CVE-2024-39689highCWE-345

CVE-2024-39689: high-severity vulnerability in certifi python-certifi

Certifi removes GLOBALTRUST root certificate

Published · Updated

Follow this CVE+ Monitor python-certifi+ Monitor python-certifi

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 1.0%
In short

Certifi, a library that stores trusted root certificates for validating SSL connections, removed GLOBALTRUST root certificates due to compliance issues. This removal prevents websites using GLOBALTRUST certificates from being trusted by applications using the updated Certifi library.

Technical detail

Certifi versions 2021.5.30 through 2024.7.3 accepted GLOBALTRUST root certificates for TLS host verification. Version 2024.7.4 removed these certificates from its trust store following Mozilla's action and investigation findings of non-compliance. Applications depending on older Certifi versions or pinned to GLOBALTRUST certificates will experience certificate validation failures.

Summary generated and translated by AI from the official description.
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.7.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
certifi · python-certifi
Related CVEs — certifi python-certifi

In the same product, most dangerous first.

CVE-2023-37920HIGHCertifi's removal of e-Tugra root certificateEPSS 0.6%CVE-2022-23491MEDIUMRemoval of TrustCor root certificateEPSS 0.5%