CVE-2022-23491

Katalog CVE

CVSS 7.5 · High EPSS 0,53%

Kerentanan Insufficient Verification of Data Authenticity pada certifi, netapp e-series performance analyzer +2 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.

Rincian

Terbit di NVD

7 Desember 2022

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-345: Insufficient Verification of Data Authenticity

EPSS (30 hari)

0,53% peluang dieksploitasi; lebih tinggi dari 43,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8 advisory pihak ketiga
• https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20230223-0010/ advisory pihak ketiga