CVE-2024-39689: Certifi removes GLOBALTRUST root certificate
First published: Fri Jul 05 2024(Updated: )
Certifi 2024.07.04 removes root certificates from "GLOBALTRUST" from the root store. These are in the process of being removed from Mozilla's trust store. GLOBALTRUST's root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues". Conclusions of Mozilla's investigation can be found [here]( https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI).
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/certifi | >=2021.5.30<2024.7.4 | 2024.7.4 |
| Certifi | >=2021.5.30<2024.7.4 | |
| NetApp Management Services for NetApp HCI | ||
| NetApp ONTAP Select Deploy | ||
| netapp ontap tools vmware vsphere | =10 | |
| IBM Data Virtualization on Cloud Pak for Data | <=3.0 | |
| IBM Watson Query with Cloud Pak for Data as a Service | <=2.2 | |
| IBM Watson Query with Cloud Pak for Data as a Service | <=2.1 | |
| IBM Watson Query with Cloud Pak for Data as a Service | <=2.0 | |
| IBM Data Virtualization on Cloud Pak for Data | <=1.8 | |
| IBM Data Virtualization on Cloud Pak for Data | <=1.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc
- https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463
- https://nvd.nist.gov/vuln/detail/CVE-2024-39689
- https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI
- https://security.netapp.com/advisory/ntap-20241206-0001
- https://github.com/pypa/advisory-database/tree/main/vulns/certifi/PYSEC-2024-230.yaml
- https://github.com/advisories/GHSA-248v-346w-9cwc (Advisory)
- https://security.netapp.com/advisory/ntap-20241206-0001/
- https://www.ibm.com/support/pages/node/7183851 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2024-39689?
CVE-2024-39689 has been classified as a moderate severity vulnerability due to its potential impact on trust in root certificates.
How do I fix CVE-2024-39689?
To fix CVE-2024-39689, upgrade to Certifi version 2024.07.04 or later.
Which software is affected by CVE-2024-39689?
CVE-2024-39689 affects the Certifi package versions between 2021.05.30 and 2024.07.04, as well as certain NetApp software.
What are the implications of CVE-2024-39689?
The implications of CVE-2024-39689 primarily involve the removal of GLOBALTRUST root certificates from the trust store, potentially affecting secure communications.
What caused the CVE-2024-39689 vulnerability?
CVE-2024-39689 was caused by an investigation revealing long-standing issues with the GLOBALTRUST root certificates.
- agent/weakness
- agent/title
- agent/type
- agent/first-publish-date
- agent/severity
- agent/author
- agent/trending
- agent/remedy
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-248v-346w-9cwc
- alias/CVE-2024-39689
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- collector/nvd-cve
- agent/description
- agent/event
- collector/github-advisory
- agent/references
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup-request
- package-manager/pip
- vendor/certifi
- canonical/certifi
- version/certifi/2021.5.30
- vendor/netapp
- canonical/netapp management services for netapp hci
- canonical/netapp ontap select deploy
- canonical/netapp ontap tools vmware vsphere
- version/netapp ontap tools vmware vsphere/10
- vendor/ibm
- canonical/ibm data virtualization on cloud pak for data
- version/ibm data virtualization on cloud pak for data/3.0
- canonical/ibm watson query with cloud pak for data as a service
- version/ibm watson query with cloud pak for data as a service/2.2
- version/ibm watson query with cloud pak for data as a service/2.1
- version/ibm watson query with cloud pak for data as a service/2.0
- version/ibm data virtualization on cloud pak for data/1.8
- version/ibm data virtualization on cloud pak for data/1.7