CVE-2023-37920
CVE Details
Last Update
11/7/2024
NIST CVE Summary
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store.
Our Official Summary
This vulnerability was found in the python-certifi package. eTurgra certificates are marked as untrusted by Mozilla and were removed from Mozilla's root store in July 2023. This issue occurs when the e-Tugra root certificate in Certifi is removed, resulting in an unspecified error that has an unknown impact and attack vector. This issue is mostly impacted during the use of web browsers. The vulnerability exploitation likelihood in the calico cni images is low. We are waiting on an upstream fix from the 3rd party vendors. We will upgrade the images once the upstream fix becomes available.
CVE Severity
Status
Ongoing
Affected Products & Versions
- Palette VerteX airgap 4.4.14, 4.4.18, 4.5.3, 4.5.8
- Palette Enterprise airgap 4.4.18, 4.5.3, 4.5.8
- Palette VerteX 4.5.3, 4.5.8
- Palette Enterprise 4.5.3, 4.5.8
Revision History
- 1.0 08/16/2024 Initial Publication
- 2.0 08/17/2024 Added Palette VerteX airgap 4.4.14 to Affected Products
- 3.0 09/17/2024 Added Palette VerteX airgap 4.4.18 & Palette Enterprise airgap 4.4.18 to Affected Products
- 4.0 10/10/2024 Added Palette VerteX airgap 4.5.3 & Palette Enterprise airgap 4.5.3 to Affected Products
- 5.0 10/14/2024 Added Palette Enterprise & Palette VerteX 4.5.3 to Affected Products
- 6.0 11/7/2024 Added Palette VerteX airgap, Palette Enterprise airgap, Palette Enterprise, and Palette VerteX 4.5.8 to Affected Products