{"id":"CVE-2023-37920","aliases":["GHSA-xqr8-7jwr-rhp7","PYSEC-2023-135"],"title":"Removal of e-Tugra root certificate","summary":"Removal of e-Tugra root certificate","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","vendor":"certifi","product":"certifi","ecosystem":"pip","affected":["certifi >= 2015.4.28, < 2023.7.22"],"patched":["certifi 2023.7.22"],"published":"2023-07-25","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:08.653753752Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-xqr8-7jwr-rhp7","references":[{"url":"https://github.com/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp7"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37920"},{"url":"https://github.com/certifi/python-certifi/commit/8fb96ed81f71e7097ed11bc4d9b19afd7ea5c909"},{"url":"https://github.com/certifi/python-certifi"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/certifi/PYSEC-2023-135.yaml"},{"url":"https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/C-HrP1SEq1A"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EX6NG7WUFNUKGFHLM35KHHU3GAKXRTG"},{"url":"https://security.netapp.com/advisory/ntap-20240912-0002"}],"tags":["osv","pip"],"epss":0.00568,"epssPercentile":0.44642,"ingestedAt":"2026-09-12T03:13:01.741Z","slug":"CVE-2023-37920","body":"## Overview\n\nCertifi 2023.07.22 removes root certificates from \"e-Tugra\" from the root store. These are in the process of being removed from Mozilla's trust store.\n\n e-Tugra's root certificates are being removed pursuant to an investigation prompted by reporting of security issues in their systems. Conclusions of Mozilla's investigation can be found [here](https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/C-HrP1SEq1A).\n\n## Affected packages\n\n- `certifi >= 2015.4.28, < 2023.7.22`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `certifi 2023.7.22`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}