WaratekVRT Sign in

CVE-2022-23491 Certifi

Affected softwareCertifi
Severity7.5 High CVSS 3.1 2 scores
WeaknessCWE-345
Published7 Dec 2022
Updated17 Jun 2026

Description

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 3 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 0.54% chance in 30 days

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

7.5 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N NVD Primary published
CVSS 3.1 6.8 MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N security-advisories@github.com Secondary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2024 ↗ CPU 2024-Q2 Oracle Fusion Middleware / WLST (Python) (14.1.1.0.0)
Oracle Critical Patch Update October 2023 ↗ CPU 2023-Q4 Oracle Database Server / OML4Py (cryptography) (21.3-21.11)
Oracle Fusion Middleware / Centralized Thirdparty Jars (Python) (14.1.1.0.0)
Oracle Critical Patch Update July 2023 ↗ CPU 2023-Q3 Oracle PeopleSoft / Porting (Certifi) (8.59, 8.60)
Oracle Critical Patch Update April 2023 ↗ CPU 2023-Q2 Oracle Communications / Installation (Certifi) (22.3.1, 22.4.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications Installation (Certifi) 22.3.1, 22.4.0 22.3.1 · 22.4.0
Oracle Database Server OML4Py (cryptography) 21.3-21.11
Oracle Fusion Middleware Centralized Thirdparty Jars (Python) 14.1.1.0.0 14.1.1.0.0
Oracle Fusion Middleware WLST (Python) 14.1.1.0.0 14.1.1.0.0
Oracle PeopleSoft Porting (Certifi) 8.59, 8.60 8.59 · 8.60

Products and versions

4 products, 4 version entries
SourceVendorProductSchemeAffected versions
nvd certifi certifi generic ≥ 2017.11.5 and ＜ 2022.12.7
nvd netapp e-series performance analyzer generic any version
nvd netapp management services for element software generic any version
nvd netapp management services for netapp hci generic any version

References

URLTags
https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8 Third Party Advisory
https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ Mailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20230223-0010/ Third Party Advisory

Timeline
Published2022-12-07By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.