CVE-2024-39689
Certifi removes GLOBALTRUST root certificate
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from GLOBALTRUST. Certifi 2024.7.04 removes root certificates from GLOBALTRUST from the root store. These are in the process of being removed from Mozilla's trust store. GLOBALTRUST's root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Certifi removes GLOBALTRUST root certificate
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from GLOBALTRUST. Certifi 2024.7.04 removes root certificates from GLOBALTRUST from the root store. These are in the process of being removed from Mozilla's trust store. GLOBALTRUST's root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."
- Record
CVE-2024-39689- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-345
- Updated
- 2026-11-02
EUVDEUVD-2024-2220
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from GLOBALTRUST. Certifi 2024.7.04 removes root certificates from GLOBALTRUST from the root store. These are in the process of being removed from Mozilla's trust store. GLOBALTRUST's root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."
- Record
EUVD-2024-2220- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-248v-346w-9cwc No score
Certifi removes GLOBALTRUST root certificate
Certifi 2024.07.04 removes root certificates from "GLOBALTRUST" from the root store. These are in the process of being removed from Mozilla's trust store.
GLOBALTRUST's root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues". Conclusions of Mozilla's investigation can be found here.
- Record
GHSA-248v-346w-9cwc- Weakness
- CWE-345
- Updated
- 2026-11-02
NVD
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from GLOBALTRUST. Certifi 2024.7.04 removes root certificates from GLOBALTRUST from the root store. These are in the process of being removed from Mozilla's trust store. GLOBALTRUST's root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."
- Record
CVE-2024-39689- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-345
- Updated
- 2026-11-02
OSV
Certifi removes GLOBALTRUST root certificate
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from GLOBALTRUST. Certifi 2024.7.04 removes root certificates from GLOBALTRUST from the root store. These are in the process of being removed from Mozilla's trust store. GLOBALTRUST's root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."
- Record
CVE-2024-39689- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-345
- Updated
- 2026-11-07
OSVDEBIAN-CVE-2024-39689
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from GLOBALTRUST. Certifi 2024.7.04 removes root certificates from GLOBALTRUST from the root store. These are in the process of being removed from Mozilla's trust store. GLOBALTRUST's root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."
- Record
DEBIAN-CVE-2024-39689- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 13 moreShow less
OSVOESA-2026-2145
ca-certificates security update
This package contains the set of CA certificates chosen by the Mozilla Foundation for use with the Internet PKI.
Security Fix(es):
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.05.30 and prior to 2024.07.4 recognized root certificates from GLOBALTRUST. Certifi 2024.07.04 removes root certificates from GLOBALTRUST from the root store. These are in the process of being removed from Mozilla s trust store. GLOBALTRUST s root certificates are being removed pursuant to an investigation which identified long-running and unresolved compliance issues.(CVE-2024-39689)
- Record
OESA-2026-2145- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVPYSEC-2024-230
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.05.30 and prior to 2024.07.4 recognized root certificates from GLOBALTRUST. Certifi 2024.07.04 removes root certificates from GLOBALTRUST from the root store. These are in the process of being removed from Mozilla's trust store. GLOBALTRUST's root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."
- Record
PYSEC-2024-230- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-39689
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from GLOBALTRUST. Certifi 2024.7.04 removes root certificates from GLOBALTRUST from the root store. These are in the process of being removed from Mozilla's trust store. GLOBALTRUST's root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."
- Record
UBUNTU-CVE-2024-39689- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1785815308 No score
TuxCare security update for certifi (1 CVE)
TuxCare rebuilt certifi to address 1 CVE. Fixed in 2021.10.8.post3+tuxcare.
- Record
CLSA-2026-1785815308- Updated
- 2026-11-02
OSVCLSA-2026-1785914728 No score
TuxCare security update for certifi (2 CVEs)
TuxCare rebuilt certifi to address 2 CVEs. Fixed in 2022.12.7.post3+tuxcare.
- Record
CLSA-2026-1785914728- Updated
- 2026-11-02
OSVCLSA-2026-1785934478 No score
TuxCare security update for certifi (1 CVE)
TuxCare rebuilt certifi to address 1 CVE. Fixed in 2023.7.22.post2+tuxcare.
- Record
CLSA-2026-1785934478- Updated
- 2026-11-02
OSVGHSA-248v-346w-9cwc No score
Certifi removes GLOBALTRUST root certificate
Certifi 2024.07.04 removes root certificates from "GLOBALTRUST" from the root store. These are in the process of being removed from Mozilla's trust store.
GLOBALTRUST's root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues". Conclusions of Mozilla's investigation can be found here.
- Record
GHSA-248v-346w-9cwc- Weakness
- CWE-345
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14118-1 No score
python310-certifi-2024.7.4-1.1 on GA media
These are all security issues fixed in the python310-certifi-2024.7.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14118-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14997-1 No score
oci-cli-3.54.1-1.1 on GA media
These are all security issues fixed in the oci-cli-3.54.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14997-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11421-1 No score
python313-certifi-2026.7.22-1.1 on GA media
These are all security issues fixed in the python313-certifi-2026.7.22-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11421-1- Updated
- 2026-11-02
OSVROOT-APP-PYPI-CVE-2024-39689 No score
CVE-2024-39689 in rootio-certifi - Patched by Root
Root has patched CVE-2024-39689 in the rootio-certifi package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-CVE-2024-39689- Updated
- 2026-11-02
OSVSUSE-SU-2026:2643-1 No score
Security update for aws-iam-authenticator
This update for aws-iam-authenticator fixes the following issues
- CVE-2022-1996: CORS bypass (bsc#1200528).
- CVE-2022-2385: aws-iam-authenticator AccessKeyID validation bypass (bsc#1201395).
- CVE-2024-39689: remove root certificates from
GLOBALTRUSTfrom the root store. - CVE-2025-47910: net/http: CrossOriginProtection bypass patterns are over-broad.
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265842).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266651).
Changes for aws-iam-authenticator:
- Update to version 0.7.18
- Merge pull request (#1062) from CaidenBorrego/new-release
- Creating new release for CVE mitigation
- Merge pull request (#1057) from CaidenBorrego/caidenb-versionbump
- Merge remote-tracking branch 'upstream/master' into caidenb-versionbump
- Bump x/net and x/sys to remediate CVEs (bsc#1266651, CVE-2026-39821)
- Update to 0.7.17
- Merge pull request #1051 from CaidenBorrego/caidenb-versionbump
- bumping version from 0.7.16->0.7.17
- Merge pull request #1047 from CaidenBorrego/caidenb-reservedprefix-fix
- fix: honor reservedPrefixConfig for ConfigMap and CRD backends
- Merge pull request #1046 from CaidenBorrego/caidenb-gorunner-bump
- fix: reject malformed mapping ARN in userIDStrict mode for dynamic files
- Update to 0.7.16
- Merge pull request #1041 from ronaldngounou/rngounou/bump-go-1.26.3
- Pin GitHub Actions to full-length commit SHAs
- fix: bump go version to 1.26.3 for CVEs
- from version 0.7.15
- Merge pull request #1035 from Ganiredi/bump-version-0.7.15
- Bump version to 0.7.15
- Merge pull request #1030 from Ganiredi/1.36-k8s-deps
- 1.36.0 dependency update
- from version 0.7.14
- Merge pull request #1029 from CaidenBorrego/caidenb-gorunner-bump
- Bump version to 0.7.14
- Bumping gorunner image tag in Dockerfile for CVE mitigation
- from version 0.7.13
- Merge pull request #1020 from dheeraj-coding/master
- feat: add manual dispatch function for create-release.yml
- Merge pull request #1019 from dheeraj-coding/master
- fix: create-release workflow failures
- Merge pull request #1017 from Ganiredi/1.36-k8s-deps
- Merge pull request #1018 from dheeraj-coding/master
- fix: build failure due to stale gcb image by updating to latest
- Release 0.7.13
- Merge pull request #1016 from Ganiredi/1.36-k8s-deps
- Merge branch 'master' into 1.36-k8s-deps
- Merge pull request #1013 from kubernetes-sigs/dependabot/go_modules/misc-dependencies-be00ae3611
- 1.36.rc release
- Merge pull request #1015 from dheeraj-coding/master
- fix: bump go version 1.26.2 for CVEs
- chore(deps): Bump the misc-dependencies group across 3 directories with 6 updates (bsc#1265842, CVE-2026-33814)
- Merge pull request #1011 from kubernetes-sigs/dependabot/go_modules/observability-dependencies-9e34dd3c34
- Merge pull request #1009 from kubernetes-sigs/dependabot/go_modules/misc-dependencies-b5e1eeb2d5
- Merge pull request #1004 from bryantbiggs/chore/fix-goreleaser-deprecations
- Merge pull request #1010 from kubernetes-sigs/dependabot/go_modules/aws-dependencies-7118f1d525
- chore(deps): Bump the observability-dependencies group across 2 directories with 2 updates
- chore(deps): Bump the aws-dependencies group across 2 directories with 6 updates
- chore(deps): Bump the misc-dependencies group across 3 directories with 2 updates
- Merge pull request #1008 from kubernetes-sigs/dependabot/go_modules/aws-dependencies-3ce7b5fcac
- chore(deps): Bump the aws-dependencies group across 2 directories with 12 updates
- Merge pull request #1006 from kubernetes-sigs/dependabot/go_modules/k8s-dependencies-09346e948b
- chore(deps): Bump the k8s-dependencies group across 3 directories with 8 updates
- Merge pull request #1005 from kubernetes-sigs/dependabot/go_modules/aws-dependencies-508cd0fd8e
- chore(deps):…
- Record
SUSE-SU-2026:2643-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:5130-1 No score
Security update for python-certifi
This update for python-certifi fixes the following issues:
- CVE-2024-39689: remove root certificates from
GLOBALTRUSTfrom the root store (bsc#1227519). - Removed eMudhra Intermediates due to compromise (bsc#1286261, bsc#1287723).
Changes for python-certifi:
- Update to 2026.10.23.
- Record
SUSE-SU-2026:5130-1- Updated
- 2026-11-07
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
certifiPyPI |
2021.5.30 up to 2024.7.4 | 2024.7.4 |
certifiTuxCare:PyPI |
2021.10.8 up to 2021.10.8.post3+tuxcare, plus listed versions 2021.10.8.post1+tuxcare |
2021.10.8.post3+tuxcare |
certifiTuxCare:PyPI From an advisory covering 2 CVEs |
2022.12.7 up to 2022.12.7.post3+tuxcare, plus listed versions 2022.12.7.post1+tuxcare |
2022.12.7.post3+tuxcare |
certifiTuxCare:PyPI |
2023.7.22 up to 2023.7.22.post2+tuxcare, plus listed versions 2023.7.22.post1+tuxcare |
2023.7.22.post2+tuxcare |
python-certifiDebian:12 |
All versions, plus listed versions 2022.9.24-12023.11.17-12023.7.22-12024.12.14+ds-12024.6.2-1 Show 12 moreShow less2024.8.30+dfsg-12024.8.30-12025.1.31+ds-12025.11.12+ds-12026.1.4+ds-12026.10.19+ds-12026.10.23+ds-12026.2.25+ds-12026.4.22+ds-12026.5.20+ds-12026.6.17+ds-12026.7.22+ds-1 |
None known |
python-certifiDebian:13 |
before 2024.8.30-1 | 2024.8.30-1 |
python-certifiDebian:14 |
before 2024.8.30-1 | 2024.8.30-1 |
certifiPyPI |
2021.5.30 up to 2024.7.4, plus listed versions 2021.10.82022.12.72022.5.182022.5.18.12022.6.15 Show 9 moreShow less2022.6.15.12022.6.15.22022.9.142022.9.242023.11.172023.5.72023.7.222024.2.22024.6.2 |
2024.7.4 |
ca-certificatesopenEuler:20.03-LTS-SP4 |
before 2023.2.60-5.oe2003sp4 | 2023.2.60-5.oe2003sp4 |
ca-certificatesopenEuler:22.03-LTS-SP4 |
before 2023.2.60-6.oe2203sp4 | 2023.2.60-6.oe2203sp4 |
Show 25 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ca-certificatesopenEuler:24.03-LTS |
before 2023.2.64-5.oe2403sp3 | 2023.2.64-5.oe2403sp3 |
ca-certificatesopenEuler:24.03-LTS-SP1 |
before 2023.2.64-5.oe2403sp1 | 2023.2.64-5.oe2403sp1 |
ca-certificatesopenEuler:24.03-LTS-SP3 |
before 2023.2.64-5.oe2403sp3 | 2023.2.64-5.oe2403sp3 |
certifiPyPI |
2021.5.30 up to 2024.7.4, plus listed versions 2021.10.82022.12.72022.5.182022.5.18.12022.6.15 Show 45 moreShow less2022.6.15.12022.6.15.22022.9.142022.9.242023.11.172023.5.72023.7.222024.2.22024.6.22024.06.022024.02.022023.07.222023.05.072022.12.072022.09.242022.09.142022.06.15.22022.06.15.12022.06.152022.05.18.12022.05.182021.10.082021.05.302020.12.052020.11.082020.06.202020.04.05.22020.04.05.12020.04.052019.11.282019.09.112019.06.162019.03.092018.11.292018.10.152018.08.242018.08.132018.04.162018.01.182017.11.052017.07.27.12017.04.172017.01.232016.09.262016.08.31 |
2024.7.4 |
rootio-certifiRoot:PyPI |
before 2023.11.17+root.io.1 | 2023.11.17+root.io.12023.11.17+root.io.2 |
certifiRoot:PyPI |
before 2023.11.17+aikido.2 | 2023.11.17+aikido.2 |
aws-iam-authenticatorSUSE:Linux Enterprise Module for Public Cloud 15 SP4 From an advisory covering 6 CVEs |
before 0.7.18-150000.1.17.1 | 0.7.18-150000.1.17.1 |
aws-iam-authenticatorSUSE:Linux Enterprise Module for Public Cloud 15 SP5 From an advisory covering 6 CVEs |
before 0.7.18-150000.1.17.1 | 0.7.18-150000.1.17.1 |
aws-iam-authenticatorSUSE:Linux Enterprise Module for Public Cloud 15 SP6 From an advisory covering 6 CVEs |
before 0.7.18-150000.1.17.1 | 0.7.18-150000.1.17.1 |
aws-iam-authenticatorSUSE:Linux Enterprise Module for Public Cloud 15 SP7 From an advisory covering 6 CVEs |
before 0.7.18-150000.1.17.1 | 0.7.18-150000.1.17.1 |
python-certifiSUSE:Linux Enterprise Module for Public Cloud 15 SP4 |
before 2026.10.23-150400.12.10.1 | 2026.10.23-150400.12.10.1 |
python-certifiSUSE:Linux Enterprise Module for Python 3 15 SP7 |
before 2026.10.23-150400.12.10.1 | 2026.10.23-150400.12.10.1 |
python-certifiSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 2026.10.23-150400.12.10.1 | 2026.10.23-150400.12.10.1 |
python-certifiSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 2026.10.23-150400.12.10.1 | 2026.10.23-150400.12.10.1 |
python-certifiSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 2026.10.23-150400.12.10.1 | 2026.10.23-150400.12.10.1 |
python-certifiSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 2026.10.23-150400.12.10.1 | 2026.10.23-150400.12.10.1 |
python-certifiSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 2026.10.23-150400.12.10.1 | 2026.10.23-150400.12.10.1 |
python-certifiSUSE:Linux Enterprise Server 15 SP5-LTSS |
before 2026.10.23-150400.12.10.1 | 2026.10.23-150400.12.10.1 |
python-certifiSUSE:Linux Enterprise Server 15 SP6-LTSS |
before 2026.10.23-150400.12.10.1 | 2026.10.23-150400.12.10.1 |
python-certifiSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 2026.10.23-150400.12.10.1 | 2026.10.23-150400.12.10.1 |
python-certifiSUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 2026.10.23-150400.12.10.1 | 2026.10.23-150400.12.10.1 |
python-certifiSUSE:Linux Enterprise Server for SAP Applications 15 SP6 |
before 2026.10.23-150400.12.10.1 | 2026.10.23-150400.12.10.1 |
python-certifiopenSUSE:Tumbleweed |
before 2024.7.4-1.1 | 2024.7.4-1.1 |
oci-cliopenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 3.54.1-1.1 | 3.54.1-1.1 |
python-certifiopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 2026.7.22-1.1 | 2026.7.22-1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | roy-aladin/InfraTest | 2024-03-20 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-39689 is a high vulnerability (CVSS 7.5) in Certifi, published July 5, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.05%, the 64th percentile. Fixed in certifi 2024.7.4.
References
github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc
groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI
security.netapp.com/advisory/ntap-20241206-0001
nvd.nist.gov/vuln/detail/CVE-2024-39689
Show 29 moreShow less
security-tracker.debian.org/tracker/CVE-2024-39689
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-2145
suse.com/support/update/announcement/2026/suse-su-20262643-1
bugzilla.suse.com/1200528
ubuntu.com/security/CVE-2024-39689
cve.org/CVERecord?id=CVE-2024-39689
lists.opensuse.org/archives/list/[email protected]/thread/RJHTSZ2BBTEOR5VWX6IPMTWJ5V4265YW
Left out here: 11 versions and the rest of 1 source description. The JSON record has them.