Skip to content
OpenAdvisories
High ALAS2023-2023-062 1 CVE

Important: python-certifi security update (Amazon Linux 2023)

Published Feb 17, 2023 · Updated Feb 22, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-23491: Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2023 python3-certifi 0:2022.12.07-1.amzn2023.0.1

Vulnerabilities 1

  • Medium 6.8
    CVE-2022-23491

    Removal of TrustCor root certificate

    Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process o…

    certifi python-certifi certifi python-certifi Debian Ubuntu PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-23491.html