CVE-2023-37920

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store.

• CWE-345
• CWE-345

• https://github.com/certifi/python-certifi/commit/8fb96ed81f71e7097ed11bc4d9b19afd7ea5c909Patch
• https://github.com/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp7Vendor Advisory
• https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/C-HrP1SEq1AMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EX6NG7WUFNUKGFHLM35KHHU3GAKXRTG/Mailing List
• https://github.com/certifi/python-certifi/commit/8fb96ed81f71e7097ed11bc4d9b19afd7ea5c909Patch
• https://github.com/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp7Vendor Advisory
• https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/C-HrP1SEq1AMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EX6NG7WUFNUKGFHLM35KHHU3GAKXRTG/Mailing List
• https://security.netapp.com/advisory/ntap-20240912-0002/Third Party Advisory

Published

Jul 25, 2023

Last Modified

Jun 17, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-37915OpenDDS is an open source C++ implementation of the Object M…7.5
• CVE-2023-37916KubePi is an opensource kubernetes management panel. The end…7.5
• CVE-2023-37917KubePi is an opensource kubernetes management panel. A norma…8.8
• CVE-2023-37918Dapr is a portable, event-driven, runtime for building distr…7.5
• CVE-2023-37919Cal.com is open-source scheduling software. A vulnerability …5.4
• CVE-2023-3792A vulnerability was found in Beijing Netcon NS-ASG 6.3. It h…6.5
• CVE-2023-37921Multiple arbitrary write vulnerabilities exist in the VCD so…7.8
• CVE-2023-37922Multiple arbitrary write vulnerabilities exist in the VCD so…7.8
• CVE-2023-37923Multiple arbitrary write vulnerabilities exist in the VCD so…7.8
• CVE-2023-37924Apache Software Foundation Apache Submarine has an SQL injec…9.8
• CVE-2023-37925An improper privilege management vulnerability in the debug …5.5
• CVE-2023-37926A buffer overflow vulnerability in the Zyxel ATP series firm…5.5