What’s Vulnerable › Vulnerabilities

CVE-2024-39689: Certifi removes GLOBALTRUST root certificate

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-07-05 · updated 2026-06-17
• Weakness: CWE-345

Description

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.7.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."

Affected products

• Certifi: from 2021.5.30 before 2024.7.4 — fixed in 2024.7.4
• NetApp Management Services For Element Software And Netapp Hci: all versions
• NetApp ONTAP Select Deploy administration utility: all versions
• NetApp Ontap Tools: 10
• Pypi Certifi: from 2021.5.30 before 2024.7.4; 2021.10.8, 2021.5.30, 2022.12.7, 2022.5.18, 2022.5.18.1, 2022.6.15 (+56) — fixed in 2024.7.4

How to fix

Upgrade to a fixed version: Certifi 2024.7.4; Pypi Certifi 2024.7.4. Check the vendor advisory for mitigations.

References

• https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463
• https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc
• https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI
• https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463
• https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc
• https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI
• https://security.netapp.com/advisory/ntap-20241206-0001/

Get alerted when CVE-2024-39689 or the next vulnerability affects your stack