CVE-2024-39689

Removal of GLOBALTRUST root certificates due to compliance issues.

• CVSS 7.5
• CWE-345
• Configuration Issues
• Remote

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.05.30 and prior to 2024.07.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.07.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."

CVE

CVE-2024-39689

CWE

CWE-345

CVSS base score

7.5

Published

2024-07-05

OWASP

A03 Security Misconfiguration

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Configuration Issues

Subcategory

Vulnerable and Outdated Components

Accessibility scope

Remote

Impact

Unauthorized Access

Affected component

Certifi

Fixed by upgrading

Yes

Solution

Upgrade to Certifi version 2024.07.04 or later.

import certifi
import requests

# Using an older version of Certifi that includes GLOBALTRUST root certificates
# Simulating a request that may be vulnerable
response = requests.get('https://example.com', verify=certifi.where())
print(response.status_code)

import certifi
import requests

# Ensure you are using the latest version of Certifi
certifi_version = certifi.__version__
print(f"Using Certifi version: {certifi_version}")

# Make a secure request using the updated Certifi root certificates
response = requests.get('https://example.com', verify=certifi.where())
print(response.status_code)

@misc{vaitp:cve202439689,
  title        = {{Removal of GLOBALTRUST root certificates due to compliance issues.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-39689},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-39689/}}
}