high7.5
CVE-2024-39689
Certifi removes GLOBALTRUST root certificate
Impact
Certifi 2024.07.04 removes root certificates from "GLOBALTRUST" from the root store. These are in the process of being removed from Mozilla's trust store. GLOBALTRUST's root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues". Conclusions of Mozilla's investigation can be found [here]( https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI).
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | certifi | >= 2021.5.30, < 2024.7.4 | 2024.7.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Certifi | Certifi | from 2021.5.30 before 2024.7.4 |
| Netapp | Management Services For Element Software And Netapp Hci | All versions |
| Netapp | Ontap Select Deploy Administration Utility | All versions |
| Netapp | Ontap Tools | Version 10 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463
- https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc
- https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI
- https://security.netapp.com/advisory/ntap-20241206-0001/
- https://github.com/advisories/GHSA-248v-346w-9cwc
- https://nvd.nist.gov/vuln/detail/CVE-2024-39689
- https://security.netapp.com/advisory/ntap-20241206-0001
- https://github.com/pypa/advisory-database/tree/main/vulns/certifi/PYSEC-2024-230.yaml