CVE-2022-23491 Removal of TrustCor root certificate
The library included untrusted root certificates from a spyware-linked entity, allowing potential man-in-the-middle attacks until upgraded.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-23491?
CVE-2022-23491 is a medium-severity vulnerability in Netapp E-Series Performance Analyzer, published on 7 Dec 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.
Weakness: CWE-345
Which versions are affected by CVE-2022-23491?
3 open source packages ship an affected version, including certifi. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
certifi PyPI | From 2017.11.05 | 2022.12.07 |
certifi PyPI | From 2017.11.05 | 2022.12.07 |
certifi PyPI | From 2017.11.5 | 2022.12.7 |
Linux distribution packages (26)
python39-certifi Red Hat:ansible_automation_platform:2.3::el8 | All versions | 0:2022.12.7-1.el8ap |
python-certifi SUSE:Enterprise Storage 6 | All versions | 2018.1.18-150000.3.3.1 |
python-certifi SUSE:Enterprise Storage 7 | All versions | 2018.1.18-150000.3.3.1 |
python-certifi SUSE:Enterprise Storage 7.1 | All versions | 2018.1.18-150000.3.3.1 |
python-certifi SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 2018.1.18-150000.3.3.1 |
python-certifi SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 2018.1.18-150000.3.3.1 |
python-certifi SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS | All versions | 2018.1.18-150000.3.3.1 |
python-certifi SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 2018.1.18-150000.3.3.1 |
python-certifi SUSE:Linux Enterprise Micro 5.1 | All versions | 2018.1.18-150000.3.3.1 |
python-certifi SUSE:Linux Enterprise Micro 5.2 | All versions | 2018.1.18-150000.3.3.1 |
python-certifi SUSE:Linux Enterprise Micro 5.3 | All versions | 2018.1.18-150000.3.3.1 |
python-certifi SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 2018.1.18-150000.3.3.1 |
python-certifi SUSE:Linux Enterprise Real Time 15 SP3 | All versions | 2018.1.18-150000.3.3.1 |
python-certifi SUSE:Linux Enterprise Server 15 SP1-LTSS | All versions | 2018.1.18-150000.3.3.1 |
python-certifi SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 2018.1.18-150000.3.3.1 |
python-certifi SUSE:Linux Enterprise Server 15 SP3-LTSS | All versions | 2018.1.18-150000.3.3.1 |
python-certifi SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | All versions | 2018.1.18-150000.3.3.1 |
python-certifi SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | All versions | 2018.1.18-150000.3.3.1 |
python-certifi SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | All versions | 2018.1.18-150000.3.3.1 |
python-certifi SUSE:Manager Proxy 4.2 | All versions | 2018.1.18-150000.3.3.1 |
python-certifi SUSE:Manager Retail Branch Server 4.2 | All versions | 2018.1.18-150000.3.3.1 |
python-certifi SUSE:Manager Server 4.2 | All versions | 2018.1.18-150000.3.3.1 |
python-certifi openSUSE:Leap 15.4 | All versions | 2018.1.18-150000.3.3.1 |
python-certifi openSUSE:Leap Micro 5.2 | All versions | 2018.1.18-150000.3.3.1 |
python-certifi openSUSE:Leap Micro 5.3 | All versions | 2018.1.18-150000.3.3.1 |
python-certifi openSUSE:Tumbleweed | All versions | 2023.7.22-2.1 |
Products include Certifi Certifi, Netapp E-Series Performance Analyzer, Netapp Management Services for Element Software, Netapp Management Services for Netapp Hci.
How do I fix CVE-2022-23491?
Upgrade certifi to a fixed version for your release line: 2022.12.07 or 2022.12.7.
Is CVE-2022-23491 being exploited?
There is no known exploitation of CVE-2022-23491 in the wild and no public exploit code.
Other vulnerabilities in Netapp E-Series Performance Analyzer
Sources
Also known as DEBIAN-CVE-2022-23491, GHSA-43fp-rhv2-5gv8, MGASA-2023-0140, MINI-pc3w-5cf9-23f6, PYSEC-2022-42986, RHBA-2023:0589 and 4 more.