CVE-2024-39689 Certifi removes GLOBALTRUST root certificate
Outdated root certificates in the certifi library allow potential trust of compromised authorities, requiring an upgrade to remove them.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-39689?
CVE-2024-39689 is a high-severity vulnerability in Netapp Ontap Select Deploy Administration Utility, published on 5 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.7.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."
Weakness: CWE-345
Which versions are affected by CVE-2024-39689?
3 open source packages ship an affected version, including certifi. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
certifi PyPI | From 2021.5.30 | 2024.7.4 |
certifi PyPI | From 2021.5.30 | 2024.7.4 |
certifi PyPI | From 2021.5.30 | 2024.7.4 |
Linux distribution packages (1)
python-certifi openSUSE:Tumbleweed | All versions | 2024.7.4-1.1 |
Products include Certifi Certifi, Netapp Management Services for Element Software and Netapp Hci, Netapp Ontap Select Deploy Administration Utility, Netapp Ontap Tools.
How do I fix CVE-2024-39689?
Upgrade certifi to 2024.7.4 or later.
Is CVE-2024-39689 being exploited?
There is no known exploitation of CVE-2024-39689 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Netapp Ontap Select Deploy Administration Utility
- CVE-2023-37920 Certifi's removal of e-Tugra root certificate
- CVE-2022-23491 Removal of TrustCor root certificate
All Netapp Ontap Select Deploy Administration Utility vulnerabilities
Sources
Also known as CLSA-2026-1785815308, CLSA-2026-1785934478, DEBIAN-CVE-2024-39689, ECHO-2c05-8db5-680f, GHSA-248v-346w-9cwc, MINI-355w-fjgc-xxwj and 5 more.