Certifi removes GLOBALTRUST root certificate
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-345.
Summary
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.7.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| certifi | python-certifi | 2021.5.30 to before 2024.7.4 | 2024.7.4 | Patch available | CNA |
| — | certifi (PyPI) | 2021.5.30 to before 2024.7.4 | 2024.7.4 | Patch available | GHSA-248v-346w-9cwc |
- python-certifi Vendorcertifi Affected 2021.5.30 to before 2024.7.4 Fixed in 2024.7.4 Patch available CNA
- certifi (PyPI) Vendor— Affected 2021.5.30 to before 2024.7.4 Fixed in 2024.7.4 Patch available GHSA-248v-346w-9cwc
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:certifi:certifi:*:*:*:*:*:python:*:* | 2021.5.30 to before 2024.7.4 | Vulnerable | certifi |
| cpe:2.3:a:netapp:management_services_for_element_software_and_netapp_hci:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:ontap_tools:10:*:*:*:*:vmware_vsphere:*:* | 10 | Vulnerable | NetApp |
- cpe:2.3:a:certifi:certifi:*:*:*:*:*:python:*:* Versions 2021.5.30 to before 2024.7.4 Vulnerable ·certifi
- cpe:2.3:a:netapp:management_services_for_element_software_and_netapp_hci:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:ontap_tools:10:*:*:*:*:vmware_vsphere:*:* Versions 10 Vulnerable ·NetApp
Remediation
- Fix · CNA python-certifi (certifi) Fixed in 2024.7.4
- Fix · GHSA-248v-346w-9cwc certifi (PyPI) Fixed in 2024.7.4 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
Not affected: 9 products
- Red Hat Ansible Automation Platform 2
- Red Hat Ceph Storage 6
- Red Hat Ceph Storage 7
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenStack Platform 16.1
- Red Hat OpenStack Platform 18.0
- Red Hat Openshift Container Storage 4
- Red Hat Satellite 6
- Red Hat Update Infrastructure 4 for Cloud Providers
Timeline
- 2026-10-02 Threatist record created from CVE-2024-39689
- 2026-10-03 Alias added: GHSA-248v-346w-9cwc
References
Advisory 3
More Certifi vulnerabilities
- TI-2023-19353 Certifi's removal of e-Tugra root certificate CVSS 3.1CRITICAL 9.8
- TI-2022-07550 Removal of TrustCor root certificate CVSS 3.1HIGH 7.5
Sources
- CVE-2024-39689 · CVE Program
- CVE-2024-39689 · NVD
- FIRST EPSS
- GHSA-248v-346w-9cwc · GitHub Advisory Database · CC BY 4.0
- CVE-2024-39689 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences