Root Store Bypass via GLOBALTRUST Cert Removal in Certifi 2024.7.4
CVE-2024-39689 Published on July 5, 2024
Certifi removes GLOBALTRUST root certificate
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.7.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."
Vulnerability Analysis
CVE-2024-39689 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.
Weakness Type
Insufficient Verification of Data Authenticity
The software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Products Associated with CVE-2024-39689
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2024-39689 are published in these products:
Affected Versions
python-certifi Version >= 2021.5.30, < 2024.7.4 is affected by CVE-2024-39689Vulnerable Packages
The following package name and versions may be associated with CVE-2024-39689
| Package Manager | Vulnerable Package | Versions | Fixed In |
|---|---|---|---|
| pip | certifi | >= 2021.05.30, < 2024.07.04 | 2024.07.04 |
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.