Removal of e-Tugra root certificate
Date: 2023-07
Affected: pip/certifi
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2023-37920
CWE: CWE-345
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store. These are in the process of being removed from Mozilla's trust store. e-Tugra's root certificates are being removed pursuant to an investigation prompted by reporting of security issues in their systems. Conclusions of Mozilla's investigation can be found [here](https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/C-HrP1SEq1A).


Mitigations:

Architectural layers (MAESTRO):