Insufficient verification of data authenticity in python-certifi - CVE-2023-37920

Vulnerability identifier: #VU79296

CSH Severity: Medium

CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-37920

CWE-ID: CWE-345

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exist due to software recognizes "e-Tugra" root certificates, which were subject to an investigation prompted by reporting of security issues in their systems. An attacker with ability to generate certificates signed with the  compromised "e-Tugra" root certificate can perform MitM attack.

python-certifi
QRadar App SDK
Guardium Data Security Center (GDSC)
Oracle Communications Operations Monitor
webMethods Managed File Transfer
IBM Application Suite - IBM Asset Data Dictionary Component
Storage Defender - Resiliency Service
Cinder Plug-in
IBM Cloud Pak for Watson AIOps
Cognos Dashboards on Cloud Pak for Data
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
watsonx Assistant Cartridge
SOAR QRadar Plugin App
Storage Protect Plus Container Agent
IBM Netezza for Cloud Pak for Data
Robotic Process Automation for Cloud Pak
Amazon Linux AMI
IBM AIX
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Anolis OS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
openEuler
Fedora
Oracle Solaris
IBM VIOS
Submariner
IBM Cloud Pak for Security
IBM Cloud Transformation Advisor
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Maximo Application Suite
IBM Cloud Pak for Business Automation
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Network Repository Function
IBM Observability with Instana
Multicluster GlobalHub
IBM Cloud Pak for Data System
IBM Fusion HCI
Red Hat Advanced Cluster Management for Kubernetes
Red Hat OpenShift Dev Spaces
IBM Cloud Object Storage Systems
QRadar User Behavior Analytics
Splunk Add-on for Google Cloud Platform
IBM Decision Optimization for Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
App Connect Enterprise Certified Container
OpenShift Logging
Splunk Add-on for Amazon Web Services
IBM Spectrum Protect Plus
Red Hat OpenStack
Voice Gateway
QRadar Suite
Juniper Secure Analytics (JSA)
Splunk Enterprise
Intel In-Band Manageability
Python for Scientific Computing
MySQL Cluster
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
fence-agents (Red Hat package)
fence-agents-emerson
fence-agents-apc-snmp
fence-agents-eaton-snmp
fence-agents-drac5
fence-agents-common
fence-agents-cisco-ucs
fence-agents-cisco-mds
fence-agents-brocade
fence-agents-bladecenter
fence-agents-all
fence-agents-kdump
fence-agents-kubevirt
fence-agents-redfish
fence-agents-aliyun
fence-agents-aws
fence-agents-azure-arm
fence-agents-gce
fence-virt
fence-virtd
fence-virtd-cpg
fence-virtd-libvirt
fence-virtd-multicast
fence-virtd-serial
fence-virtd-tcp
ha-cloud-support
fence-agents-amt-ws
fence-agents-apc
fence-agents-heuristics-ping
fence-agents-wti
fence-agents-vmware-soap
fence-agents-vmware-rest
fence-agents-virsh
fence-agents-scsi
fence-agents-sbd
fence-agents-rsb
fence-agents-rsa
fence-agents-rhevm
fence-agents-mpath
fence-agents-lpar
fence-agents-ipmilan
fence-agents-ipdu
fence-agents-intelmodular
fence-agents-ilo2
fence-agents-ilo-ssh
fence-agents-ilo-mp
fence-agents-ilo-moonshot
fence-agents-ifmib
fence-agents-ibmblade
fence-agents-ibm-vpc
fence-agents-ibm-powervs
fence-agents-hpblade
fence-agents-eps
ca-certificates
python-certifi
python3-certifi-doc
python3-certifi
python-certifi-help
mingw-python-certifi
Oracle Communications Cloud Native Core Service Communication Proxy
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Policy
OpenShift API for Data Protection (OADP)
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
Red Hat OpenShift GitOps
Multicluster Engine for Kubernetes
OpenShift Virtualization
IBM Storage Scale System
IBM Qradar SIEM
Operational Decision Manager
IBM Cognos Analytics
Dell EMC VxRail Appliance

Install updates from vendor's website.

python-certifi - update to 2023.07.22
Submariner - addressed in versions 0.16.8, 0.18.5
Voice Gateway - update to 1.0.8.12
IBM Cloud Pak for Security - update to 1.11.3.0
QRadar Suite - update to 1.11.3.0
IBM Cloud Transformation Advisor - update to 3.10.2
QRadar App SDK - update to 2.2.1
Intel In-Band Manageability - update to 4.2.0
Guardium Data Security Center (GDSC) - update to 3.6.1
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.8.0
Python for Scientific Computing - update to 4.2.1
Juniper Secure Analytics (JSA) - addressed in versions 7.5.0 UP7 IF04, 7.5.0 UP7 IF05, 7.5.0 UP11 IF03
MySQL Cluster - update to 8.2.0
IBM Maximo Application Suite - update to 8.10.5
Splunk Enterprise - addressed in versions 9.0.8, 9.0.9, 9.1.3, 9.1.4, 9.2.1
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.26, 23.0.1.4
IBM Observability with Instana - update to 286
IBM Application Suite - IBM Asset Data Dictionary Component - update to 1.1.6
Multicluster GlobalHub - update to 1.2.1
OpenShift API for Data Protection (OADP) - update to 1.3.4
Migration Toolkit for Containers - update to 1.8.5
Red Hat OpenShift GitOps - addressed in versions 1.12.6, 1.13.2
IBM Cloud Pak for Data System - update to 2.0.2.1.IF2
Storage Defender - Resiliency Service - update to 2.0.9
Multicluster Engine for Kubernetes - addressed in versions 2.3.8, 2.4.6, 2.5.8, 2.6.4, 2.6.7, 2.7.2, 2.7.4
IBM Fusion HCI - update to 2.7.1
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.8.8, 2.9.5, 2.10.8, 2.11.4, 2.11.7, 2.12.0, 2.12.1, 2.12.3
Cinder Plug-in - update to 3.6
Red Hat OpenShift Dev Spaces - update to 3.17.0
IBM Cloud Object Storage Systems - update to 3.17.5.79
QRadar User Behavior Analytics - update to 4.1.13
IBM Cloud Pak for Watson AIOps - update to 4.2.0
fence-agents (Red Hat package) - addressed in versions 4.2.1-30.el8_1.10, 4.2.1-65.el8_4.13, 4.2.1-112.el8_8.2, 4.2.1-121.el8_9.2, 4.10.0-43.el9_2.2, 4.10.0-55.el9_3.2
Splunk Add-on for Google Cloud Platform - update to 4.3.0
IBM Decision Optimization for Cloud Pak for Data - update to 4.7.2
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.7.3
fence-agents-emerson - update to 4.10.0-62.0.1
fence-agents-apc-snmp - update to 4.10.0-62.0.1
fence-agents-eaton-snmp - update to 4.10.0-62.0.1
fence-agents-drac5 - update to 4.10.0-62.0.1
fence-agents-common - update to 4.10.0-62.0.1
fence-agents-cisco-ucs - update to 4.10.0-62.0.1
fence-agents-cisco-mds - update to 4.10.0-62.0.1
fence-agents-brocade - update to 4.10.0-62.0.1
fence-agents-bladecenter - update to 4.10.0-62.0.1
fence-agents-all - update to 4.10.0-62.0.1
fence-agents-kdump - update to 4.10.0-62.0.1
fence-agents-kubevirt - update to 4.10.0-62.0.1
fence-agents-redfish - update to 4.10.0-62.0.1
fence-agents-aliyun - update to 4.10.0-62.0.1
fence-agents-aws - update to 4.10.0-62.0.1
fence-agents-azure-arm - update to 4.10.0-62.0.1
fence-agents-gce - update to 4.10.0-62.0.1
fence-virt - update to 4.10.0-62.0.1
fence-virtd - update to 4.10.0-62.0.1
fence-virtd-cpg - update to 4.10.0-62.0.1
fence-virtd-libvirt - update to 4.10.0-62.0.1
fence-virtd-multicast - update to 4.10.0-62.0.1
fence-virtd-serial - update to 4.10.0-62.0.1
fence-virtd-tcp - update to 4.10.0-62.0.1
ha-cloud-support - update to 4.10.0-62.0.1
fence-agents-amt-ws - update to 4.10.0-62.0.1
fence-agents-apc - update to 4.10.0-62.0.1
fence-agents-heuristics-ping - update to 4.10.0-62.0.1
fence-agents-wti - update to 4.10.0-62.0.1
fence-agents-vmware-soap - update to 4.10.0-62.0.1
fence-agents-vmware-rest - update to 4.10.0-62.0.1
fence-agents-virsh - update to 4.10.0-62.0.1
fence-agents-scsi - update to 4.10.0-62.0.1
fence-agents-sbd - update to 4.10.0-62.0.1
fence-agents-rsb - update to 4.10.0-62.0.1
fence-agents-rsa - update to 4.10.0-62.0.1
fence-agents-rhevm - update to 4.10.0-62.0.1
fence-agents-mpath - update to 4.10.0-62.0.1
fence-agents-lpar - update to 4.10.0-62.0.1
fence-agents-ipmilan - update to 4.10.0-62.0.1
fence-agents-ipdu - update to 4.10.0-62.0.1
fence-agents-intelmodular - update to 4.10.0-62.0.1
fence-agents-ilo2 - update to 4.10.0-62.0.1
fence-agents-ilo-ssh - update to 4.10.0-62.0.1
fence-agents-ilo-mp - update to 4.10.0-62.0.1
fence-agents-ilo-moonshot - update to 4.10.0-62.0.1
fence-agents-ifmib - update to 4.10.0-62.0.1
fence-agents-ibmblade - update to 4.10.0-62.0.1
fence-agents-ibm-vpc - update to 4.10.0-62.0.1
fence-agents-ibm-powervs - update to 4.10.0-62.0.1
fence-agents-hpblade - update to 4.10.0-62.0.1
fence-agents-eps - update to 4.10.0-62.0.1
OpenShift Virtualization - update to 4.13.11
Red Hat OpenShift Container Platform - addressed in versions 4.16.44, 4.17.2
App Connect Enterprise Certified Container - addressed in versions 5.0.10, 9.2.0
Cognos Dashboards on Cloud Pak for Data - update to 5.1
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.1.1
watsonx Assistant Cartridge - update to 5.1.1
IBM Storage Scale System - addressed in versions 5.1.2.14, 5.1.9.0
SOAR QRadar Plugin App - update to 5.3.1
OpenShift Logging - update to 5.6.25
Splunk Add-on for Amazon Web Services - update to 7.2.0
IBM Qradar SIEM - update to 7.5.0 Update Pack 7 IF05
Operational Decision Manager - addressed in versions 8.10.5.1 Interim fix 49, 8.11.0.1 Interim fix 26, 8.12.0 Interim fix 8
Dell EMC VxRail Appliance - update to 8.320
Storage Protect Plus Container Agent - update to 10.1.12.7
IBM Spectrum Protect Plus - update to 10.1.15.2
IBM Netezza for Cloud Pak for Data - update to 11.2.3.3
IBM Cognos Analytics - addressed in versions 11.2.4 IF5, 12.0.4 IF2
Oracle Solaris - update to 11.4 SRU 71
Red Hat OpenStack - update to 16.2
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.11, 23.0.12
ca-certificates - addressed in versions 2018.2.22-65.1.31, 2023.2.60-1.0
python-certifi - update to 2023.7.22-1
python3-certifi-doc - update to 2023.07.22-1
python3-certifi - update to 2023.07.22-1
python3-certifi - update to 2023.7.22-1
python-certifi-help - update to 2023.7.22-1
mingw-python-certifi - update to 2023.7.22-1.fc38

• https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/C-HrP1SEq1A
• https://github.com/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp7
• https://github.com/certifi/python-certifi/commit/8fb96ed81f71e7097ed11bc4d9b19afd7ea5c909

• Insufficient verification of data authenticity in python-certifi
• Fedora 38 update for mingw-python-certifi
• Insufficient verification of data authenticity in IBM Decision Optimization for Cloud Pak for Data
• Insufficient verification of data authenticity in IBM App Connect Enterprise Certified Container
• Amazon Linux AMI update for ca-certificates
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Multiple vulnerabilities in IBM Spectrum Protect Plus File Systems Agent
• Insufficient verification of data authenticity in IBM Cloud Object Storage Systems
• Insufficient verification of data authenticity in IBM Watson Discovery for IBM Cloud Pak for Data
• Insufficient verification of data authenticity in IBM Maximo Application Suite - Monitor Component
• Red Hat Enterprise Linux 8 update for fence-agents
• Insufficient verification of data authenticity in IBM Storage Scale
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Splunk Add-on for Amazon Web Services update for python-certifi
• Multiple vulnerabilities in Splunk Add-on for Google Cloud Platform
• Red Hat Enterprise Linux 9.2 Extended Update Support update for fence-agents
• Red Hat Enterprise Linux 8 update for fence-agents
• Red Hat Enterprise Linux 8.8 Extended Update Support update for fence-agents
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Insufficient verification of data authenticity in IBM Cinder Plug-in
• Red Hat Enterprise Linux 9 update for fence-agents
• Multiple vulnerabilities in IBM AIX and IBM VIOS
• Multiple vulnerabilities in IBM Storage Fusion HCI
• Multiple vulnerabilities in IBM Operational Decision Manager
• Red Hat Enterprise Linux 8 update for fence-agents
• Splunk Enterprise update for third-party components
• Multiple vulnerabilities in Intel In-Band Manageability Framework
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Multiple vulnerabilities in IBM SOAR QRadar Plugin App
• Juniper Networks Juniper Secure Analytics update for third-party applications
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• openEuler update for python-certifi
• Insufficient verification of data authenticity in IBM Asset Data Dictionary Component
• Multiple vulnerabilities in IBM QRadar App SDK
• Multiple vulnerabilities in IBM Storage Protect Plus Container Agent
• Splunk Enterprise update for third-party components
• Oracle Solaris update for thrid-party components
• Multiple vulnerabilities in Oracle Communications Operations Monitor
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Service Communication Proxy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Security Edge Protection Proxy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Repository Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
• Multiple vulnerabilities in MySQL Cluster
• Splunk Python for Scientific Computing update for third-party packages
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in OpenShift Logging 5.6
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.4
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.9
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.13
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.12
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.12
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP) 1.3
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.3
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.8
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces 3.17
• Multiple vulnerabilities in OpenShift Virtualization 4.13
• IBM Storage Defender - Resiliency Service update for Certifi
• Multiple vulnerabilities in IBM Observability with Instana
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.7
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.12
• Multiple vulnerabilities in Red Hat OpenStack 16.2 packages
• Multiple vulnerabilities in Migration Toolkit for Containers 1.8
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.6
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.11
• Multiple vulnerabilities in IBM Netezza for Cloud Pak for Data (on Cloud)
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.5
• Multiple vulnerabilities in Guardium Data Security Center
• Multiple vulnerabilities in Submariner
• Multiple vulnerabilities in Multicluster GlobalHub 1.2
• Multiple vulnerabilities in IBM Cognos Analytics
• Amazon Linux AMI update for ca-certificates
• IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component update for Certifi
• Multiple vulnerabilities in IBM Cognos Dashboards on Cloud Pak for Data
• Anolis OS update for python-certifi
• Anolis OS update for fence-agents
• Multiple vulnerabilities in Dell VxRail Appliance
• IBM Cloud Pak for Data System 2.0 update for Certifi
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.7
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.12
• Multiple vulnerabilities in IBM webMethods Managed File Transfer
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.10
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.6
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.11
• Multiple vulnerabilities in Submariner 0.18
• Juniper Secure Analytics update for third-party components
• Multiple vulnerabilities in IBM Voice Gateway
• Multiple vulnerabilities in IBM Cloud Pak for Security and IBM QRadar Suite Software
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16