CVE-2024-39689
CVE-2024-39689 · Certifi removes GLOBALTRUST root certificate
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.7.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."
CVSS 7.5 · High · EPSS 1.0% · Fix available
- Published
- Updated
Affected products and versions
python-certifi
- Versions
- >= 2021.5.30, < 2024.7.4: Affected
No fix published
python-certifi Debian:12
- Versions
- 2022.9.24-1
- 2023.11.17-1
- 2023.7.22-1
- 2024.12.14+ds-1
- 2024.6.2-1
- 2024.8.30+dfsg-1
- 2024.8.30-1
- 2025.1.31+ds-1
- 2025.11.12+ds-1
- 2026.1.4+ds-1
- 2026.2.25+ds-1
- 2026.4.22+ds-1
- 2026.5.20+ds-1
- 2026.6.17+ds-1
- 2026.7.22+ds-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
python-certifi Debian:13
- Affected ranges
- ECOSYSTEM: < 2024.8.30-1
Update to 2024.8.30-1
python-certifi Debian:14
- Affected ranges
- ECOSYSTEM: < 2024.8.30-1
Update to 2024.8.30-1
certifi PyPI
- Versions
- 2021.10.8
- 2021.5.30
- 2022.12.7
- 2022.5.18
- 2022.5.18.1
- 2022.6.15
- 2022.6.15.1
- 2022.6.15.2
- 2022.9.14
- 2022.9.24
- 2023.11.17
- 2023.5.7
- 2023.7.22
- 2024.2.2
- 2024.6.2
- Affected ranges
- ECOSYSTEM: ≥ 2021.5.30, < 2024.7.4
Update to 2024.7.4
certifi PyPI
- Versions
- 2021.10.8
- 2021.5.30
- 2022.12.7
- 2022.5.18
- 2022.5.18.1
- 2022.6.15
- 2022.6.15.1
- 2022.6.15.2
- 2022.9.14
- 2022.9.24
- 2023.11.17
- 2023.5.7
- 2023.7.22
- 2024.2.2
- 2024.6.2
- 2024.06.02
- 2024.02.02
- 2023.07.22
- 2023.05.07
- 2022.12.07
- 2022.09.24
- 2022.09.14
- 2022.06.15.2
- 2022.06.15.1
- 2022.06.15
- 2022.05.18.1
- 2022.05.18
- 2021.10.08
- 2021.05.30
- 2020.12.05
- 2020.11.08
- 2020.06.20
- 2020.04.05.2
- 2020.04.05.1
- 2020.04.05
- 2019.11.28
- 2019.09.11
- 2019.06.16
- 2019.03.09
- 2018.11.29
- 2018.10.15
- 2018.08.24
- 2018.08.13
- 2018.04.16
- 2018.01.18
- 2017.11.05
- 2017.07.27.1
- 2017.04.17
- 2017.01.23
- 2016.09.26
- 2016.08.31
- 2016.08.08
- 2016.08.02
- 2016.02.28
- 2015.11.20.1
- 2015.11.20
- 2015.09.06.2
- 2015.09.06.1
- 2015.09.06
- 2015.04.28
- v1.0.1
- v1.0.0
- Affected ranges
- GIT: < bd8153872e9c6fc98f4023df9c2deaffea2fa463
- ECOSYSTEM: ≥ 2021.5.30, < 2024.7.4
Update to 2024.7.4
Original sources
- https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc
- https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463
- https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI
- https://security.netapp.com/advisory/ntap-20241206-0001/
- https://nvd.nist.gov/vuln/detail/CVE-2024-39689