CVE-2022-23491: Removal of TrustCor root certificate
An unspecified error in with TrustCor's ownership also operated a business that produced spyware in Certifi has an unknown impact and attack vector.
Other sources
Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store.
TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found here.
— GitHub
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-23491?
The severity of CVE-2022-23491 is currently unspecified due to inadequate details about its impact and attack vector.
How do I fix CVE-2022-23491?
To mitigate CVE-2022-23491, update the Certifi package to version 2022.12.07 or later.
What software is affected by CVE-2022-23491?
CVE-2022-23491 affects Certifi versions between 2017.11.05 and 2022.12.07, as well as IBM Cognos Dashboards on Cloud Pak for Data versions up to 5.0.0.
What is the impact of the vulnerability CVE-2022-23491?
The impact of CVE-2022-23491 is unknown, but it relates to root certificates being removed from the trust store.
When was CVE-2022-23491 disclosed?
CVE-2022-23491 was disclosed on December 7, 2022.