Description
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| certifi | python-certifi | < 2022.12.07 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-certifi | 2023.7.22-1 | — |
| Debian 13 | python-certifi | 2023.7.22-1 | — |
| Debian 12 | python-certifi | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | ca-certificates | 20211016ubuntu0.22.04.1 | — |
| Ubuntu 20.04 LTS | ca-certificates | 20211016ubuntu0.20.04.1 | — |
| Ubuntu 18.04 LTS | ca-certificates | 20211016ubuntu0.18.04.1 | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | ca-certificates | 20211016~16.04.1~esm2 | — |
| Ubuntu Pro 14.04 LTS | ca-certificates | 20211016~14.04.1~esm1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ceph Storage 8 | ceph +27 | 2:19.2.1-222.el9cp | RHSA-2025:9775 |
| Red Hat Ceph Storage 8 | cephadm-ansible | 1:4.1.4-1.el9cp | RHSA-2025:9775 |
| Red Hat Ceph Storage 8 | liboath +1 | 2.6.12-1.el9cp | RHSA-2025:9775 |
| Red Hat Ansible Automation Platform 2 | python39-certifi | 2022.12.7-1.el8ap | RHBA-2023:0589 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | mozilla-nss | 3.79.3-150400.3.23.1 | SUSE-SU-2023:0119-1 |
| SLES 15 SP4 | python-certifi | 2018.1.18-150000.3.3.1 | SUSE-SU-2023:0139-1 |
| SLES 15 SP3 | mozilla-nss | 3.79.3-150000.3.90.1 | SUSE-SU-2023:0130-1 |
| SLES 15 SP3 | python-certifi | 2018.1.18-150000.3.3.1 | SUSE-SU-2023:0139-1 |
| SLES 15 SP2 | mozilla-nss | 3.79.3-150000.3.90.1 | SUSE-SU-2023:0130-1 |
| SLES 15 SP2 | python-certifi | 2018.1.18-150000.3.3.1 | SUSE-SU-2023:0139-1 |
| SLES 15 SP1 | mozilla-nss | 3.79.3-150000.3.90.1 | SUSE-SU-2023:0130-1 |
| SLES 15 SP1 | python-certifi | 2018.1.18-150000.3.3.1 | SUSE-SU-2023:0139-1 |
| SLES 12 SP5 | mozilla-nss | 3.79.3-58.91.1 | SUSE-SU-2023:0118-1 |
Show 22 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP4 | mozilla-nss | 3.79.3-58.91.1 | SUSE-SU-2023:0118-1 |
| SLES 12 SP2 | mozilla-nss | 3.79.3-58.91.1 | SUSE-SU-2023:0118-1 |
| SLES for SAP 15 SP3 | mozilla-nss | 3.79.3-150000.3.90.1 | SUSE-SU-2023:0130-1 |
| SLES for SAP 15 SP3 | python-certifi | 2018.1.18-150000.3.3.1 | SUSE-SU-2023:0139-1 |
| SLES for SAP 15 SP2 | mozilla-nss | 3.79.3-150000.3.90.1 | SUSE-SU-2023:0130-1 |
| SLES for SAP 15 SP2 | python-certifi | 2018.1.18-150000.3.3.1 | SUSE-SU-2023:0139-1 |
| SLES for SAP 15 SP1 | mozilla-nss | 3.79.3-150000.3.90.1 | SUSE-SU-2023:0130-1 |
| SLES for SAP 15 SP1 | python-certifi | 2018.1.18-150000.3.3.1 | SUSE-SU-2023:0139-1 |
| SLES for SAP 12 SP5 | mozilla-nss | 3.79.3-58.91.1 | SUSE-SU-2023:0118-1 |
| SLES for SAP 12 SP4 | mozilla-nss | 3.79.3-58.91.1 | SUSE-SU-2023:0118-1 |
| SLE Real Time 15 SP3 | mozilla-nss | 3.79.3-150000.3.90.1 | SUSE-SU-2023:0130-1 |
| SLE Real Time 15 SP3 | python-certifi | 2018.1.18-150000.3.3.1 | SUSE-SU-2023:0139-1 |
| SLE Micro 5.3 | mozilla-nss | 3.79.3-150400.3.23.1 | SUSE-SU-2023:0119-1 |
| SLE Micro 5.3 | python-certifi | 2018.1.18-150000.3.3.1 | SUSE-SU-2023:0139-1 |
| SLE Micro 5.2 | mozilla-nss | 3.79.3-150000.3.90.1 | SUSE-SU-2023:0130-1 |
| SLE Micro 5.2 | python-certifi | 2018.1.18-150000.3.3.1 | SUSE-SU-2023:0139-1 |
| SLE Micro 5.1 | mozilla-nss | 3.79.3-150000.3.90.1 | SUSE-SU-2023:0130-1 |
| SLE Micro 5.1 | python-certifi | 2018.1.18-150000.3.3.1 | SUSE-SU-2023:0139-1 |
| SLE HPC 15 SP3 | mozilla-nss | 3.79.3-150000.3.90.1 | SUSE-SU-2023:0130-1 |
| SLE HPC 15 SP3 | python-certifi | 2018.1.18-150000.3.3.1 | SUSE-SU-2023:0139-1 |
| SLE HPC 15 SP2 | mozilla-nss | 3.79.3-150000.3.90.1 | SUSE-SU-2023:0130-1 |
| SLE HPC 15 SP2 | python-certifi | 2018.1.18-150000.3.3.1 | SUSE-SU-2023:0139-1 |
| SLE HPC 15 SP1 | mozilla-nss | 3.79.3-150000.3.90.1 | SUSE-SU-2023:0130-1 |
| SLE HPC 15 SP1 | python-certifi | 2018.1.18-150000.3.3.1 | SUSE-SU-2023:0139-1 |
| SUSE OpenStack Cloud Crowbar 9 | mozilla-nss | 3.79.3-58.91.1 | SUSE-SU-2023:0118-1 |
| SUSE OpenStack Cloud 9 | mozilla-nss | 3.79.3-58.91.1 | SUSE-SU-2023:0118-1 |
| SUSE Manager Server 4.2 | mozilla-nss | 3.79.3-150000.3.90.1 | SUSE-SU-2023:0130-1 |
| SUSE Manager Server 4.2 | python-certifi | 2018.1.18-150000.3.3.1 | SUSE-SU-2023:0139-1 |
| SUSE Manager Retail Branch Server 4.2 | mozilla-nss | 3.79.3-150000.3.90.1 | SUSE-SU-2023:0130-1 |
| SUSE Manager Retail Branch Server 4.2 | python-certifi | 2018.1.18-150000.3.3.1 | SUSE-SU-2023:0139-1 |
| SUSE Manager Proxy 4.2 | mozilla-nss | 3.79.3-150000.3.90.1 | SUSE-SU-2023:0130-1 |
| SUSE Manager Proxy 4.2 | python-certifi | 2018.1.18-150000.3.3.1 | SUSE-SU-2023:0139-1 |
| SUSE Enterprise Storage 7.1 | mozilla-nss | 3.79.3-150000.3.90.1 | SUSE-SU-2023:0130-1 |
| SUSE Enterprise Storage 7.1 | python-certifi | 2018.1.18-150000.3.3.1 | SUSE-SU-2023:0139-1 |
| SUSE Enterprise Storage 7 | mozilla-nss | 3.79.3-150000.3.90.1 | SUSE-SU-2023:0130-1 |
| SUSE Enterprise Storage 7 | python-certifi | 2018.1.18-150000.3.3.1 | SUSE-SU-2023:0139-1 |
| SUSE Enterprise Storage 6 | mozilla-nss | 3.79.3-150000.3.90.1 | SUSE-SU-2023:0130-1 |
| SUSE Enterprise Storage 6 | python-certifi | 2018.1.18-150000.3.3.1 | SUSE-SU-2023:0139-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-certifi | 2023.7.22-2.1 | openSUSE-SU-2026:11421-1, openSUSE-SU-2024:13237-1 |
| openSUSE Leap 15.4 | mozilla-nss | 3.79.3-150400.3.23.1 | SUSE-SU-2023:0119-1 |
| openSUSE Leap 15.4 | python-certifi | 2018.1.18-150000.3.3.1 | SUSE-SU-2023:0139-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.3 | mozilla-nss | 3.79.3-150400.3.23.1 | SUSE-SU-2023:0119-1 |
| openSUSE Leap Micro 5.3 | python-certifi | 2018.1.18-150000.3.3.1 | SUSE-SU-2023:0139-1 |
| openSUSE Leap Micro 5.2 | mozilla-nss | 3.79.3-150000.3.90.1 | SUSE-SU-2023:0130-1 |
| openSUSE Leap Micro 5.2 | python-certifi | 2018.1.18-150000.3.3.1 | SUSE-SU-2023:0139-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | ca-certificates | 2021.2.50-1.0.amzn2023.0.6 | ALAS2023-2023-061 |
| Amazon Linux 2023 | python3-certifi | 2022.12.07-1.amzn2023.0.1 | ALAS2023-2023-062 |
| Amazon Linux 2 | ca-certificates | 2021.2.50-72.amzn2.0.5 | ALAS2-2023-1957 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | certifi | >= 2017.11.05, < 2022.12.07 | 2022.12.07 | GHSA-43fp-rhv2-5gv8 |
| PyPI | certifi | >= 2017.11.5, < 2022.12.7 | 2022.12.7 | PYSEC-2022-42986 |
Advisories 19
- RHSA-2025:9775 Red Hat Security Advisory: Red Hat Ceph Storage 8.1 security, bug fix, and enhancement updates Red Hat Security Advisories (RHSA) · Oct 16, 2026
- WID-SEC-2023-1793 Oracle PeopleSoft: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 16, 2026
- openSUSE-SU-2026:11421-1 python313-certifi-2026.7.22-1.1 on GA media SUSE / openSUSE Security Updates · Aug 2, 2026
- WID-SEC-2023-1350 Splunk Splunk Enterprise: Mehrere Schwachstellen in Komponenten von Drittanbietern BSI CERT-Bund (WID) · Jul 1, 2026
- RHBA-2023:0589 Red Hat Bug Fix Advisory: Red Hat Ansible Automation Platform 2.3 Product Release Update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- SUSE-SU-2023:0119-1 Security update for mozilla-nss SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:0130-1 Security update for mozilla-nss SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13237-1 python310-certifi-2023.7.22-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-2229 Splunk Splunk Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
- SUSE-SU-2023:0118-1 Security update for mozilla-nss SUSE / openSUSE Security Updates · May 2, 2025
- SUSE-SU-2023:0139-1 Security update for python-certifi SUSE / openSUSE Security Updates · May 2, 2025
- WID-SEC-2023-2674 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 26, 2023
- WID-SEC-2023-2673 Oracle Database Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2023
- WID-SEC-2023-1021 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 29, 2023
- WID-SEC-2023-0542 tribe29 checkmk: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Mar 1, 2023
- WID-SEC-2023-0255 IBM Spectrum Protect: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 27, 2023
- ALAS2023-2023-061 Important: ca-certificates security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 22, 2023
- ALAS2023-2023-062 Important: python-certifi security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 22, 2023
- ALAS2-2023-1957 Important: ca-certificates security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Feb 22, 2023