Skip to content

Matched advisory candidates (shard 38) #108

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
p-linnane merged 1 commit into from
Aug 13, 2026
Merged

Matched advisory candidates (shard 38) #108

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
96 changes: 96 additions & 0 deletions advisories/BREW-certifi-CVE-2022-23491.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,96 @@
{
"schema_version": "1.7.3",
"id": "BREW-certifi-CVE-2022-23491",
"published": "2026-08-13T16:39:03Z",
"modified": "2026-08-13T16:39:03Z",
"upstream": [
"CVE-2022-23491",
"GHSA-43fp-rhv2-5gv8",
"PYSEC-2022-42986"
],
"affected": [
{
"package": {
"ecosystem": "Homebrew",
"name": "certifi",
"purl": "pkg:brew/certifi"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.7.22"
}
]
}
],
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"upstream_fixed_in": "2022.12.07"
}
}
],
"database_specific": {
"source": "matched",
"strategy": "git",
"confidence": "high",
"upstream_evidence": [
{
"strategy": "git",
"ecosystem": "GIT",
"name": "https://github.com/certifi/python-certifi",
"subject_version": "2026.7.22",
"key": "https://github.com/certifi/python-certifi"
},
{
"strategy": "registry",
"ecosystem": "PyPI",
"name": "certifi",
"subject_version": "2026.7.22",
"key": "pkg:pypi/certifi@2026.7.22"
},
{
"strategy": "registry",
"ecosystem": "PyPI",
"name": "certifi",
"subject_version": "2026.7.22",
"key": "pkg:pypi/certifi@2026.7.22"
}
]
},
"summary": "Removal of TrustCor root certificate",
"details": "Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from \"TrustCor\" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N"
}
],
"references": [
{
"type": "WEB",
"url": "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ"
},
{
"type": "ADVISORY",
"url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23491.json"
},
{
"type": "ADVISORY",
"url": "https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23491"
},
{
"type": "ADVISORY",
"url": "https://security.netapp.com/advisory/ntap-20230223-0010/"
}
]
}
104 changes: 104 additions & 0 deletions advisories/BREW-certifi-CVE-2023-37920.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,104 @@
{
"schema_version": "1.7.3",
"id": "BREW-certifi-CVE-2023-37920",
"published": "2026-08-13T16:39:03Z",
"modified": "2026-08-13T16:39:03Z",
"upstream": [
"CVE-2023-37920",
"GHSA-xqr8-7jwr-rhp7",
"PYSEC-2023-135"
],
"affected": [
{
"package": {
"ecosystem": "Homebrew",
"name": "certifi",
"purl": "pkg:brew/certifi"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.7.22"
}
]
}
],
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"upstream_fixed_in": "2023.7.22"
}
}
],
"database_specific": {
"source": "matched",
"strategy": "git",
"confidence": "high",
"upstream_evidence": [
{
"strategy": "git",
"ecosystem": "GIT",
"name": "https://github.com/certifi/python-certifi",
"subject_version": "2026.7.22",
"key": "https://github.com/certifi/python-certifi"
},
{
"strategy": "registry",
"ecosystem": "PyPI",
"name": "certifi",
"subject_version": "2026.7.22",
"key": "pkg:pypi/certifi@2026.7.22"
},
{
"strategy": "registry",
"ecosystem": "PyPI",
"name": "certifi",
"subject_version": "2026.7.22",
"key": "pkg:pypi/certifi@2026.7.22"
}
]
},
"summary": "Certifi's removal of e-Tugra root certificate",
"details": "Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes \"e-Tugra\" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from \"e-Tugra\" from the root store.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
}
],
"references": [
{
"type": "WEB",
"url": "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/C-HrP1SEq1A"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EX6NG7WUFNUKGFHLM35KHHU3GAKXRTG/"
},
{
"type": "ADVISORY",
"url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37920.json"
},
{
"type": "ADVISORY",
"url": "https://github.com/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37920"
},
{
"type": "ADVISORY",
"url": "https://security.netapp.com/advisory/ntap-20240912-0002/"
},
{
"type": "FIX",
"url": "https://github.com/certifi/python-certifi/commit/8fb96ed81f71e7097ed11bc4d9b19afd7ea5c909"
}
]
}
107 changes: 107 additions & 0 deletions advisories/BREW-certifi-CVE-2024-39689.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,107 @@
{
"schema_version": "1.7.3",
"id": "BREW-certifi-CVE-2024-39689",
"published": "2026-08-13T16:39:03Z",
"modified": "2026-08-13T16:39:03Z",
"upstream": [
"CVE-2024-39689",
"GHSA-248v-346w-9cwc",
"PYSEC-2024-230"
],
"affected": [
{
"package": {
"ecosystem": "Homebrew",
"name": "certifi",
"purl": "pkg:brew/certifi"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.7.22"
}
]
}
],
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"upstream_fixed_in": "2024.7.4"
}
}
],
"database_specific": {
"source": "matched",
"strategy": "git",
"confidence": "high",
"upstream_evidence": [
{
"strategy": "git",
"ecosystem": "GIT",
"name": "https://github.com/certifi/python-certifi",
"subject_version": "2026.7.22",
"key": "https://github.com/certifi/python-certifi"
},
{
"strategy": "git",
"ecosystem": "GIT",
"name": "https://github.com/certifi/python-certifi",
"subject_version": "2026.7.22",
"key": "https://github.com/certifi/python-certifi"
},
{
"strategy": "registry",
"ecosystem": "PyPI",
"name": "certifi",
"subject_version": "2026.7.22",
"key": "pkg:pypi/certifi@2026.7.22"
},
{
"strategy": "registry",
"ecosystem": "PyPI",
"name": "certifi",
"subject_version": "2026.7.22",
"key": "pkg:pypi/certifi@2026.7.22"
}
]
},
"summary": "Certifi removes GLOBALTRUST root certificate",
"details": "Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.7.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified \"long-running and unresolved compliance issues.\"",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
}
],
"references": [
{
"type": "WEB",
"url": "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI"
},
{
"type": "ADVISORY",
"url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39689.json"
},
{
"type": "ADVISORY",
"url": "https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39689"
},
{
"type": "ADVISORY",
"url": "https://security.netapp.com/advisory/ntap-20241206-0001/"
},
{
"type": "FIX",
"url": "https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463"
}
]
}
Loading