Executive brief
Certifi is a Python package that maintains a database of trusted root certificates used to verify the authenticity of SSL/TLS connections. GLOBALTRUST root certificates have been removed from Certifi's trust store due to long-running compliance issues identified in Mozilla's investigation. Applications relying on these certificates to validate GLOBALTRUST-issued server certificates will no longer recognize them as valid, potentially causing connection failures to legitimate services.
Technical details
This is a certificate revocation event, not a software vulnerability per se. Certifi version 2024.07.04 and later remove GLOBALTRUST root certificates from its bundled certificate authority store in response to Mozilla's decision to distrust them following a compliance investigation. The removal affects all applications using Certifi that previously accepted GLOBALTRUST-issued certificates for TLS authentication. Services relying on GLOBALTRUST certificates will experience certificate validation failures in applications updated to the patched version. This is a deliberate security measure to prevent potential man-in-the-middle attacks by untrusted CAs, rather than a code-level vulnerability requiring patching for security reasons.
Affected products
- Python Software Foundation certifi 2021.5.30 to 2024.7.2
Timeline
- 2024-07-05: disclosed
- 2024-07-04: patched