CVE-2022-23491 (Medium) detected in certifi-2021.5.30-py2.py3-none-any.whl #576
Labels
Mend: dependency security vulnerability
Security vulnerability detected by WhiteSource
Comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
CVE-2022-23491 - Medium Severity Vulnerability
Python package for providing Mozilla's CA Bundle.
Library home page: https://files.pythonhosted.org/packages/05/1b/0a0dece0e8aa492a6ec9e4ad2fe366b511558cdc73fd3abc82ba7348e875/certifi-2021.5.30-py2.py3-none-any.whl
Path to dependency file: /tools/docker/indy-testnet/validator/requirements.txt
Path to vulnerable library: /tools/docker/indy-testnet/validator/requirements.txt
Dependency Hierarchy:
Found in base branch: master
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.
Publish Date: 2022-12-07
URL: CVE-2022-23491
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: