CVE-2024-39689: Certifi removes GLOBALTRUST root certificate
Certifi 2024.07.04 removes root certificates from "GLOBALTRUST" from the root store. These are in the process of being removed from Mozilla's trust store.
GLOBALTRUST's root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues". Conclusions of Mozilla's investigation can be found here.
Other sources
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from GLOBALTRUST. Certifi 2024.7.04 removes root certificates from GLOBALTRUST from the root store. These are in the process of being removed from Mozilla's trust store. GLOBALTRUST's root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39689?
CVE-2024-39689 has been classified as a moderate severity vulnerability due to its potential impact on trust in root certificates.
How do I fix CVE-2024-39689?
To fix CVE-2024-39689, upgrade to Certifi version 2024.07.04 or later.
Which software is affected by CVE-2024-39689?
CVE-2024-39689 affects the Certifi package versions between 2021.05.30 and 2024.07.04, as well as certain NetApp software.
What are the implications of CVE-2024-39689?
The implications of CVE-2024-39689 primarily involve the removal of GLOBALTRUST root certificates from the trust store, potentially affecting secure communications.
What caused the CVE-2024-39689 vulnerability?
CVE-2024-39689 was caused by an investigation revealing long-standing issues with the GLOBALTRUST root certificates.