Tóm tắt nhanh
- CVE-2022-23491 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng certifi, certifi (certifi).
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.53%, cao hơn 44.8% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 2022.12.07, 2022.12.7 hoặc mới hơn.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|
| certifi PyPI | ≥ 2017.11.05, < 2022.12.07≥ 2017.11.5, < 2022.12.7
| 2022.12.072022.12.7
|
| certifi | ≥ 2017.11.5, < 2022.12.7
| 2022.12.7
|
Mô tả
Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store.
TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found here.
Mô tả của NVD
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí