GitHub Advisoryadvisory · PyPI
GHSA-248v-346w-9cwc Certifi removes GLOBALTRUST root certificate
LOW
Official page ↗
- Aliases
- CVE-2024-39689
- Ecosystem
- PyPI
- Packages
- certifi
- Severity
- Low
- Weaknesses
- CWE-345
- Reviewed
- 2024-07-05
Affected packages
• PyPI certifi: >= 2021.5.30, < 2024.7.4 → fixed in 2024.7.4
Description
Certifi 2024.07.04 removes root certificates from "GLOBALTRUST" from the root store. These are in the process of being removed from Mozilla's trust store.
GLOBALTRUST's root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues". Conclusions of Mozilla's investigation can be found here.
Related
Alias · CVE (1)
- CVE-2024-39689 Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of… vulnerability
Weakness · CWE (1)
- CWE-345 Insufficient Verification of Data Authenticity weakness
References
- https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc web
- https://nvd.nist.gov/vuln/detail/CVE-2024-39689 advisory
- https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463 web
- https://github.com/certifi/python-certifi package
- https://github.com/pypa/advisory-database/tree/main/vulns/certifi/PYSEC-2024-230.yaml web
- https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI web
- https://security.netapp.com/advisory/ntap-20241206-0001 web