Junglewise Threat Intelligence

CVE-2024-39689: PYSEC-2024-230 - Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of

CVE-2024-39689 · Severity: low · CVSS 3.1 · Published 2024-07-05

Technologies: certifi (PyPI). Vendors: Python Software Foundation, PyPI.

Executive brief

Certifi is a Python package that maintains a database of trusted root certificates used to verify the authenticity of SSL/TLS connections. GLOBALTRUST root certificates have been removed from Certifi's trust store due to long-running compliance issues identified in Mozilla's investigation. Applications relying on these certificates to validate GLOBALTRUST-issued server certificates will no longer recognize them as valid, potentially causing connection failures to legitimate services.

Technical details

This is a certificate revocation event, not a software vulnerability per se. Certifi version 2024.07.04 and later remove GLOBALTRUST root certificates from its bundled certificate authority store in response to Mozilla's decision to distrust them following a compliance investigation. The removal affects all applications using Certifi that previously accepted GLOBALTRUST-issued certificates for TLS authentication. Services relying on GLOBALTRUST certificates will experience certificate validation failures in applications updated to the patched version. This is a deliberate security measure to prevent potential man-in-the-middle attacks by untrusted CAs, rather than a code-level vulnerability requiring patching for security reasons.

Affected products

  • Python Software Foundation certifi 2021.5.30 to 2024.7.2

Timeline

  • 2024-07-05: disclosed
  • 2024-07-04: patched

References

Related threats