CVE-2023-37920

Critical

Advisory

Published 25 Jul 2023In the index since 5 Sept 2026

Severity: Critical; worst across findings
CVSS: 9.8; base score, highest
EPSS: 0.006; 45th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 610; of 17,787 indexed, latest versions
Container images: 651; deployed by those charts
Fix available: 3 of 5; affected packages

Red Hat Bug Fix Advisory: ca-certificates bug fix and enhancement update

Carried by container images the latest versions of 610 of 17,787 indexed charts deploy, on 651 images.

Affected package	Affected versions	Fixed in	Images
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+19 more	no fix listed	83
python-certifideb	2018.1.18-2, 2019.11.28-1, 2020.6.20-1, 2022.9.24-1	no fix listed	57
py3-certifiapk	2023.5.7-r0	2023.7.22-r0	1
ca-certificatesrpm	2018.2.24-6.el8, 2019.2.32-80.0.el8_1, 2020.2.41-80.0.el8_2, 2021.2.50-80.0.el8_4+8 more	0:2024.2.69_v8.0.303-80.0.el8_10, 0:2024.2.69_v8.0.303-91.4.el9_4	203
certifipypi	2017.11.05, 2017.11.5, 2018.1.18, 2018.4.16+21 more	2023.7.22	427

OSV records: ALPINE-CVE-2023-37920 DEBIAN-CVE-2023-37920 RHBA-2024:5691 RHBA-2024:5736 UBUNTU-CVE-2023-37920 GHSA-xqr8-7jwr-rhp7
Also known as: PYSEC-2023-135

Charts affected

610 by stars

Chart

Latest

Affected images

Radar Score

miniowenerme

8.0.10

1 of 1 See more

minio wenerme 8.0.10

1 of the 1 container images this version deploys carry CVE-2023-37920.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2021-02-14T04-01-33Z	bd11edda91f3	ca-certificates@2020.2.41-80.0.el8_2	0:2024.2.69_v8.0.303-80.0.el8_10

Open the chart page →

6,915

minio-standalonewenerme

1.0.2

1 of 1 See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2023-37920.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2022-01-04T07-41-07Z	1484c87239ea	ca-certificates@2021.2.50-80.0.el8_4	0:2024.2.69_v8.0.303-80.0.el8_10

Open the chart page →

6,138

ceph-csi-cephfswikimedia

0.1.8

1 of 5 See more

ceph-csi-cephfs wikimedia 0.1.8

1 of the 5 container images this version deploys carry CVE-2023-37920.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	certifi@2018.10.15	2023.7.22

Open the chart page →

10,286

ceph-csi-rbdwikimedia

0.1.13

1 of 6 See more

ceph-csi-rbd wikimedia 0.1.13

1 of the 6 container images this version deploys carry CVE-2023-37920.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	certifi@2018.10.15	2023.7.22

Open the chart page →

11,785

docker-hub-rate-limit-exporterwiremind

0.3.0

1 of 1 See more

docker-hub-rate-limit-exporter wiremind 0.3.0

1 of the 1 container images this version deploys carry CVE-2023-37920.

Container image	Digest	Package	Fixed in
viadee/docker-hub-rate-limit-exporter :version-1.5	2e27e3b3ee56	certifi@2020.12.5	2023.7.22

Open the chart page →

1,843

powerdnsadminwitcom-gmbh

0.3.4

1 of 1 See more

powerdnsadmin witcom-gmbh 0.3.4

1 of the 1 container images this version deploys carry CVE-2023-37920.

Container image	Digest	Package	Fixed in
ngoduykhanh/powerdns-admin :v0.2.4	ba36ab196d3d	certifi@2021.10.8	2023.7.22

Open the chart page →

2,643

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2023-37920.

Container image	Digest	Package	Fixed in
quay.io/maximilianopizarro/workshop-pipelines :latest	e383ba3e0966	ca-certificates@2021.2.50-80.0.el8_4	0:2024.2.69_v8.0.303-80.0.el8_10

Open the chart page →

11,592

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2023-37920.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10

Open the chart page →

6,016

enterprise-gatewayzeet

3.2.2

1 of 2 See more

enterprise-gateway zeet 3.2.2

1 of the 2 container images this version deploys carry CVE-2023-37920.

Container image	Digest	Package	Fixed in
elyra/kernel-image-puller :3.2.2	c922f1f1646a	certifi@2022.12.7	2023.7.22

Open the chart page →

1,838

posthogzeet

0.23.2

1 of 9 See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2023-37920.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10

Open the chart page →

3,697

Container images carrying it

651 by charts deploying them

A fixed version is listed for 3 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/keycloak/keycloak :20.0	054ef67eb7da	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10	2
quay.io/keycloak/keycloak :17.0.1-legacy	68f9f38c8f30	ca-certificates@2021.2.50-80.0.el8_4	0:2024.2.69_v8.0.303-80.0.el8_10	2
quay.io/kiwigrid/k8s-sidecar :1.19.2	6a8671702d6f	certifi@2022.5.18.1	2023.7.22	2
quay.io/minio/mc :RELEASE.2023-09-29T16-41-22Z	a784ce6e3b1b	ca-certificates@2023.2.60_v7.0.306-80.0.el8_8	0:2024.2.69_v8.0.303-80.0.el8_10	2
quay.io/minio/mc :RELEASE.2023-01-28T20-29-38Z	ad34abeba912	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10	2
quay.io/minio/minio :RELEASE.2023-09-30T07-02-29Z	6262bc9a2730	ca-certificates@2023.2.60_v7.0.306-80.0.el8_8	0:2024.2.69_v8.0.303-80.0.el8_10	2
quay.io/minio/minio :RELEASE.2023-07-21T21-12-44Z	8e5e9490cd50	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10	2
quay.io/minio/minio :RELEASE.2023-02-10T18-48-39Z	a0a002cb113c	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10	2
quay.io/opencloudio/ibm-mongodb :4.0.24	d8c631a6dc43	ca-certificates@2020.2.41-80.0.el8_2	0:2024.2.69_v8.0.303-80.0.el8_10	2
quay.io/openshift/origin-cli :4.7	464a3af4dfe0	ca-certificates@2022.2.54-80.2.el8_4	0:2024.2.69_v8.0.303-80.0.el8_10	2
quay.io/openshift/origin-cli :4.8	bb5e052770e5	ca-certificates@2022.2.54-80.2.el8_4	0:2024.2.69_v8.0.303-80.0.el8_10	2
quay.io/strimzi/operator :0.39.0	02f6f143fc6d	ca-certificates@2023.2.60_v7.0.306-80.0.el8_8	0:2024.2.69_v8.0.303-80.0.el8_10	2
a10networks/acos-prometheus-exporter :latest	8dc58d434d71	python-pip@9.0.1-2.3~ubuntu1.18.04.1 certifi@2020.4.5.1	no fix listed 2023.7.22	1
acockburn/appdaemon :4.0.8	3a93281d7e94	certifi@2020.12.5	2023.7.22	1
adwerx/github-actions-runner :2.276.1-20.04-1	840d2b078682	python-certifi@2019.11.28-1 certifi@2019.11.28	no fix listed 2023.7.22	1
afrank/mozalert-controller :latest	d463c37b08d7	certifi@2020.6.20	2023.7.22	1
airsonicadvanced/airsonic-advanced :latest	f7cbafac2806	python-certifi@2019.11.28-1 certifi@2019.11.28	no fix listed 2023.7.22	1
akeyless/base-rhel :0.0.1	4ba8900a0061	ca-certificates@2023.2.60_v7.0.306-80.0.el8_8	0:2024.2.69_v8.0.303-80.0.el8_10	1
alerta/alerta-web :8.5.0	4786b9eaa606	certifi@2021.10.8	2023.7.22	1
alexvm6/generator :latest	fb99ee4f760a	certifi@2023.5.7	2023.7.22	1
allegroai/clearml-agent-k8s-base :1.24-21	772827a01bb5	python-pip@9.0.1-2.3~ubuntu1.18.04.5 certifi@2022.6.15	no fix listed 2023.7.22	1
allegroai/clearml-serving-inference :1.3.0	fca885e8cfc6	certifi@2022.12.7	2023.7.22	1
allegroai/clearml-serving-statistics :1.3.0	c58d9da7bdf8	certifi@2022.12.7	2023.7.22	1
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10	1
altinity/clickhouse-operator :0.20.0	8f0f582d41f0	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10	1
altinity/metrics-exporter :0.20.0	1a46d104406d	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10	1
amancevice/superset :0.28.1	c8c04bfe3d66	certifi@2018.8.24	2023.7.22	1
amundsendev/amundsen-frontend :2.1.1	69e7915e61c1	certifi@2020.4.5.1	2023.7.22	1
amundsendev/amundsen-metadata :2.5.4	4d98eb21f5f9	certifi@2020.6.20	2023.7.22	1
amundsendev/amundsen-search :2.4.0	99dda9502c3e	certifi@2020.6.20	2023.7.22	1
anchore/anchore-engine :v0.10.0	bde9eedf639d	ca-certificates@2020.2.41-80.0.el8_2 certifi@2021.5.30	0:2024.2.69_v8.0.303-80.0.el8_10 2023.7.22	1
anchore/anchore-engine :v0.7.1	ed9b3badd17c	ca-certificates@2019.2.32-80.0.el8_1 certifi@2020.4.5.1	0:2024.2.69_v8.0.303-80.0.el8_10 2023.7.22	1
andrewgolikov55/intel-gpu-exporter :latest	fcc001b61c0e	python-pip@22.0.2+dfsg-1ubuntu0.3	no fix listed	1
andrianrf/backoffice :latest	047a7837651e	ca-certificates@2023.2.60_v7.0.306-80.0.el8_8	0:2024.2.69_v8.0.303-80.0.el8_10	1
andrianrf/backoffice-be :latest	6036614803d4	ca-certificates@2022.2.54-90.2.el9_0	0:2024.2.69_v8.0.303-91.4.el9_4	1
andrianrf/iso-server :latest	7da47f525c7d	ca-certificates@2022.2.54-90.2.el9_0	0:2024.2.69_v8.0.303-91.4.el9_4	1
apache/camel-k :1.10.4	3bb13d14f64a	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10	1
apachepulsar/pulsar :3.1.0	16f9fdab3fa6	python-pip@22.0.2+dfsg-1ubuntu0.3	no fix listed	1
apachepulsar/pulsar :2.10.0	3b262ab7a7d9	python-pip@20.0.2-5ubuntu1.6 certifi@2021.10.8	no fix listed 2023.7.22	1
apachepulsar/pulsar :2.6.1	4db6ff0b4045	certifi@2020.6.20	2023.7.22	1
apachepulsar/pulsar :3.0.7	9c9947de139d	python-pip@22.0.2+dfsg-1ubuntu0.4	no fix listed	1
apachepulsar/pulsar :2.9.0	d056c89b7131	certifi@2021.10.8	2023.7.22	1
apachepulsar/pulsar :2.8.2	d538416d5afe	certifi@2021.10.8	2023.7.22	1
apache/ranger :2.7.0	76c176e8a0e4	python-pip@22.0.2+dfsg-1ubuntu0.6	no fix listed	1
apache/superset :9cdaa280429ec297db16d56c94fd77b5d2aff107	975ab033580d	certifi@2021.10.8	2023.7.22	1
apecloud/smartfs-csi-driver :0.1.1	ff2858eab9cc	ca-certificates@2023.2.60_v7.0.306-80.0.el8_8	0:2024.2.69_v8.0.303-80.0.el8_10	1
apicurio/apicurio-registry-kafkasql :2.1.0.Final	a97d67487532	ca-certificates@2020.2.41-80.0.el8_2	0:2024.2.69_v8.0.303-80.0.el8_10	1
apicurio/apicurio-studio-api :0.2.62.Final	302d202ed149	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10	1
apicurio/apicurio-studio-ui :0.2.62.Final	349c845270c2	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10	1
apicurio/apicurio-studio-ws :0.2.62.Final	27a91978a388	ca-certificates@2022.2.54-80.2.el8_6	0:2024.2.69_v8.0.303-80.0.el8_10	1