GCVE - cpe:2.3:a:certifi:python-certifi:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:certifi:python-certifi:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Certifi (`9ccff261-419d-597a-a012-e24479deb67e`)
Product	Python Certifi (`81874d1c-1722-5e41-b74c-f02fed6caea5`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-39689`	vulnerable	2026-06-08 06:41:51.394223	Certifi removes GLOBALTRUST root certificate HIGH (7.5) Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.7.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues." Published: 2024-07-05T18:39:33.202Z Updated: 2025-02-14T23:19:13.111Z Open on db.gcve.eu Reference links https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463 https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-37920`	vulnerable	2026-06-08 06:08:16.207656	Certifi's removal of e-Tugra root certificate HIGH (7.5) Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store. Published: 2023-07-25T20:45:35.286Z Updated: 2025-03-05T18:47:15.819Z Open on db.gcve.eu Reference links https://github.com/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp7 https://github.com/certifi/python-certifi/commit/8fb96ed81f71e7097ed11bc4d9b19afd7ea5c909 https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/C-HrP1SEq1A https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EX6NG7WUFNUKGFHLM35KHHU3GAKXRTG/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-23491`	vulnerable	2026-06-08 05:40:57.631499	Removal of TrustCor root certificate MEDIUM (6.8) Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion. Published: 2022-12-07T21:15:53.804Z Updated: 2025-04-23T16:31:36.080Z Open on db.gcve.eu Reference links https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8 https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.