CVE-2023-37920

Critical

Advisory

Published 25 Jul 2023In the index since 5 Sept 2026

Severity: Critical; worst across findings
CVSS: 9.8; base score, highest
EPSS: 0.006; 45th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 610; of 17,787 indexed, latest versions
Container images: 651; deployed by those charts
Fix available: 3 of 5; affected packages

Red Hat Bug Fix Advisory: ca-certificates bug fix and enhancement update

Carried by container images the latest versions of 610 of 17,787 indexed charts deploy, on 651 images.

Affected package	Affected versions	Fixed in	Images
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+19 more	no fix listed	83
python-certifideb	2018.1.18-2, 2019.11.28-1, 2020.6.20-1, 2022.9.24-1	no fix listed	57
py3-certifiapk	2023.5.7-r0	2023.7.22-r0	1
ca-certificatesrpm	2018.2.24-6.el8, 2019.2.32-80.0.el8_1, 2020.2.41-80.0.el8_2, 2021.2.50-80.0.el8_4+8 more	0:2024.2.69_v8.0.303-80.0.el8_10, 0:2024.2.69_v8.0.303-91.4.el9_4	203
certifipypi	2017.11.05, 2017.11.5, 2018.1.18, 2018.4.16+21 more	2023.7.22	427

OSV records: ALPINE-CVE-2023-37920 DEBIAN-CVE-2023-37920 RHBA-2024:5691 RHBA-2024:5736 UBUNTU-CVE-2023-37920 GHSA-xqr8-7jwr-rhp7
Also known as: PYSEC-2023-135

Charts affected

610 by stars

Chart

Latest

Affected images

Radar Score

miniowenerme

8.0.10

1 of 1 See more

minio wenerme 8.0.10

1 of the 1 container images this version deploys carry CVE-2023-37920.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2021-02-14T04-01-33Z	bd11edda91f3	ca-certificates@2020.2.41-80.0.el8_2	0:2024.2.69_v8.0.303-80.0.el8_10

Open the chart page →

6,915

minio-standalonewenerme

1.0.2

1 of 1 See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2023-37920.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2022-01-04T07-41-07Z	1484c87239ea	ca-certificates@2021.2.50-80.0.el8_4	0:2024.2.69_v8.0.303-80.0.el8_10

Open the chart page →

6,138

ceph-csi-cephfswikimedia

0.1.8

1 of 5 See more

ceph-csi-cephfs wikimedia 0.1.8

1 of the 5 container images this version deploys carry CVE-2023-37920.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	certifi@2018.10.15	2023.7.22

Open the chart page →

10,286

ceph-csi-rbdwikimedia

0.1.13

1 of 6 See more

ceph-csi-rbd wikimedia 0.1.13

1 of the 6 container images this version deploys carry CVE-2023-37920.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	certifi@2018.10.15	2023.7.22

Open the chart page →

11,785

docker-hub-rate-limit-exporterwiremind

0.3.0

1 of 1 See more

docker-hub-rate-limit-exporter wiremind 0.3.0

1 of the 1 container images this version deploys carry CVE-2023-37920.

Container image	Digest	Package	Fixed in
viadee/docker-hub-rate-limit-exporter :version-1.5	2e27e3b3ee56	certifi@2020.12.5	2023.7.22

Open the chart page →

1,843

powerdnsadminwitcom-gmbh

0.3.4

1 of 1 See more

powerdnsadmin witcom-gmbh 0.3.4

1 of the 1 container images this version deploys carry CVE-2023-37920.

Container image	Digest	Package	Fixed in
ngoduykhanh/powerdns-admin :v0.2.4	ba36ab196d3d	certifi@2021.10.8	2023.7.22

Open the chart page →

2,643

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2023-37920.

Container image	Digest	Package	Fixed in
quay.io/maximilianopizarro/workshop-pipelines :latest	e383ba3e0966	ca-certificates@2021.2.50-80.0.el8_4	0:2024.2.69_v8.0.303-80.0.el8_10

Open the chart page →

11,592

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2023-37920.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10

Open the chart page →

6,016

enterprise-gatewayzeet

3.2.2

1 of 2 See more

enterprise-gateway zeet 3.2.2

1 of the 2 container images this version deploys carry CVE-2023-37920.

Container image	Digest	Package	Fixed in
elyra/kernel-image-puller :3.2.2	c922f1f1646a	certifi@2022.12.7	2023.7.22

Open the chart page →

1,838

posthogzeet

0.23.2

1 of 9 See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2023-37920.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10

Open the chart page →

3,697

Container images carrying it

651 by charts deploying them

A fixed version is listed for 3 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/flomesh/osm-edge-injector-ubi8 :1.2.1	8e9c39c34e89	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/flomesh/osm-edge-preinstall-ubi8 :1.2.1	f94282a9cfec	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/flomesh/pipy-repo-ubi8 :0.70.0-46	9912fdf6c183	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/flomesh/pipy-ubi8 :0.50.0-88	24352dca6672	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/flomesh/pipy-ubi8 :0.70.0-46	35d87a381432	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/flomesh/toolbox-ubi8 :1.2.0	1f5e3161cb84	ca-certificates@2023.2.60_v7.0.306-80.0.el8_8	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/ibmgaragecloud/cli-tools :v0.15	9663f06adcb1	certifi@2021.10.8	2023.7.22	1
quay.io/ibmgaragecloud/developer-dashboard :v1.4.4	7a4b9fedc724	ca-certificates@2020.2.41-80.0.el8_2	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	ca-certificates@2020.2.41-80.0.el8_2	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/keycloak/keycloak :24.0.3	4d6f22991266	ca-certificates@2023.2.60_v7.0.306-90.1.el9_2	0:2024.2.69_v8.0.303-91.4.el9_4	1
quay.io/keycloak/keycloak :23.0.3	4f72a5b0c076	ca-certificates@2023.2.60_v7.0.306-90.1.el9_2	0:2024.2.69_v8.0.303-91.4.el9_4	1
quay.io/keycloak/keycloak :20.0.1	8830f76112b6	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/keycloak/keycloak-operator :19.0.3-legacy	09d52508fee9	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/keycloak/keycloak-operator :19.0.2-legacy	15fa0ed662b1	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/keycloak/keycloak-operator :18.0.0-legacy	36ce77526145	ca-certificates@2021.2.50-80.0.el8_4	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/keycloak/keycloak-operator :20.0.2	b1710745fa64	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/kiali/kiali :v1.89.3	0dcdb1c1e747	ca-certificates@2023.2.60_v7.0.306-80.0.el8_8	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/kiwigrid/k8s-sidecar :1.10.7	18feb3906286	certifi@2020.12.5	2023.7.22	1
quay.io/kiwigrid/k8s-sidecar :1.15.6	1f025ae37b7b	certifi@2021.10.8	2023.7.22	1
quay.io/kiwigrid/k8s-sidecar :1.21.0	710e23b489c5	certifi@2022.9.24	2023.7.22	1
quay.io/kiwigrid/k8s-sidecar :1.15.1	a25886092fa4	certifi@2021.10.8	2023.7.22	1
quay.io/maximilianopizarro/workshop-pipelines :latest	e383ba3e0966	ca-certificates@2021.2.50-80.0.el8_4	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/mcouliba/quarkus-serverless :1.0	c2851757eca4	ca-certificates@2019.2.32-80.0.el8_1	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/minio/directpv :v4.0.8	4560083eb77d	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/minio/mc :RELEASE.2022-10-20T23-26-33Z	50ee58bc9770	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/minio/mc :RELEASE.2022-09-16T09-16-47Z	546a8b52d7b0	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/minio/minio :RELEASE.2022-09-17T00-09-45Z	c3d20bc2ea08	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/minio/minio :RELEASE.2022-10-24T18-35-07Z	d853057f2800	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/mittwald/brudi-operator :v0.2.3	edb322094359	ca-certificates@2023.2.60_v7.0.306-80.0.el8_8	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/mongodb/mongodb-kubernetes-operator :0.3.0	107a7c73af59	ca-certificates@2020.2.41-80.0.el8_2	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/nird-toolkit/jupyterhub-server :20221215-e6aa80e	cae8c0622533	certifi@2022.6.15.1	2023.7.22	1
quay.io/openshift/origin-cli :4.6	6722d5041b47	ca-certificates@2022.2.54-80.2.el8_2	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/openshift/origin-console :4.10.0	0bbe8b451fa3	ca-certificates@2023.2.60_v7.0.306-80.0.el8_2	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/openshift/origin-jenkins-agent-base :latest	c241c971aef8	ca-certificates@2023.2.60_v7.0.306-80.0.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/opsmxpublic/awsgit :v2-openssh	0d21ba756f44	certifi@2020.12.5	2023.7.22	1
quay.io/opsmxpublic/awsgit :v3-js	15a6faada3d4	certifi@2020.12.5	2023.7.22	1
quay.io/opsmxpublic/ubi8-oes-db :v3.0.0	89ee6493af89	ca-certificates@2021.2.50-80.0.el8_4	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/redhat-ai-dev/chatbot :latest	59fe607dfdf2	ca-certificates@2023.2.60_v7.0.306-90.1.el9_2	0:2024.2.69_v8.0.303-91.4.el9_4	1
quay.io/redhat-appstudio/appstudio-utils :dbbdd82734232e6289e8fbae5b4c858481a7c057	7b4202c25b67	ca-certificates@2023.2.60_v7.0.306-90.1.el9_2	0:2024.2.69_v8.0.303-91.4.el9_4	1
quay.io/redhat-cop/cert-utils-operator :v1.3.12	0290e7b2800a	ca-certificates@2023.2.60_v7.0.306-80.0.el8_8	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/redhat-cop/patch-operator :v0.1.11	030ade9b9428	ca-certificates@2023.2.60_v7.0.306-90.1.el9_2	0:2024.2.69_v8.0.303-91.4.el9_4	1
quay.io/rht-labs/stack-do500 :3.0.8	6ba82beff18e	ca-certificates@2020.2.41-80.0.el8_2	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/strimzi/operator :0.36.1	e9e03b31007c	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10	1
quay.io/wi_stefan/dss-validation-service :0.0.1	8e928db29ee1	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/mongodb :4.4.5	cf72810d33f5	ca-certificates@2020.2.41-80.0.el8_2	0:2024.2.69_v8.0.303-80.0.el8_10	1
registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator :0.5.1	36b19b72120e	ca-certificates@2021.2.50-80.0.el8_4	0:2024.2.69_v8.0.303-80.0.el8_10	1
registry.gitlab.com/infinitydon/registry/open5gs-aio :v2.2.2	f6385712935f	python-pip@20.0.2-5ubuntu1.1	no fix listed	1
registry.gitlab.com/open-forms/forms-catalogue :latest	4eaf9c911f33	certifi@2021.5.30	2023.7.22	1
registry.gitlab.com/open-forms/request-registry :latest	0886cbbc5f95	certifi@2021.5.30	2023.7.22	1