Security Bulletin: IBM Maximo Application Suite - AI Broker component uses certifi-2023.7.22-py3-none-any.whl which is vulnerable to this CVE-2024-39689

Summary

IBM Maximo Application Suite - AI Broker Component includes certifi-2023.7.22-py3-none-any.whl which is vulnerable to this CVE-2024-39689. This bulletin contains information regarding the vulnerability and its fixture.

Vulnerability Details

CVEID:CVE-2024-39689
**DESCRIPTION:**Certifi python-certifi could provide weaker than expected security, caused by the use of GLOBALTRUST root certificate. An attacker could exploit this vulnerability to launch further attacks on the system.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/297375 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Affected Products and Versions

Remediation/Fixes

Affected Product(s)|

FixPack

Version(s)

—|—
IBM Maximo Application Suite - AI Broker| 1.0.1

Workarounds and Mitigations

None