Is CVE-2024-39689 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-39689 being exploited in the wild.

How severe is CVE-2024-39689?

Low severity, with a CVSS score of 3.1, published 5 July 2024.

Which products and versions are affected?

certifi (PyPI) ECOSYSTEM:introduced=2021.5.30,fixed=2024.7.4, GIT:introduced=0,fixed=bd8153872e9c6fc98f4023df9c2deaffea2fa463|ECOSYSTEM:introduced=2021.5.30,fixed=2024.7.4.

Is there a fix for CVE-2024-39689?

Yes. certifi (PyPI): upgrade to 2024.7.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-39689 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-39689?

Check whether you run certifi (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-39689: Certifi GLOBALTRUST root certificate removal

CVE-2024-39689 · Severity: low · CVSS 3.1 · Published 2024-07-05

Certifi is a Python package that maintains a database of trusted root certificates used to verify the authenticity of SSL/TLS connections. GLOBALTRUST root certificates have been removed from Certifi's trust store due to long-running compliance issues identified in Mozilla's investigation. Applications relying on these certificates to validate GLOBALTRUST-issued server certificates will no longer recognize them as valid, potentially causing connection failures to legitimate services.

Technologies: certifi (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2024-39689 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-39689 being exploited in the wild.
How severe is CVE-2024-39689?: Low severity, with a CVSS score of 3.1, published 5 July 2024.
Which products and versions are affected?: certifi (PyPI) ECOSYSTEM:introduced=2021.5.30,fixed=2024.7.4, GIT:introduced=0,fixed=bd8153872e9c6fc98f4023df9c2deaffea2fa463|ECOSYSTEM:introduced=2021.5.30,fixed=2024.7.4.
Is there a fix for CVE-2024-39689?: Yes. certifi (PyPI): upgrade to 2024.7.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-39689 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-39689?: Check whether you run certifi (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

certifi (PyPI): upgrade to 2024.7.4 or later
```
pip install "certifi>=2024.7.4"
```

Technical details

This is a certificate revocation event, not a software vulnerability per se. Certifi version 2024.07.04 and later remove GLOBALTRUST root certificates from its bundled certificate authority store in response to Mozilla's decision to distrust them following a compliance investigation. The removal affects all applications using Certifi that previously accepted GLOBALTRUST-issued certificates for TLS authentication. Services relying on GLOBALTRUST certificates will experience certificate validation failures in applications updated to the patched version. This is a deliberate security measure to prevent potential man-in-the-middle attacks by untrusted CAs, rather than a code-level vulnerability requiring patching for security reasons.

Affected products

Python Software Foundation certifi 2021.5.30 to 2024.7.2

Identifiers

CVE-2024-39689
GHSA-248v-346w-9cwc
PYSEC-2024-230

Timeline

2024-07-05: disclosed
2024-07-04: patched

References

https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.