CVE-2024-39689

CVE Details

Release Date:	2024-07-05
Impact:	Important	What is this?

Description

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.7.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."

See more information about CVE-2024-39689 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	7.5
Vector String:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Version:	3.1
Attack Vector:	Network
Attack Complexity:	Low
Privileges Required:	None
User Interaction:	None
Scope:	Unchanged
Confidentiality Impact:	None
Integrity Impact:	High
Availability Impact:	None

Errata information

Platform	Errata	Release Date
Oracle Linux version 8 (ol-automation-manager)	OLAMSA-2025-0003	2025-04-14
Oracle Linux version 8 (python-aiohttp)	OLAMSA-2025-0003	2025-04-14
Oracle Linux version 8 (python-django)	OLAMSA-2025-0003	2025-04-14
Oracle Linux version 8 (python-jinja2)	OLAMSA-2025-0003	2025-04-14
Oracle Linux version 8 (python-requests)	OLAMSA-2025-0003	2025-04-14