2024-17878

ALT-PU-2025-6576

AZL-35126

BDU:2023-05463

CESA-2024_0133

CVE-2023-37920

ECHO-DF75-5B71-A4BE

GHSA-XQR8-7JWR-RHP7

INFBA-2024_5691

INFBA-2024_5736

OESA-2023-1457

PYSEC-2023-135

RHSA-2023:6812

RHSA-2023:7378

RHSA-2023:7385

RHSA-2023:7407

RHSA-2023:7435

RHSA-2023:7523

RHSA-2023:7528

RHSA-2023:7753

RHSA-2023_7753

RHSA-2024:0133

RHSA-2024_0133

Affected Products

Alt Linux

Almalinux

Centos

Certifi

Debian

Ibm Aix

Red Hat

Red Os

References · 54

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37920.json · Exploit
• https://github.com/certifi/python-certifi/commit/8fb96ed81f71e7097ed11bc4d9b19afd7ea5c909 · Patch
• https://github.com/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp7 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2023-37920 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-37920 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37920 · Security Note
• https://bdu.fstec.ru/vul/2023-05463 · Security Note
• https://linux.oracle.com/errata/ELSA-2024-0133.html · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2024:0133 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/704209 · Security Note
• https://linux.oracle.com/errata/ELSA-2023-7753.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-37920 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2023-7753.html · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1457 · Vendor Advisory