Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2023-37920: certifi package could let attackers spoof secure connections
CVE-2023-37920 · published today
Summary
The Python certifi library, used by several applications, can be tricked into accepting fraudulent security certificates, potentially exposing data to eavesdropping or tampering. This affects systems that rely on certifi, such as Fedora and NetApp management tools. Updating to the latest patched version of certifi resolves the risk.
What to do
- Update kenneth reitz certifi to version 2023.7.22.
- Update rootio-certifi to version 2019.11.28+root.io.1.
- Update debian python-certifi to version 2023.7.22-1.
- Update kenneth reitz certifi to version 2020.12.5+aikido.3.
- Update py3-certifi to version 2023.7.22-r0.
- Update certifi to version 2019.11.28+aikido.2.
- Update certifi certifi to version 2023.7.22 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | kenneth reitz | certifi |
>= 2015.4.28, < 2023.7.22 Fix: upgrade to 2023.7.22
|
| – | certifi | certifi |
>= 2015.4.28, < 2023.7.22 cpe:2.3:a:certifi:certifi:*:*:*:*:*:python:*:* |
| – | fedoraproject | fedora |
38 cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* |
| – | netapp | active_iq_unified_manager |
All versions
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:* |
| – | netapp | management_services_for_element_software |
All versions
cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:* |
| – | netapp | management_services_for_netapp_hci |
All versions
cpe:2.3:a:netapp:management_services_for_netapp_hci:-:*:*:*:*:*:*:* |
| – | netapp | ontap_mediator |
All versions
cpe:2.3:a:netapp:ontap_mediator:-:*:*:*:*:*:*:* |
| – | netapp | ontap_select_deploy_administration_utility |
All versions
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* |
| – | netapp | solidfire_\&_hci_storage_node |
All versions
cpe:2.3:a:netapp:solidfire_\&_hci_storage_node:-:*:*:*:*:*:*:* |
| Root:PyPI | – | rootio-certifi |
< 2019.11.28+root.io.1 Fix: upgrade to 2019.11.28+root.io.1
|
| Debian:12 | debian | python-certifi | All versions |
| Debian:13 | debian | python-certifi |
< 2023.7.22-1 Fix: upgrade to 2023.7.22-1
|
| Debian:14 | debian | python-certifi |
< 2023.7.22-1 Fix: upgrade to 2023.7.22-1
|
| Root:PyPI | kenneth reitz | certifi |
< 2020.12.5+aikido.3 Fix: upgrade to 2020.12.5+aikido.3
|
| Alpine:v3.18 | – | py3-certifi |
>= 2015.4.28, < 2023.7.22-r0 Fix: upgrade to 2023.7.22-r0
|
| Root:PyPI | – | certifi |
< 2019.11.28+aikido.2 Fix: upgrade to 2019.11.28+aikido.2
|
Original advisory text
CVE-2023-37920 in certifi - Patched by Root
Root has patched CVE-2023-37920 in the certifi package for Root:PyPI. Multiple fixed versions available.
References
- https://github.com/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-37920 Vendor Advisory
- https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/C-HrP1SEq1A URL
- https://github.com/pypa/advisory-database/tree/main/vulns/certifi/PYSEC-2023-135...
- https://lists.fedoraproject.org/archives/list/[email protected]...
- https://security.netapp.com/advisory/ntap-20240912-0002
- https://github.com/advisories/GHSA-xqr8-7jwr-rhp7
- https://lists.fedoraproject.org/archives/list/[email protected]... URL
- https://security.netapp.com/advisory/ntap-20240912-0002/ Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2023-37920 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37920... Vendor Advisory
- https://github.com/certifi/python-certifi/commit/8fb96ed81f71e7097ed11bc4d9b19af... Patch
- https://security.alpinelinux.org/vuln/CVE-2023-37920 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-345Insufficient Verification of Data Authenticity
Timeline
Published27 Oct 2026
Updated27 Oct 2026
First seen6 Mar 2026
Sources
GHSA-xqr8-7jwr-rhp7 · GHSA
CVE-2023-37920 · NVD
DEBIAN-CVE-2023-37920 · OSV
CVE-2023-37920 · OSV
ALPINE-CVE-2023-37920 · OSV
Track software like this
Free during beta