CVE-2023-37920

Critical

Advisory

Published 25 Jul 2023In the index since 5 Sept 2026

Severity: Critical; worst across findings
CVSS: 9.8; base score, highest
EPSS: 0.006; 45th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 610; of 17,787 indexed, latest versions
Container images: 651; deployed by those charts
Fix available: 3 of 5; affected packages

Red Hat Bug Fix Advisory: ca-certificates bug fix and enhancement update

Carried by container images the latest versions of 610 of 17,787 indexed charts deploy, on 651 images.

Affected package	Affected versions	Fixed in	Images
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+19 more	no fix listed	83
python-certifideb	2018.1.18-2, 2019.11.28-1, 2020.6.20-1, 2022.9.24-1	no fix listed	57
py3-certifiapk	2023.5.7-r0	2023.7.22-r0	1
ca-certificatesrpm	2018.2.24-6.el8, 2019.2.32-80.0.el8_1, 2020.2.41-80.0.el8_2, 2021.2.50-80.0.el8_4+8 more	0:2024.2.69_v8.0.303-80.0.el8_10, 0:2024.2.69_v8.0.303-91.4.el9_4	203
certifipypi	2017.11.05, 2017.11.5, 2018.1.18, 2018.4.16+21 more	2023.7.22	427

OSV records: ALPINE-CVE-2023-37920 DEBIAN-CVE-2023-37920 RHBA-2024:5691 RHBA-2024:5736 UBUNTU-CVE-2023-37920 GHSA-xqr8-7jwr-rhp7
Also known as: PYSEC-2023-135

Charts affected

610 by stars

Chart

Latest

Affected images

Radar Score

miniowenerme

8.0.10

1 of 1 See more

minio wenerme 8.0.10

1 of the 1 container images this version deploys carry CVE-2023-37920.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2021-02-14T04-01-33Z	bd11edda91f3	ca-certificates@2020.2.41-80.0.el8_2	0:2024.2.69_v8.0.303-80.0.el8_10

Open the chart page →

6,915

minio-standalonewenerme

1.0.2

1 of 1 See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2023-37920.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2022-01-04T07-41-07Z	1484c87239ea	ca-certificates@2021.2.50-80.0.el8_4	0:2024.2.69_v8.0.303-80.0.el8_10

Open the chart page →

6,138

ceph-csi-cephfswikimedia

0.1.8

1 of 5 See more

ceph-csi-cephfs wikimedia 0.1.8

1 of the 5 container images this version deploys carry CVE-2023-37920.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	certifi@2018.10.15	2023.7.22

Open the chart page →

10,286

ceph-csi-rbdwikimedia

0.1.13

1 of 6 See more

ceph-csi-rbd wikimedia 0.1.13

1 of the 6 container images this version deploys carry CVE-2023-37920.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	certifi@2018.10.15	2023.7.22

Open the chart page →

11,785

docker-hub-rate-limit-exporterwiremind

0.3.0

1 of 1 See more

docker-hub-rate-limit-exporter wiremind 0.3.0

1 of the 1 container images this version deploys carry CVE-2023-37920.

Container image	Digest	Package	Fixed in
viadee/docker-hub-rate-limit-exporter :version-1.5	2e27e3b3ee56	certifi@2020.12.5	2023.7.22

Open the chart page →

1,843

powerdnsadminwitcom-gmbh

0.3.4

1 of 1 See more

powerdnsadmin witcom-gmbh 0.3.4

1 of the 1 container images this version deploys carry CVE-2023-37920.

Container image	Digest	Package	Fixed in
ngoduykhanh/powerdns-admin :v0.2.4	ba36ab196d3d	certifi@2021.10.8	2023.7.22

Open the chart page →

2,643

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2023-37920.

Container image	Digest	Package	Fixed in
quay.io/maximilianopizarro/workshop-pipelines :latest	e383ba3e0966	ca-certificates@2021.2.50-80.0.el8_4	0:2024.2.69_v8.0.303-80.0.el8_10

Open the chart page →

11,592

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2023-37920.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10

Open the chart page →

6,016

enterprise-gatewayzeet

3.2.2

1 of 2 See more

enterprise-gateway zeet 3.2.2

1 of the 2 container images this version deploys carry CVE-2023-37920.

Container image	Digest	Package	Fixed in
elyra/kernel-image-puller :3.2.2	c922f1f1646a	certifi@2022.12.7	2023.7.22

Open the chart page →

1,838

posthogzeet

0.23.2

1 of 9 See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2023-37920.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10

Open the chart page →

3,697

Container images carrying it

651 by charts deploying them

A fixed version is listed for 3 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
voltha/voltha-tester :1.7.0	655c3048a602	python-pip@8.1.1-2ubuntu0.4 certifi@2019.6.16	no fix listed 2023.7.22	1
voltha/voltha-voltha :1.6.0	ff596b62de59	python-pip@8.1.1-2ubuntu0.4 certifi@2018.10.15	no fix listed 2023.7.22	1
wallarm/ingress-python :4.6.0-1	5cb2ae08b40f	certifi@2018.8.24	2023.7.22	1
wazuh/wazuh-manager :4.4.1	21994f40e0da	certifi@2022.12.7	2023.7.22	1
weblate/weblate :3.11.3-1	82848df56ecd	certifi@2019.11.28	2023.7.22	1
wiremind/pghoard :12-2019-11-26	4dea42c8166c	certifi@2019.9.11	2023.7.22	1
witcherek7/pav :0.0.3	42a744f29ac0	certifi@2022.12.7	2023.7.22	1
xeladock/mysql_dns :latest	4baf531453f1	python-pip@22.0.2+dfsg-1	no fix listed	1
zohardocker12/weather_app_flask :latest	b86d60dbb68d	certifi@2021.10.8	2023.7.22	1
gcr.io/google-samples/microservices-demo/loadgenerator :v0.2.3	360130ab5850	certifi@2020.12.5	2023.7.22	1
gcr.io/google-samples/microservices-demo/recommendationservice :v0.2.3	5f60c4988859	certifi@2020.12.5	2023.7.22	1
gcr.io/ml-pipeline/metadata-writer :2.0.0-alpha.5	ec3ae9f6df47	certifi@2021.10.8	2023.7.22	1
ghcr.io/avistotelecom/docker-wazuh-agent :4.12.0	8766ba08bf1a	python-certifi@2022.9.24-1 certifi@2022.9.24	no fix listed 2023.7.22	1
ghcr.io/aws-exporters/prometheus-ecr-exporter :0.1.4	42b0c87470d6	certifi@2020.12.5	2023.7.22	1
ghcr.io/aws-exporters/prometheus-inspector-exporter :0.0.2	9c7c11293b3c	certifi@2020.12.5	2023.7.22	1
ghcr.io/blakeblackshear/frigate :0.12.0	c862771e38e8	certifi@2022.12.7	2023.7.22	1
ghcr.io/brittonhayes/arma-reforger :latest	6fde1edc0983	python-certifi@2019.11.28-1 certifi@2019.11.28	no fix listed 2023.7.22	1
ghcr.io/cloudnative-pg/postgresql :14.5	b3b30d04b362	certifi@2022.9.24	2023.7.22	1
ghcr.io/ctron/ditto-operator :0.4.0	61a9bb81b85c	ca-certificates@2021.2.50-80.0.el8_4	0:2024.2.69_v8.0.303-80.0.el8_10	1
ghcr.io/ctron/kubectl :1.25	e37d61b5277c	ca-certificates@2023.2.60_v7.0.306-80.0.el8_8	0:2024.2.69_v8.0.303-80.0.el8_10	1
ghcr.io/ctron/streamsheets-base :2.4.0	0cf25ed621e2	ca-certificates@2020.2.41-80.0.el8_2	0:2024.2.69_v8.0.303-80.0.el8_10	1
ghcr.io/ctron/streamsheets-gateway :2.4.0	0635f17c9d2c	ca-certificates@2020.2.41-80.0.el8_2	0:2024.2.69_v8.0.303-80.0.el8_10	1
ghcr.io/ctron/streamsheets-service-graphs :2.4.0	e34964e336c1	ca-certificates@2020.2.41-80.0.el8_2	0:2024.2.69_v8.0.303-80.0.el8_10	1
ghcr.io/ctron/streamsheets-service-machines :2.4.0	0c5a3398d1e4	ca-certificates@2020.2.41-80.0.el8_2	0:2024.2.69_v8.0.303-80.0.el8_10	1
ghcr.io/ctron/streamsheets-service-streams :2.4.0	8ba040e79ca0	ca-certificates@2020.2.41-80.0.el8_2	0:2024.2.69_v8.0.303-80.0.el8_10	1
ghcr.io/cunningpike/fediblockhole :0.4.2	2abc5f0350dc	certifi@2022.12.7	2023.7.22	1
ghcr.io/dgtlmoon/changedetection.io :0.39.4	f1ce4c56ccaa	certifi@2021.10.8	2023.7.22	1
ghcr.io/dodevops/azure-advanced-backup :0.4.0	1041d4449e49	certifi@2021.10.8	2023.7.22	1
ghcr.io/drogue-iot/authentication-service :0.11.0	857b137fc7b3	ca-certificates@2022.2.54-90.2.el9_0	0:2024.2.69_v8.0.303-91.4.el9_4	1
ghcr.io/drogue-iot/coap-endpoint :0.11.0	44790b71aa22	ca-certificates@2022.2.54-90.2.el9_0	0:2024.2.69_v8.0.303-91.4.el9_4	1
ghcr.io/drogue-iot/command-endpoint :0.11.0	6dce3158b851	ca-certificates@2022.2.54-90.2.el9_0	0:2024.2.69_v8.0.303-91.4.el9_4	1
ghcr.io/drogue-iot/console-backend :0.11.0	25d229ae5bde	ca-certificates@2022.2.54-90.2.el9_0	0:2024.2.69_v8.0.303-91.4.el9_4	1
ghcr.io/drogue-iot/console-frontend :0.11.0	558972f9374c	ca-certificates@2022.2.54-90.2.el9_0	0:2024.2.69_v8.0.303-91.4.el9_4	1
ghcr.io/drogue-iot/database-migration :0.11.0	57072c72a7cd	ca-certificates@2022.2.54-90.2.el9_0	0:2024.2.69_v8.0.303-91.4.el9_4	1
ghcr.io/drogue-iot/device-management-controller :0.11.0	200aea1a2b42	ca-certificates@2022.2.54-90.2.el9_0	0:2024.2.69_v8.0.303-91.4.el9_4	1
ghcr.io/drogue-iot/device-management-service :0.11.0	f4a5bfc06a74	ca-certificates@2022.2.54-90.2.el9_0	0:2024.2.69_v8.0.303-91.4.el9_4	1
ghcr.io/drogue-iot/device-state-service :0.11.0	fbf0738cfc7e	ca-certificates@2022.2.54-90.2.el9_0	0:2024.2.69_v8.0.303-91.4.el9_4	1
ghcr.io/drogue-iot/drogue-event-source :0.2.1	e2e812a4cf8e	ca-certificates@2021.2.50-80.0.el8_4	0:2024.2.69_v8.0.303-80.0.el8_10	1
ghcr.io/drogue-iot/http-endpoint :0.11.0	b612c18479e0	ca-certificates@2022.2.54-90.2.el9_0	0:2024.2.69_v8.0.303-91.4.el9_4	1
ghcr.io/drogue-iot/knative-operator :0.11.0	e2d927639f6e	ca-certificates@2022.2.54-90.2.el9_0	0:2024.2.69_v8.0.303-91.4.el9_4	1
ghcr.io/drogue-iot/mqtt-endpoint :0.11.0	32c6d2f5eab9	ca-certificates@2022.2.54-90.2.el9_0	0:2024.2.69_v8.0.303-91.4.el9_4	1
ghcr.io/drogue-iot/mqtt-integration :0.11.0	7ac2adb6ca49	ca-certificates@2022.2.54-90.2.el9_0	0:2024.2.69_v8.0.303-91.4.el9_4	1
ghcr.io/drogue-iot/outbox-controller :0.11.0	1a958edafdb1	ca-certificates@2022.2.54-90.2.el9_0	0:2024.2.69_v8.0.303-91.4.el9_4	1
ghcr.io/drogue-iot/postgresql-pusher :0.2.1	c6bb121ced90	ca-certificates@2021.2.50-80.0.el8_4	0:2024.2.69_v8.0.303-80.0.el8_10	1
ghcr.io/drogue-iot/test-cert-generator :0.11.0	6ba7e1608286	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10	1
ghcr.io/drogue-iot/topic-strimzi-operator :0.11.0	5253fbf8d04c	ca-certificates@2022.2.54-90.2.el9_0	0:2024.2.69_v8.0.303-91.4.el9_4	1
ghcr.io/drogue-iot/ttn-operator :0.11.0	7dd5ac80c8f1	ca-certificates@2022.2.54-90.2.el9_0	0:2024.2.69_v8.0.303-91.4.el9_4	1
ghcr.io/drogue-iot/user-auth-service :0.11.0	adebc40ddf98	ca-certificates@2022.2.54-90.2.el9_0	0:2024.2.69_v8.0.303-91.4.el9_4	1
ghcr.io/drogue-iot/websocket-integration :0.11.0	372dcd370945	ca-certificates@2022.2.54-90.2.el9_0	0:2024.2.69_v8.0.303-91.4.el9_4	1
ghcr.io/grofers/legend :0.1	d6e901ad0ebd	certifi@2020.6.20	2023.7.22	1