# CVE-2024-39689: Certifi GLOBALTRUST root certificate removal

Source: https://junglewise.ai/threats/cve-2024-39689-certifi-globaltrust-root-certificate-removal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-07-05. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2024-39689 · Severity: low · CVSS 3.1 · Published 2024-07-05

Certifi is a Python package that maintains a database of trusted root certificates used to verify the authenticity of SSL/TLS connections. GLOBALTRUST root certificates have been removed from Certifi's trust store due to long-running compliance issues identified in Mozilla's investigation. Applications relying on these certificates to validate GLOBALTRUST-issued server certificates will no longer recognize them as valid, potentially causing connection failures to legitimate services.

Technologies: [certifi (PyPI)](https://junglewise.ai/threats/technologies/certifi). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2024-39689 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-39689 being exploited in the wild.

**How severe is CVE-2024-39689?** Low severity, with a CVSS score of 3.1, published 5 July 2024.

**Which products and versions are affected?** certifi (PyPI) ECOSYSTEM:introduced=2021.5.30,fixed=2024.7.4, GIT:introduced=0,fixed=bd8153872e9c6fc98f4023df9c2deaffea2fa463|ECOSYSTEM:introduced=2021.5.30,fixed=2024.7.4.

**Is there a fix for CVE-2024-39689?** Yes. certifi (PyPI): upgrade to 2024.7.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-39689 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-39689?** Check whether you run certifi (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- certifi (PyPI): upgrade to 2024.7.4 or later

  ```sh
  pip install "certifi>=2024.7.4"
  ```


## Technical details

This is a certificate revocation event, not a software vulnerability per se. Certifi version 2024.07.04 and later remove GLOBALTRUST root certificates from its bundled certificate authority store in response to Mozilla's decision to distrust them following a compliance investigation. The removal affects all applications using Certifi that previously accepted GLOBALTRUST-issued certificates for TLS authentication. Services relying on GLOBALTRUST certificates will experience certificate validation failures in applications updated to the patched version. This is a deliberate security measure to prevent potential man-in-the-middle attacks by untrusted CAs, rather than a code-level vulnerability requiring patching for security reasons.

## Affected products

- Python Software Foundation certifi 2021.5.30 to 2024.7.2

## Identifiers

- CVE-2024-39689
- GHSA-248v-346w-9cwc
- PYSEC-2024-230

## Timeline

- 2024-07-05: disclosed
- 2024-07-04: patched

## References

- [https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc](https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc)

## Related threats

- [certifi bundled root CA compromised intermediate key exposure](https://junglewise.ai/threats/pysec-2026-4320-certifi-bundles-emsign-root-cas-with-compromised-f1149678)
- [certifi emSign root CAs with compromised intermediate keys](https://junglewise.ai/threats/certifi-bundles-emsign-root-cas-with-compromised-intermediate-ca-keys-e7e757f2)
- [Removal of e-Tugra root certificate](https://junglewise.ai/threats/cve-2023-37920-removal-of-e-tugra-root-certificate)
- [Certifi removing TrustCor root certificate](https://junglewise.ai/threats/cve-2022-23491-certifi-removing-trustcor-root-certificate)