CVE-2023-37920

HighCVSS 7.5

Published: 25/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

37th percentile - higher than 37% of all known CVEs

Summary

Certifi, a collection of root certificates for SSL verification, prior to version 2023.07.22 recognized 'e-Tugra' root certificates. Following reports of security issues in 'e-Tugra' systems, these certificates were removed from the root store in version 2023.07.22.

Risk Assessment

Using 'e-Tugra' certificates may lead to security breaches as they were under investigation for security issues. Organizations could be vulnerable to attacks if they continue to rely on these certificates.

Recommendation

It is recommended to upgrade to Certifi version 2023.07.22 or later to remove 'e-Tugra' certificates from the store. An audit of the certificates in use within systems should also be conducted.

Other vulnerabilities in Certifi

GHSA-6q48-6c7w-9gw2Critical
Certifi versions before 2026.10.18 include the emSign ECC Root CA - G3 root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates chaining to this root have compromised private keys and the CA has revoked them. An attacker with one of the compromised keys can issue certificates.

Original NVD description (English source)

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS