Insufficient verification of data authenticity in python-certifi - CVE-2022-23491

Vulnerability identifier: #VU71398

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-23491

CWE-ID: CWE-345

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass certificate validation checks.

The vulnerability exists due to presence of the TrustCor certificate in the Root Certificates list. the certificate is removed due to TrustCor's ownership also operated a business that produced spyware. Therefore, any checks that rely on digital signatures of trusted certificates were compromised.

python-certifi
IBM Cloud Pak for Watson AIOps
Dell Data Protection Central
Dell EMC PowerProtect Data Protection
Storage Ceph
ObjectScale
Cloud Pak for Network Automation
PowerStore T
Dell EMC PowerStore Family Operating System
SOAR QRadar Plugin App
Cognos Dashboards on Cloud Pak for Data
EMC Cloud Tiering Appliance
Robotic Process Automation for Cloud Pak
Amazon Linux AMI
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
openSUSE Leap Micro
SUSE Enterprise Storage
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Basesystem
openSUSE Leap
openEuler
Fedora
Oracle Database Server
IBM Process Mining
Ansible Automation Platform
IBM Watson Assistant for IBM Cloud Pak for Data
Oracle Communications Cloud Native Core Automated Test Suite
IBM Cloud Pak for Data System
Spectrum Discover
IBM Cloud Pak for Multicloud Management Security Services
IBM Fusion HCI
QRadar User Behavior Analytics
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
App Connect Enterprise Certified Container
IBM Spectrum Scale for IBM Elastic Storage Server
IBM Maximo Application Suite
IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes
IBM Spectrum Protect Plus Container Backup and Restore for OpenShift
IBM Spectrum Protect Plus
Intel In-Band Manageability
Splunk Enterprise
PeopleSoft Enterprise PeopleTools
IBM Cognos Analytics
Oracle WebLogic Server
IBM Integrated Analytics System
oath-toolkit (Red Hat package)
ansible-core (Red Hat package)
mozilla-nss-sysinit-debuginfo
mozilla-nss-sysinit
mozilla-nss-sysinit-32bit
libfreebl3-32bit
mozilla-nss-sysinit-debuginfo-32bit
mozilla-nss-tools
mozilla-nss-tools-debuginfo
libfreebl3
mozilla-nss-debugsource
mozilla-nss-devel
libfreebl3-debuginfo
libfreebl3-debuginfo-32bit
libfreebl3-hmac
libfreebl3-hmac-32bit
libsoftokn3
libsoftokn3-32bit
libsoftokn3-debuginfo
libsoftokn3-debuginfo-32bit
libsoftokn3-hmac
mozilla-nss
mozilla-nss-32bit
mozilla-nss-certs
mozilla-nss-certs-32bit
mozilla-nss-certs-debuginfo
mozilla-nss-certs-debuginfo-32bit
mozilla-nss-debuginfo
mozilla-nss-debuginfo-32bit
libsoftokn3-hmac-32bit
libfreebl3-32bit-debuginfo
libsoftokn3-32bit-debuginfo
mozilla-nss-32bit-debuginfo
mozilla-nss-certs-32bit-debuginfo
mozilla-nss-sysinit-32bit-debuginfo
cephadm-ansible (Red Hat package)
automation-controller (Red Hat package)
ceph (Red Hat package)
python3-certifi
python2-certifi
ca-certificates
python-certifi
python-certifi (Red Hat package)
mingw-python-certifi
python-certifi-help
Cloud Pak for Data
RecoverPoint for VMs
Dell EMC VxRail Appliance
Red Hat Ceph Storage

Install updates from vendor's website.

python-certifi - update to 2022.12.07
IBM Process Mining - update to 2.0
Intel In-Band Manageability - update to 4.2.0
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
Storage Ceph - update to 8.1
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
IBM Cloud Pak for Data System - update to 1.0.8.2
IBM Integrated Analytics System - update to 1.0.28.0
ObjectScale - update to 1.4.0
Spectrum Discover - addressed in versions 2.0.4.8, 2.1.1
IBM Cloud Pak for Multicloud Management Security Services - update to 2.3 Fix Pack 6
Cloud Pak for Network Automation - update to 2.4.3
oath-toolkit (Red Hat package) - update to 2.6.12-1.el9cp
IBM Fusion HCI - update to 2.7.1
ansible-core (Red Hat package) - addressed in versions 2.14.2-1.el8ap, 2.14.2-1.el9ap
PowerStore T - update to 3.5.0.1-2083289
mozilla-nss-sysinit-debuginfo - addressed in versions 3.79.3-58.91.1, 3.79.3-150000.3.90.1, 3.79.3-150400.3.23.1
mozilla-nss-sysinit - addressed in versions 3.79.3-58.91.1, 3.79.3-150000.3.90.1, 3.79.3-150400.3.23.1
mozilla-nss-sysinit-32bit - addressed in versions 3.79.3-58.91.1, 3.79.3-150000.3.90.1, 3.79.3-150400.3.23.1
libfreebl3-32bit - addressed in versions 3.79.3-58.91.1, 3.79.3-150000.3.90.1, 3.79.3-150400.3.23.1
mozilla-nss-sysinit-debuginfo-32bit - update to 3.79.3-58.91.1
mozilla-nss-tools - addressed in versions 3.79.3-58.91.1, 3.79.3-150000.3.90.1, 3.79.3-150400.3.23.1
mozilla-nss-tools-debuginfo - addressed in versions 3.79.3-58.91.1, 3.79.3-150000.3.90.1, 3.79.3-150400.3.23.1
libfreebl3 - addressed in versions 3.79.3-58.91.1, 3.79.3-150000.3.90.1, 3.79.3-150400.3.23.1
mozilla-nss-debugsource - addressed in versions 3.79.3-58.91.1, 3.79.3-150000.3.90.1, 3.79.3-150400.3.23.1
mozilla-nss-devel - addressed in versions 3.79.3-58.91.1, 3.79.3-150000.3.90.1, 3.79.3-150400.3.23.1
libfreebl3-debuginfo - addressed in versions 3.79.3-58.91.1, 3.79.3-150000.3.90.1, 3.79.3-150400.3.23.1
libfreebl3-debuginfo-32bit - update to 3.79.3-58.91.1
libfreebl3-hmac - addressed in versions 3.79.3-58.91.1, 3.79.3-150000.3.90.1, 3.79.3-150400.3.23.1
libfreebl3-hmac-32bit - addressed in versions 3.79.3-58.91.1, 3.79.3-150000.3.90.1, 3.79.3-150400.3.23.1
libsoftokn3 - addressed in versions 3.79.3-58.91.1, 3.79.3-150000.3.90.1, 3.79.3-150400.3.23.1
libsoftokn3-32bit - addressed in versions 3.79.3-58.91.1, 3.79.3-150000.3.90.1, 3.79.3-150400.3.23.1
libsoftokn3-debuginfo - addressed in versions 3.79.3-58.91.1, 3.79.3-150000.3.90.1, 3.79.3-150400.3.23.1
libsoftokn3-debuginfo-32bit - update to 3.79.3-58.91.1
libsoftokn3-hmac - addressed in versions 3.79.3-58.91.1, 3.79.3-150000.3.90.1, 3.79.3-150400.3.23.1
mozilla-nss - addressed in versions 3.79.3-58.91.1, 3.79.3-150000.3.90.1, 3.79.3-150400.3.23.1
mozilla-nss-32bit - addressed in versions 3.79.3-58.91.1, 3.79.3-150000.3.90.1, 3.79.3-150400.3.23.1
mozilla-nss-certs - addressed in versions 3.79.3-58.91.1, 3.79.3-150000.3.90.1, 3.79.3-150400.3.23.1
mozilla-nss-certs-32bit - addressed in versions 3.79.3-58.91.1, 3.79.3-150000.3.90.1, 3.79.3-150400.3.23.1
mozilla-nss-certs-debuginfo - addressed in versions 3.79.3-58.91.1, 3.79.3-150000.3.90.1, 3.79.3-150400.3.23.1
mozilla-nss-certs-debuginfo-32bit - update to 3.79.3-58.91.1
mozilla-nss-debuginfo - addressed in versions 3.79.3-58.91.1, 3.79.3-150000.3.90.1, 3.79.3-150400.3.23.1
mozilla-nss-debuginfo-32bit - update to 3.79.3-58.91.1
libsoftokn3-hmac-32bit - addressed in versions 3.79.3-58.91.1, 3.79.3-150000.3.90.1, 3.79.3-150400.3.23.1
libfreebl3-32bit-debuginfo - addressed in versions 3.79.3-150000.3.90.1, 3.79.3-150400.3.23.1
libsoftokn3-32bit-debuginfo - addressed in versions 3.79.3-150000.3.90.1, 3.79.3-150400.3.23.1
mozilla-nss-32bit-debuginfo - addressed in versions 3.79.3-150000.3.90.1, 3.79.3-150400.3.23.1
mozilla-nss-certs-32bit-debuginfo - addressed in versions 3.79.3-150000.3.90.1, 3.79.3-150400.3.23.1
mozilla-nss-sysinit-32bit-debuginfo - addressed in versions 3.79.3-150000.3.90.1, 3.79.3-150400.3.23.1
Dell EMC PowerStore Family Operating System - update to 4.0.0.0-2284811
cephadm-ansible (Red Hat package) - update to 4.1.4-1.el9cp
QRadar User Behavior Analytics - update to 4.1.10
automation-controller (Red Hat package) - addressed in versions 4.3.5-1.el8ap, 4.3.5-1.el9ap
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.2
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.6.4
Cloud Pak for Data - update to 4.8.5
App Connect Enterprise Certified Container - addressed in versions 5.0.3, 7.0.0
SOAR QRadar Plugin App - update to 5.0.3
Cognos Dashboards on Cloud Pak for Data - update to 5.1
IBM Spectrum Scale for IBM Elastic Storage Server - addressed in versions 5.1.2.11, 5.1.7.0
RecoverPoint for VMs - update to 6.0.SP1.P1
Dell EMC VxRail Appliance - addressed in versions 7.0.411, 8.320
Red Hat Ceph Storage - update to 8.1
IBM Maximo Application Suite - addressed in versions 8.8.7, 8.9.3
IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes - update to 10.1.12.4
IBM Spectrum Protect Plus Container Backup and Restore for OpenShift - update to 10.1.12.4
IBM Spectrum Protect Plus - update to 10.1.13.1
IBM Cognos Analytics - addressed in versions 11.2.4 IF5, 12.0.4 IF2
EMC Cloud Tiering Appliance - update to 13.2.0.2.22
ceph (Red Hat package) - update to 19.2.1-222.el9cp
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.1, 23.0.1
python3-certifi - update to 2018.1.18-150000.3.3.1
python2-certifi - update to 2018.1.18-150000.3.3.1
ca-certificates - addressed in versions 2018.2.22-65.1.29, 2018.2.22-65.1.30, 2021.2.50-1.0, 2023.2.60-1.0
python-certifi - update to 2022.12.07-1
python-certifi (Red Hat package) - update to 2022.12.7-1.el9ap
mingw-python-certifi - addressed in versions 2022.12.7-1.fc36, 2022.12.7-1.fc37, 2022.12.7-1.fc38
python-certifi - update to 2023.7.22-1
python-certifi-help - update to 2023.7.22-1
python3-certifi - update to 2023.7.22-1

• https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ
• https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8

• Insufficient verification of data authenticity in Python Certifi
• SUSE update for mozilla-nss
• SUSE update for mozilla-nss
• SUSE update for mozilla-nss
• SUSE update for python-certifi
• Insufficient verification of data authenticity in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in IBM Spectrum Protect Plus File Systems Agent
• Insufficient verification of data authenticity in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Amazon Linux AMI update for ca-certificates
• Insufficient verification of data authenticity in IBM QRadar User Behavior Analytics
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 2.3
• Insufficient verification of data authenticity in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Automated Test Suite
• Multiple vulnerabilities in Dell Cloud Tiering Appliance
• Insufficient verification of data authenticity in IBM Integrated Analytics System
• Insufficient verification of data authenticity in IBM Storage Scale
• Multiple vulnerabilities in IBM Spectrum Discover
• Insufficient verification of data authenticity in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Insufficient verification of data authenticity in IBM Cloud Pak for Data System
• Insufficient verification of data authenticity in IBM Maximo Application Suite
• Multiple vulnerabilities in Dell Data Protection Central
• Multiple vulnerabilities in Dell PowerStore Family
• Fedora 37 update for mingw-python-certifi
• Fedora 38 update for mingw-python-certifi
• Fedora 36 update for mingw-python-certifi
• Splunk Enterprise update for third-party packages
• Multiple vulnerabilities in IBM SOAR QRadar Plugin App
• Multiple vulnerabilities in Oracle Database Server
• Multiple vulnerabilities in Oracle WebLogic Server
• Multiple vulnerabilities in IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Multiple vulnerabilities in IBM Storage Fusion HCI
• Multiple vulnerabilities in Intel In-Band Manageability Framework
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management Security Services
• openEuler update for python-certifi
• Multiple vulnerabilities in Dell PowerStore Family
• Amazon Linux AMI update for ca-certificates
• Amazon Linux AMI update for python-certifi
• Multiple vulnerabilities in Dell ObjectScale
• Insufficient verification of data authenticity in IBM Cloud Pak for Data
• Amazon Linux AMI update for ca-certificates
• Multiple vulnerabilities in Dell RecoverPoint for Virtual Machines
• Multiple vulnerabilities in IBM Cognos Analytics
• Amazon Linux AMI update for ca-certificates
• Multiple vulnerabilities in IBM Cognos Dashboards on Cloud Pak for Data
• Multiple vulnerabilities in Dell VxRail Appliance
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in Red Hat Ceph Storage 8
• Multiple vulnerabilities in Red Hat Ceph Storage 8
• IBM Storage Ceph update for Certifi