CVE-2024-39689 Certifi removes GLOBALTRUST root certificate

2024-07-0518:39:33

CWE-345

GitHub_M

github.com

certifi

root certificates

ssl validation

tls verification

globaltrust

mozilla

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

6.9

Confidence

High

EPSS

Percentile

15.8%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.05.30 and prior to 2024.07.4 recognized root certificates from GLOBALTRUST. Certifi 2024.07.04 removes root certificates from GLOBALTRUST from the root store. These are in the process of being removed from Mozilla’s trust store. GLOBALTRUST’s root certificates are being removed pursuant to an investigation which identified “long-running and unresolved compliance issues.”

CNA Affected

[
  {
    "vendor": "certifi",
    "product": "python-certifi",
    "versions": [
      {
        "status": "affected",
        "version": ">= 2021.05.30, < 2024.07.04"
      }
    ]
  }
]