Skip to content
OpenAdvisories
High · 7.5 Public exploit CVE-2024-39689 EUVD-2024-2220GHSA-248v-346w-9cwcPYSEC-2024-230

Certifi removes GLOBALTRUST root certificate

Published Jul 5, 2024 · Updated Feb 14, 2025 · Assigned by GitHub_M

Vendor: certifi Product: python-certifi Package: airflow Package: az Package: az-iamguarded-compat Package: certifi Package: checkov Package: confluent-docker-utils Package: dask-gateway Package: dask-gateway-server Package: jwt-tool Package: k8s-sidecar Package: katib-controller Package: katib-controller-compat Package: katib-db-manager Package: katib-db-manager-compat Package: katib-earlystopping Package: katib-file-metricscollector Package: katib-file-metricscollector-compat Package: katib-suggestion-goptuna Package: katib-suggestion-goptuna-compat Package: katib-suggestion-hyperband Package: katib-suggestion-hyperopt Package: katib-suggestion-nas-darts Package: katib-suggestion-nas-enas Package: katib-suggestion-optuna-enas Package: katib-suggestion-pbt-enas Package: katib-suggestion-skopt-enas Package: katib-tfevent-metricscollector Package: kubeflow-jupyter-web-app Package: kubeflow-katib Package: kubeflow-pipelines Package: kubeflow-pipelines-apiserver Package: kubeflow-pipelines-cache_server Package: kubeflow-pipelines-cache-deployer Package: kubeflow-pipelines-cache-deployer-compat Package: kubeflow-pipelines-frontend Package: kubeflow-pipelines-metadata-envoy-config Package: kubeflow-pipelines-metadata-writer Package: kubeflow-pipelines-metadata-writer-compat Package: kubeflow-pipelines-persistence_agent Package: kubeflow-pipelines-scheduledworkflow Package: kubeflow-pipelines-viewer-crd-controller Package: kubeflow-pipelines-visualization-server Package: kubeflow-volumes-web-app Package: patroni Package: py3-cassandra-medusa Package: py3-cassandra-medusa-compat Package: py3-certifi Package: py3-pipenv Package: py3-supported-pipenv Package: py3.10-pipenv Package: py3.10-pipenv-bin Package: py3.11-pipenv Package: py3.11-pipenv-bin Package: py3.12-pipenv Package: py3.12-pipenv-bin Package: py3.13-pipenv Package: py3.13-pipenv-bin Package: python-certifi Package: reflex Ecosystem: Debian Ecosystem: PyPI Ecosystem: Wolfi

Description

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.7.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."

Affected products

VendorProductAffectedFixed
certifi python-certifi >= 2021.5.30, < 2024.7.4 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 python-certifi 2024.8.30-1 —
Debian 13 python-certifi 2024.8.30-1 —
Debian 12 python-certifi No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 aws-iam-authenticator 0.7.18-150000.1.17.1 SUSE-SU-2026:2643-1
SLES 15 SP6 aws-iam-authenticator 0.7.18-150000.1.17.1 SUSE-SU-2026:2643-1
SLES 15 SP6 python-certifi 2026.10.23-150400.12.10.1 SUSE-SU-2026:5130-1
SLES 15 SP5 aws-iam-authenticator 0.7.18-150000.1.17.1 SUSE-SU-2026:2643-1
SLES 15 SP5 python-certifi 2026.10.23-150400.12.10.1 SUSE-SU-2026:5130-1
SLES 15 SP4 aws-iam-authenticator 0.7.18-150000.1.17.1 SUSE-SU-2026:2643-1
SLES 15 SP4 python-certifi 2026.10.23-150400.12.10.1 SUSE-SU-2026:5130-1
SLES 3 python-certifi 2026.10.23-150400.12.10.1 SUSE-SU-2026:5130-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP6 python-certifi 2026.10.23-150400.12.10.1 SUSE-SU-2026:5130-1
SLES for SAP 15 SP5 python-certifi 2026.10.23-150400.12.10.1 SUSE-SU-2026:5130-1
SLES for SAP 15 SP4 python-certifi 2026.10.23-150400.12.10.1 SUSE-SU-2026:5130-1
SLE HPC 15 SP5 python-certifi 2026.10.23-150400.12.10.1 SUSE-SU-2026:5130-1
SLE HPC 15 SP4 python-certifi 2026.10.23-150400.12.10.1 SUSE-SU-2026:5130-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed oci-cli 3.54.1-1.1 openSUSE-SU-2025:14997-1
openSUSE Tumbleweed python-certifi 2024.7.4-1.1 openSUSE-SU-2026:11421-1, openSUSE-SU-2024:14118-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 ca-certificates 2023.2.68-1.0.amzn2023.0.1 ALAS2023-2024-682
Amazon Linux 2 ca-certificates 2023.2.68-1.amzn2.0.1 ALAS2-2024-2607

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling airflow 2.9.2-r2 —
Wolfi rolling az +1 2.61.0-r2 —
Wolfi rolling checkov 3.0.34-r1 —
Wolfi rolling confluent-docker-utils 0.0.82-r1 —
Wolfi rolling dask-gateway +1 2024.1.0-r8 —
Wolfi rolling jwt-tool 2.2.7-r1 —
Wolfi rolling k8s-sidecar 1.27.4-r2 —
Wolfi rolling kubeflow-jupyter-web-app 1.8.0-r10 —
Wolfi rolling kubeflow-katib +17 0.18.0-r0 —
Wolfi rolling kubeflow-pipelines +11 2.2.0-r6 —
Wolfi rolling kubeflow-pipelines-visualization-server 2.3.0-r1 —
Wolfi rolling kubeflow-volumes-web-app 1.8.0-r8 —
Wolfi rolling patroni 3.3.2-r0 —
Wolfi rolling py3-cassandra-medusa +1 0.23.0-r30 —
Wolfi rolling py3-certifi 2024.07.04-r0 —
Wolfi rolling py3-pipenv +9 2024.4.1-r0 —
Wolfi rolling reflex 0.5.6-r0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • roy-aladin/InfraTest ★ 0 · Mar 20, 2024

    DO NOT FORK, DEPLOY, OR USE FOR ANYTHING BUT LEARNING. These requirements are vulnerable to CVE-2024-39689

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI certifi >= 2021.5.30, < 2024.7.4 2024.7.4 GHSA-248v-346w-9cwc

Advisories 19

References